C
hildren’s Online Privacy Act (COPPA)
The Children’s Online
Privacy Protection Act (COPPA) was signed into law on October 21,
1998. COPPA prohibits unfair or deceptive acts or practices in
connection with the collection, use, or disclosure of personally
identifiable information from and about children on the Internet. The
Federal Trade Commission (FTC) issued the enclosed final rule, 16 CFR
Part 312, effective April 21, 2000.
COPPA and the FTC’s implementing rule generally apply to financial
institutions that operate commercial websites or provide online
services (or portions thereof) directed to, or knowingly collect
personal information from children under the age of 13.
COPPA and the FTC’s rule require those financial institutions to:
- Provide parents notice of their information practices;
- Obtain prior verifiable parental consent for the collection,
use, and/or disclosure of personal information from children (with
certain limited exceptions for the collection of “online contract
information, “e.g., an e-mail address);
- Provide a parent, upon request, with the means to review the
personal information collected from his/her child;
- Provide a parent with the opportunity to prevent the further use
of personal information that has already been collected, or the
future collection of personal information from that child;
- Limit collection of personal information for a child’s online
participation in a game, prize, offer, or other activity to
information that is reasonably necessary for the activity; and
- Establish and maintain reasonable procedures to protect the
confidentiality, security, and integrity of the personal information
collected.
At this time, Berks Community Federal Credit Union falls under the
exceptions category of the November, 1999 How to Comply with The
Children’s Online Privacy Protection Rule.
The regulations include several exceptions that allow operators to
collect a child’s e-mail address without getting the parents consent
in advance. These exceptions cover many popular online activities for
kids, including contests, online newsletters, homework help and
electronic postcards.
Prior parental consent is not required when:
- An operator collects a child’s or parent’s e-mail address to
provide notice and seek consent;
- An operator collects an e-mail address to respond more than once
to a specific request – say, for a subscription to a newsletter. In
this case, the operator must notify the parent that it is
communicating regularly with the child and give the parent the
opportunity to stop the communication before sending or delivering a
second communication to a child;
- An operator collects a child’s name or online contact
information to protect the safety of a child who is participating on
the site. In this case, the operator must notify the parent and
give him or her the opportunity to prevent further use of the
information;
An operator collects a
child’s name or online contact information to protect the security or
liability of the site or to respond to law enforcement, if necessary,
and does not use it for any other purpose.
