united-states privacy children website coppa
How much evidence do I need in their ban appeal that they are actually 13+ to unban someone who was banned for being under 13 (to comply with COPPA)?
<p>Since my site collects personal information, people under 13 years of age are not allowed because of the COPPA law (and the site is not directed towards children).</p>

<p>The most common ban appeals that these people make are:</p>

<ul>
<li>The person claims they were joking when they said they were 12 in the chat and they're actually older than 13.</li>
<li>Some months pass after a 12 year old is banned, and they claim that they have now turned 13</li>
</ul>

<p><strong>Can I take someone's word for it that they are 13+, or do I need some sort of proof like an ID or birth certificate?</strong> Is it even okay to ask for such private documents?</p>

<p>The <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=4939e77c77a1a1a08c1cbf905fc4b409&amp;node=16%3A1.0.1.3.36&amp;rgn=div5" rel="nofollow noreferrer">regulations</a> are addressed to the "operator of a Web site or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child". If you have an enforced policy of banning those under 13, you gain "actual knowledge" of the status of the liar when yuo learn their age. The FTC addresses the lying child question in <a href="https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions" rel="nofollow noreferrer">FAQ 14</a>, saying</p>

<blockquote>
  <p>The Rule does not require operators to ask the age of visitors. 
  However, an operator of a general audience site or service that
  chooses to screen its users for age in a neutral fashion may rely on
  the age information its users enter, even if that age information is
  not accurate.  In some circumstances, this may mean that children are
  able to register on a site or service in violation of the operator’s
  Terms of Service.  <strong>If, however, the operator later determines that a
  particular user is a child under age 13</strong>, COPPA’s notice and parental
  consent requirements will be triggered.</p>
</blockquote>

<p>If a banned lying child claims to now be 13 but in fact is still not 13, the notice and consent requirements have been triggered and you can be (massively) punished. If the child is over 13, there will be no penalty, since you didn't violate the rule.</p>

<p>The rule does not include any standards for proving age, and you have to evaluate any such evidence at your own risk. Whatever proof you would require, that would (if it were reasonably related to proof of age) constitute personal information, and the regulations require you to "obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children". In other words, <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=4939e77c77a1a1a08c1cbf905fc4b409&amp;node=16%3A1.0.1.3.36&amp;rgn=div5#se16.1.312_15" rel="nofollow noreferrer">parental consent</a> is necessary to get the information necessary (birth certificate for example) to establish that parental consent is not necessary. You are strictly liable for violating the rule if you actually know that a user is under 13, and you can't argue "But he showed me a birth certificate".</p>

<p>§312.5 gives details about what constitutes "verifiable parental consent". (c) <em>Exceptions to prior parental consent</em> says that you can obtain personal information for the purpose of obtaining parental consent (otherwise, you would never be able to ask for parental consent, since you can't ask "who are your parents"). (c)(6) allows "collecting a child's name and online contact information to... take precautions against liability", but that does not include e.g. collecting a child's birth certificate. In other words, the only apparently safe course of action in case you have obtained actual knowledge that a user is a child is to require parental consent.</p>
