privacy children website
Websites for children under 13 years of age
<p>Many websites have a section for children under 13 years of age in their privacy policy, stating that they are not knowingly collecting information from such children and the collected information will be deleted upon request from their parents. I think <a href="https://www.ftc.gov/enforcement/rules/rulemaking-regulatory-reform-proceedings/childrens-online-privacy-protection-rule" rel="nofollow noreferrer">this document</a> may be relevant but I read it for a while and still couldn't get a clue about what really matters for children under 13 years of age. Any experts can help explain what issues must be addressed by site owners targeting customers who are children under 13 years of age?</p>

<p>Edit. It's a US website.</p>

<p>The basic law (<a href="https://www.law.cornell.edu/uscode/text/15/chapter-91" rel="nofollow noreferrer">COPPA</a>) says that as a website operator, you cannot collect personal information from anyone under 13 without verifiable parental consent. The regulations then tell you what a "parent" is, what "verifiable parental consent" is, what "personal information" is. The latter is defined as:</p>

<blockquote>
  <p>(A) a first and last name; (B) a home or other physical address
  including street name and name of a city or town; (C) an e-mail
  address; (D) a telephone number; (E) a Social Security number; (F) <em>any
  other identifier that the Commission determines permits the physical
  or online contacting of a specific individual</em>; or (G) information
  concerning the child or the parents of that child that the website
  collects online from the child and combines with an identifier
  described in this paragraph.</p>
</blockquote>

<p>and the commission has determined that (F) includes</p>

<blockquote>
  <p>(7) A persistent identifier that can be used to recognize a user over
  time and across different Web sites or online services. Such
  persistent identifier includes, but is not limited to, a customer
  number held in a cookie, an Internet Protocol (IP) address, a
  processor or device serial number, or unique device identifier; (8) A
  photograph, video, or audio file where such file contains a child's
  image or voice; (9) Geolocation information sufficient to identify
  street name and name of a city or town</p>
</blockquote>

<p>If you don't collect any such information, you don't have to worry. You do have to worry, though, if you think "collect" means what it ordinarily means. <a href="https://www.ecfr.gov/cgi-bin/text-idx?SID=4939e77c77a1a1a08c1cbf905fc4b409&amp;node=16%3A1.0.1.3.36&amp;rgn=div5#se16.1.312_12" rel="nofollow noreferrer">From the regulations</a> (which is where the details of implementation are made clearer): </p>

<blockquote>
  <p>Collects or collection means the gathering of any personal information
  from a child by any means, including but not limited to:</p>
  
  <p>Enabling a child to make personal information publicly available in
  identifiable form. An operator shall not be considered to have
  collected personal information under this paragraph if it takes
  reasonable measures to delete all or virtually all personal
  information from a child's postings before they are made public and
  also to delete such information from its records;</p>
</blockquote>

<p>So if you have a read-only website without accounts, you may be able to avoid reading and complying, but you have to be careful if users can post stuff.</p>

<p>First you have to say what information you collect from children, and what you do with it. Section 312.4 says exactly what that means. Then you need parental consent <em>before</em> you collect such information (which includes their email address), and section 312.5 spells that out; then 312.6 lists the parental right to review their child's peron information. There are "reasonability" limits to what information you can collect (a short section, which doesn't say what would be reasonable).</p>
