COPPA FAQs: Verifiable Parental Consent
- By Sean Bryant
- Online Community
- July 9, 2013
Inversoft has provided a shortened version of the ‘Business and Parents and Small Entity Compliance Guide’.
Please remember, this is merely a simplified reference. For more detailed information refer to the link at the bottom of this page.
Verifiable Parental Consent (1 - 8)
1. When do I have to get verifiable parental consent.
The operator must obtain verifiable parental consent before any personal information from a child is collected.
Read on for exceptions.
2. May I first collect personal information from the child, and then get parental permission to such collection if I do not use the child’s information before getting the parent’s consent?
Operators must get verifiable consent prior to the collection of a child's personal information.
Limited Exceptions to certain personal information:
- Collecting parent's information is to provide voluntary information on their child's participation in a site/service that does not collect, disclose or use the child's personal information...
- Collecting contact information from the child is strictly to respond to a one-time basis request. The information cannot be used to re-contact, disclosed and must be deleted after the operator responds (or chooses not to respond).
- If contact information is collected from the child and parent for continuous responses to requests, the operator must provide notice and the option for the parent to discontinue the site's future correspondence with the child...
- Collecting child and parent's contact information is solely for the safety of the child and efforts must be made to provide the parent with appropriate notice. Collecting a persistent identifier for the purpose of providing support to internal operations of the site/service.
- Purpose of collecting a child's name and online contact information:
- Protect the security and integrity of the site/service
- Precautions again liability
- Response to judicial process
- Public safety matters: provide information to law enforcement or investigations
- Purpose of collecting a child's name and online contact information:
- Age-gated registration - a persistent identifier can collect personal information strictly to identify a user as a child/adult.
3. I collect personal information from children who use my online service, but I only use the personal information I collect for internal purposes and I never give it to third parties. Do I still need to get parental consent before collecting that information?
If the information collected falls outside the Exceptions listed above you must provide notice and obtain parental consent.
If the information collected is strictly for providing support for internal operations and is not disclosed to third parties or distributed publicly then you may obtain parental consent through email plus (See below).
4. How do I get parental consent?
Any number of methods may be used to ensure verifiable parental consent is obtained.
Methods include:
- A signed consent form via U.S. mail, fax, or scanned and emailed
- The parent must provide a credit card, debit card or another online payment option for every transaction that occurs
- Toll-free number or a vidoe-conference call the parent may contact and reach a trained personnel
- Verify a form of government issued identification against a database to confirm parent's identity (Must be deleted once completed)
- Requesting in your initial message to the parent that the parent include a phone or fax number or mailing address in the reply message, so that you can follow up with a confirming phone call, fax or letter to the parent; or
- After a reasonable time delay, sending another message via the parent’s online contact information to confirm consent. In this confirmatory message, you should include all the original information contained in the direct notice, inform the parent that he or she can revoke the consent, and inform the parent how to do so.
5. I would like to get consent by collecting a credit card or debit card number from the parent, but I do not want to engage in a monetary transaction. Is this ok?
No. Obtaining verifiable parental consent through credit/debit card or other online payment options can only take place:
- Monetary transaction must take place
- Notification is provided for every individual transaction
6. I would like to use a credit card or a government-issued identification as a method of parental consent. I am worried, however, that I will not know whether it is the child’s parent or another adult who is submitting identification for consent. Do I need to collect additional information to confirm that, in fact, it is the parent?
No.
7. What do I do if some parents cannot or will not use the consent method I have chosen? For instance, some parents might not have a credit card, or might feel uncomfortable providing government identification information online.
Offering multiple choices for consent increases the likelihood of obtaining such consent.
8. Should I give out passwords or PIN numbers to parents to confirm their identity in any future contact with them?
Once you have notified a parent and obtained verifiable consent, providing a password or a PIN number is a good way to confirm a parent’s identity for any future contact you might have with that parent...
In addition, the Rule requires you to give a parent access to any personal information you have collected from the child. Before you provide that information, you will need to confirm that the person requesting the information is the child’s parent. Again, providing the parent a password or a PIN number makes it easier to confirm the parent’s identity if the parent requests access to the child’s personal information.
For more details on Verifiable Parental Consent (9 - 14) click here.