How to Comply with the Children’s Online Privacy Protection Act

You, Your Privacy Policy

and COPPA

Federal Trade Commission

Bureau of Consumer Protection

www.ftc.gov

Contents

Drafting A COPPA-Compliant Privacy Policy 1

INTRODUCTION 1

THE BASIC REQUIREMENTS 2

 LOCATION 2

 CLEAR AND PROMINENT LINKS 2

 CLEAR LABELS 3

 LOCATION: THE BASICS 3

 CONTENT 3

 THIRD PARTIES 5

 THE BAN ON CONDITIONING PARTICIPATION ON INFORMATION COLLECTION 5

 PARENTAL RIGHTS 6

 CONTENT: THE BASICS 6

RESOURCES 7

ENDNOTES 7

FAQs About Privacy Policies 8

Compliance Checklist 11

LOCATION 11

CONTENT 12

STYLE 17

I

II

III

1

Drafting A COPPA-Compliant Privacy Policy

INTRODUCTION

The Childrenís Online Privacy Protection Act (COPPA), passed by Congress in October 1998, requires the Federal Trade Commission (FTC) to issue and enforce rules

concerning childrenís online privacy. The FTC issued the Childrenís Online Privacy

Protection Rule in November 1999; it has been in effect since April 21, 2000.1

 The

Ruleís primary goal: to place parents in control over what information is collected from

their children online.

The Rule applies to:

● operators of commercial websites or online services directed to children under 13 that

collect personal information from children;

● operators of general audience sites that knowingly collect personal information from

children under 13; and

● operators of general audience sites that have a separate

childrenís area and that collect personal information

from children.

The Rule requires these operators to:

● Post a privacy policy on the homepage of the

website and link to the privacy policy everywhere

personal information is collected.

● Provide notice to parents about the siteís information

collection practices and, with some exceptions, get

verifiable parental consent before collecting personal

information from children.

● Give parents the choice to consent to the collection and

use of a childís personal information for internal use by the

website, and give them the chance to choose not to have that

personal information disclosed to third parties.

● Provide parents with access to their childís information, and the

opportunity to delete the information and opt out of the future collection or use of the

information.

● Not condition a childís participation in an activity on the disclosure of more personal information than is reasonably necessary for the activity.

● Maintain the confidentiality, security and integrity of the personal information

collected from children.

The FTC has prepared this guide to help website operators comply with the Rule. The

guide explains each component of a COPPA-compliant privacy policy, answers questions that website operators have asked, and features a Compliance Checklist to help

website operators identify areas where their privacy policies could be improved.

Where information is collected,

post a clear and prominent link

to your privacy policy.
2

THE BASIC REQUIREMENTS

A privacy policy tells the visitor about the information collection practices of the

website. For sites that are covered by COPPA, the policy must explain what types of

personal information are collected, how it is collected, and how the website will use the

information. It also needs to tell the visitor whether the website gives the personal

information to anyone else. If so, the policy must identify the third parties and tell the

visitor how the third parties will in general use the information. The privacy policy must

be placed where it can be found easily, and it must be written so that the average person

can understand what it says.

LOCATION

To comply with the Rule, a website directed to children must put the link to its privacy

policy in a clear and prominent place on the home page and at every area on the website

where children are asked to provide personal information. The links to the privacy

policy also must be close to the requests for information.

General audience websites with separate childrenís areas must post a clear and prominent link on the home page of the childrenís area, as well as at every area where personal information is collected from children. A general audience website is not required

to have a separate privacy policy for its childrenís area, and may combine its general

audience and childrenís privacy policies into one document. However, a website without

a separate privacy policy for its childrenís area should clearly disclose at the top of its

privacy policy that a specific section discusses the siteís information practices with

respect to children. A general audience site also

can link from the childrenís area directly

to the part of its privacy policy that

pertains to children.2

CLEAR AND PROMINENT LINKS

The Rule requires that the link to

the privacy policy be placed in a

clear and prominent place on the

home page and everywhere that

children provide ó or are asked

to provide ó personal information.3

ìClear and prominentî means that the

link stands out and is noticeable to

visitors through the use of different type

sizes, different fonts, different colors, or

contrasting backgrounds. A link that is in

tiny print at the bottom of the home page ó

or one that is indistinguishable from adjacent

links ó is not considered clear and prominent.4

Use your imagination: Some children’s websites

have created bright, attention-grabbing icons — like

animated characters or objects — that direct the visitor

to the privacy policy. Other websites provide several

links from different parts of the homepage to the

privacy policy, making it easy for parents and

other visitors to find the privacy policy.
3

CLEAR LABELS

The link must be labeled clearly, which allows the visitor to know the link goes to the

siteís privacy policy and a description of its information collection practices. For example, a link that says Privacy Policy, Privacy Statement or Information Collection

Practices Statement is considered to be labeled clearly. Links labeled Important Information, Legal Notice or Note to Parents would not be as effective in letting the visitor

know that a click would take him or her to the siteís privacy policy.

CONTENT

A privacy policy tells visitors about the types of information the website collects, how

the site handles the information, and whether the site gives the information to anyone

else. The Rule requires that the privacy policy be clear and understandable. The policy

must give a complete description of the siteís information practices; it must not contain

confusing or contradictory information.

The privacy policy plays a very important role in a parentís decision to agree to a

websiteís request for information from their children. One that is clearly written, easyto-understand, and full of relevant information helps parents make an informed decision.

To be COPPA-compliant, a privacy policy must contain the following information:

● Contact information, including the name, mailing address, telephone number, and

email address of all operators collecting or maintaining personal information from

children through the website. This requirement lets parents know who will see and

use their childrenís personal information; it gives them the information they need to

get in touch with the operators who collect or maintain their childrenís personal

information.

According to the Rule, if several operators are collecting information through the

website, the site operator may list the name, address, phone number, and email

address of one operator who will respond to all inquiries from parents about the

LOCATION: THE BASICS

● Place a link to the privacy policy on the websiteís homepage ó or

on the homepage of the childrenís area of a general audience site.

● Place a link to the privacy policy close to all areas where personal

information is collected from children.

● Make the link to the privacy policy ìclear and prominent.î

● Label the link clearly so visitors know it goes to the websiteís

privacy policy.
4

operatorsí privacy policies and uses of childrenís information ó but only if it makes

the names of all the operators available, either by listing them in the policy or linking

to them from the policy.5

● What types of personal information are collected, and how. Website operators

should be specific enough about the types of personal information they collect from

children to allow parents to make an informed decision about whether to agree to the

collection and use of the information. A policy that uses descriptors like name, address, telephone number, hobbies, gender, and age tells parents exactly the types of

personal information that the website collects from children. A privacy policy that

notes it collects ìcontact informationî gives parents no idea whether the website is

collecting an email address or a home telephone number.

In addition, the privacy policy must state whether personal information is collected

actively or passively. Active collection includes registration forms and email newsletter sign-up boxes. Passive collection includes the use of cookies or other identifiers

when the information is combined with ìpersonal information.î6

● How the website will use the personal information. The privacy policy should state

if the personal information is to be used to fulfill a requested transaction, keep records

or market back to the child. For example, it should explain that email addresses are

used to send weekly newsletters, or that a mailing address is used to send a prize or

magazine subscription or fulfill another request.

In addition, the privacy policy must state whether the website offers activities that

allow the child or the site to disclose the childís

personal information publicly ó for example,

through chat rooms, message boards or

email accounts.

● Whether the website operator

gives or discloses the personal

information it has collected

from children to third parties.7

The website also must give parents

the option of consenting to its

collection and internal use of their

childís personal information while

refusing to permit the site to share

the information with third parties.

If the website shares personal information

with third parties, the privacy policy must

explain the types of businesses the third parties

To be COPPA-compliant,

your privacy policy must include:

contact information;

the kinds of personal information you collect;

how you collect and use it;

whether you disclose it to third parties.
5

are in and the general purposes for

which they will use the information. The privacy policy also

must tell the visitor whether

the third parties have agreed

to maintain the confidentiality, security and integrity of

the personal information they

obtain from the website operator.

THIRD PARTIES

The Rule defines a third party as a person

who is not an operator of the website or

who does not provide support for the internal

operations of the website.8

If the website is sharing the personal information

with a company or person whose only role is to

provide support for the internal operations of the

website ó like a fulfillment house or a shipping

company ó the disclosure of the personal information is not to a ìthird partyî and does

not have to be spelled out in the privacy policy. The Rule specifically defines ìthird

partyî to exclude people who provide internal support. These providers are obligated to

use the personal information only to carry out their specific obligations. They cannot use

the information for any other purpose.

Whether an ìaffiliated or related companyî is considered a third party and triggers the

third-party disclosure requirements, depends on the affiliated or related companyís

relationship to the personal information. If the affiliated or related company is an operator of the website because it collects personal information on the site, or because personal information is being collected on its behalf, it is not considered a third party.

Rather, it is considered an operator ó and subject to the Rule. If the affiliated or related

company is not an operator and isnít providing internal support services, it is considered

a third party. The privacy policy must tell parents about the sharing of personal information with this affiliated or related company and must give parents the choice to allow the

disclosure of information ó or not.

THE BAN ON CONDITIONING PARTICIPATION ON INFORMATION COLLECTION

The Rule prohibits website operators from conditioning a childís participation in an

activity ó like a game or prize offer ó on the childís disclosure of more personal

information than is reasonably necessary to participate in the activity. This provision

prevents tying personal information from children to popular and persuasive incentives

like games and prizes, and preserves a childís access to such activities. For example, to

send a child a prize, it is reasonably necessary for a website to collect the childís mailing

A privacy policy is not COPPA-compliant

if it tells parents that the website “may” disclose

information to third parties without giving details

about the third parties or giving the parent the

option to say ‘no’ to sharing of information.
6

address. Asking the child for a postal or mailing address when offering an email newsletter would not be reasonably necessary. The Rule requires that privacy policies state

this prohibition explicitly.

PARENTAL RIGHTS

The privacy policy must state that a parent can review the childís personal information,

have it deleted, and refuse to allow the further collection or use of the childís information ó and explain the procedures for doing so. For example, the privacy policy could

provide contact information, like an email address or toll-free telephone number, for the

parent to use.

CONTENT: THE BASICS

The privacy policy must:

● Be written clearly and understandably. It should not contain any confusing or

contradictory information.

● Describe the siteís information practices completely and accurately.

● Include contact information (name, mailing address, telephone number, and

email address) for all operators collecting or maintaining personal information

through the website.

● Explain what types of personal information the site collects, whether it collects

the information actively or passively, and how it will use the information.

● Provide all the required information about the disclosure of personal information to third parties.

● Tell parents they can consent to the collection and use of their childís personal

information without consenting to the disclosure of the information to third

parties.

● Explain that website operators cannot condition a childís participation in an

activity on the child providing more personal information than is reasonably

necessary for the activity.

● Tell parents that they can review their childís personal information, have it

deleted and refuse to permit any further collection ó and how to do it.
7

RESOURCES

For more information about childrenís privacy issues, call the FTCís help-line,

202-326-3140, or visit www.ftc.gov/kidzprivacy.

ENDNOTES

1 16 C.F.R. ß 312.5. See also http://www.ftc.gov/os/1999/9910/

64fr59888.pdf.

2 64 Fed. Reg. 59,888, 59,894 at n.98 (Nov. 3, 1999).

3 See 16 C.F.R. ßß 312.4(b)(1)(ii) and (iii).

4 64 Fed. Reg. at 59,894.

5 See 16 C.F.R. ß 312.4(b)(2)(i).

6 The Rule defines personal information as including information

collected through the use of cookies or other identifiers when tied to

personal information, such as an email address. 16 C.F.R. ß 312.2.

If your site uses cookies and links the information stored in the cookie

with other individually identifiable information, such collection must

be disclosed in the privacy policy.

7 Because the Rule regulates operators and not ìthird parties,î the Rule

requires operators to tell parents about the third party and what the

third party plans to do with the information given to it by the

operator.

8 16 C.F.R. ß 312.2.
8

FAQs About Privacy Policies

Q. COPPA applies to ìwebsites directed to children.î What factors should I use

to determine whether my website is targeted to children?

A. According to the Rule, the factors to use in determining whether your

site is targeted to kids include subject matter, language, whether the

site uses animated characters, and whether advertising on the site is

directed to children. The Commission also considers empirical

evidence regarding the ages of the siteís visitors. These standards are

similar to those for TV, radio and print advertising.

Q. My site is a general audience site that has a separate childrenís area. What are

my COPPA obligations?

A. The portion of your website that is directed to children must be

COPPA-compliant. The Rule requires that you post a prominent link

to your privacy policy on the homepage of your childrenís area. In

addition, it requires that you place a prominent link to your privacy

policy near every area that asks for personal information from

children.

You may have a separate privacy policy for the childrenís area of

your website or a separate section within your general privacy policy

that describes your information collection practices with respect to

children. If you decide on a privacy policy with a separate section for

your information practices regarding children, youíll need a link from

the homepage of the childrenís area directly to the childrenís portion

of the privacy policy. Or, state clearly at the top of the privacy policy

that a specific section discusses the information practices regarding

children.

Q. My site does not collect personally identifiable information from children ó or

anyone else. Do I still need to post a privacy policy?

A. COPPA applies only to websites that collect personal information

from children. However, posting a privacy policy may reassure

visitors about a website operatorís information practices. Surveys

show that most parents are uncomfortable with their children

revealing any personal information on the Internet. As a practical

matter, parents should be pleased to read your privacy policy and find

out quickly that you donít collect personally identifiable information.
9

Q. COPPA is triggered by the collection of personal information from children.

But the information I collect at my site is voluntary, not mandatory. Does

COPPA apply?

A. Yes. Information collection is what triggers the Rule, whether it is

voluntary or mandatory.

Q. Is it okay for the link to my privacy policy to be at the bottom of my home

page?

A. As long as the link is ìclear and prominent,î it can be at the bottom

of the home page. The Rule requires that the link to your privacy

policy ìbe placed in a clear and prominent place and manner on the

home page of the website or online serviceî and at each area where

children provide, or are asked to provide, personal information.

According to the Commission, ìëclear and prominentí means that the

link must stand out and be noticeable to the siteís visitors.... The

Commission does not consider ëclear and prominentí a link that is in

small print at the bottom of the page, or a link that is indistinguishable

from a number of other, adjacent links.î

Q. I run a general audience site, but it has a separate childrenís section. Can I

structure my privacy policy so that information about my childrenís practices

and non-childrenís practices are mixed, or do I have to have a separate

privacy policy about my practices with respect to children?

A. You may have one privacy policy that contains information about

your practices as they apply to children and other people. But make

sure that there is a link to the privacy policy on the home page of the

childrenís area and at each area where personal information is

collected from children.

If you use one privacy policy for both the general audience and

childrenís portions of your website, make sure that:

● the link on the homepage of the childrenís area takes visitors

directly to the part of the privacy policy that discusses children, or

● you clearly state at the top of the privacy policy that there is a

specific section discussing information practices with respect to

children.
10

Q. Can my privacy policy include materials promoting products or services?

A. No. COPPA requires that privacy policies be ìclearly and

understandably written, complete, and contain no unrelated,

confusing, or contradictory materials.î The more complicated and

confusing the policy, the less likely it is that parents will understand

or even read it. Parents who find a policy confusing or difficult to

wade through may be less likely to grant you consent.

Q. Does COPPA require that I list the contact information for all the operators at

my site? This could make my privacy policy very long and confusing.

A. If there are multiple operators collecting information through your

site, you may list the name, mailing address, phone number, and

email address of one operator who will respond to all inquiries from

parents regarding all the operatorsí privacy policies and the uses of

childrenís information. But thatís the case only as long as the names

of all the operators are listed in the notice.

Alternatively, if you want to list the contact information for all the

operators ó but still keep your privacy policy and notice simple ó

include a link in the privacy policy to the list of operators and all their

contact information. When you send your notice to parents to request

consent, be sure they can access the list.

Q. Does my privacy policy have to disclose my use of cookies, GUIDS, IP

addresses, or the fact that I use other passive information collection

technology?

A. Yes, it does, when the information is combined with ìpersonal

information.î The Rule defines personal information as including

identifiable information about an individual collected online, including

any persistent identifier that is tied to identifying information. For

example, if you tied a childís email address to the information that

your cookies collected about the length of the childís visit, all the

information collected would be considered ìpersonal information.î
11

Compliance Checklist

Your websiteís privacy policy must accurately represent your siteís information practices. That is, you must deliver what your privacy policy promises. The policy also

should be well-organized, concise and easy to understand. This will help ensure that

parents will have all the information they need to make decisions about giving consent.

Use this checklist to help identify the elements that your websiteís privacy policy needs

to be COPPA-compliant. It addresses issues related to the placement, content and style

of your privacy policy. The person completing the checklist should be knowledgeable

about your websiteís information practices and have a copy of your siteís policy handy

for review.

But you also may want to ask someone who isnít familiar with your information practices to read your privacy policy and help you answer the following questions. Should a

question in the checklist identify an issue in your privacy policy that needs correction, it

will refer you to the appropriate part of Section 1 for guidance.

LOCATION

1. Is there a link to your privacy policy on the homepage of your website or on

the homepage of the childrenís area of your website?

❏ If YES, go to the next question.

❏ If NO, place a link to your privacy policy in the appropriate

places. See page 2 for details.

2. Are the links to your privacy policy near

each and every place on your website

where you collect personal

information from children?

❏ If YES, go to the next

question.

❏ If NO, review the

areas where you collect

personal information from

children and put links to your

privacy policy near each of these

places.

You must deliver what your

privacy policy promises.
12

3. Does the link to your privacy policy stand out so that the website visitor can

locate it easily?

❏ If YES, describe how the link stands out:

_______________________________________________________

_______________________________________________________.

Go to the next question.

❏ If NO, change your link by using contrasting colors, changing the

font or type size or creating a noticeable icon. See page 2.

4. Is the link in a different color, a different font, or a larger type size?

❏ If YES, go to the next question.

❏ If NO, change it so it is prominent and stands out. See page 2.

5. Is the link to your privacy policy labeled clearly so a visitor can tell what it is?

❏ If YES, record the label of your link:

______________________________.

Go to the next question.

❏ If NO, change the link to your privacy policy so that a casual

visitor can tell what it is. See page 3.

CONTENT

6. Does your privacy policy include the names of

all the website operators who collect or

maintain personal information from

children through your site?

❏ If YES, go to the next

question.

❏ If NO, revise your

privacy policy to include

the name of each

operator. See pages 3-4.

The person most familiar with

your site’s information practices

should complete this checklist.
13

7. Does your privacy policy provide mailing addresses for all the website

operators who collect or maintain personal information through your site?

❏ If YES, go to the next question.

❏ If NO, does the privacy policy provide contact information

(mailing address, telephone number and email address) for one

operator who, in turn, will respond to inquiries from parents on

behalf of the other operators?

❏ If YES, go to question 10.

❏ If NO, revise your privacy policy to include full contact

information for each operator who collects or maintains

personal information from children through your website,

or for one operator who will respond to all inquiries.

See pages 3-4.

8. Does your privacy policy provide the telephone numbers for all website

operators who collect or maintain personal information through your site?

❏ If YES, go to the next question.

❏ If NO, revise your privacy policy to include telephone numbers

for all operators. See pages 3-4.

9. Does your privacy policy provide the email addresses of all website operators

who collect or maintain personal information through your site?

❏ If YES, go to the next question.

❏ If NO, revise your privacy policy

so it includes email addresses.

See pages 3-4.

10. Does your privacy policy state each

type of personal information (full

name, email address, mailing address,

phone number, etc.) that you collect

from children?

❏ If YES, go to the next question.

❏ If NO, revise your privacy policy so it

tells each type of personal information the

site collects. See page 4.

Keep a copy of your

privacy policy handy for review.
14

11. Is your statement of the types of personal information collected descriptive? Is

it specific enough to let parents know the kinds of personal information you

will be collecting from their children?

❏ If YES, go to the next question.

❏ If NO, revise the statement to be more descriptive. See page 4.

12. Does your privacy policy tell parents whether personal information is collected

actively ó that is, from the child ó or passively ó for example, through the

use of cookies?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy to tell parents how your website

collects personal information from children. See page 4.

13. Does your privacy policy tell parents how your website will use the personal

information that it collects?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy so it gives parents that

information. See page 4.

14. Does your website share or disclose childrenís personal information with third

parties?

❏ If YES, go to the next question.

❏ If NO, go to question 19.

15. Does your privacy policy state what kinds of businesses the third parties are

engaged in?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy. See pages 4-5.

16. Does your privacy policy tell parents the general purposes the third parties will

use their childrenís personal information for?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy. See pages 4-5.
15

17. Does your privacy policy state whether the third parties that your site shares

personal information with have agreed to maintain the confidentiality, security

and integrity of the information?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy to address whether the third

parties have agreed. See pages 4-5.

18. Does your privacy policy tell parents they can agree to the collection and use of

their childís personal information by your site without agreeing to you

disclosing the information to third parties?

❏ If YES, go to question 20.

❏ If NO, revise the privacy policy to tell parents they have the right

to consent to your siteís collection and use of their childís personal

information, while saying no to your disclosure of the information

to third parties. See page 5. Then go to question 20.

19. Does your privacy policy clearly state that your website does not disclose

personal information to third parties?

❏ If YES, go to the next question.

❏ If NO, revise the language in your privacy policy to explain that

the website doesnít share childrenís personal information with

third parties. See pages 4-5.

20. Does your privacy policy state that your site cannot condition a childís

participation in an activity on the childís disclosure of more personal

information than is reasonably necessary to participate in the activity?

❏ If YES, go to the next question.

❏ If NO, add appropriate language to your privacy policy. See page 5.

21. Does your privacy policy let parents know that they can review the personal

information that your website has collected from their child?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy to tell parents they have the right

to review the information the site has collected from their child.

See page 6.
22. Does your privacy policy tell parents how they can review their childís

personal information?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy to let parents know how to

review their childís personal information. See page 6.

23. A. Does your privacy policy tell parents they can have their childís personal

information deleted from your site?

❏ If YES, go to the next question.

❏ If NO, revise the language in the privacy policy. See page 6.

B. Does your privacy policy tell parents how they can have their childrenís

personal information deleted from your site?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy. See page 6.

24. A. Does your privacy policy tell parents that they can stop your website from

further collecting or using the additional personal information from your child?

❏ If YES, go to the next question.

❏ If NO, revise the privacy policy as appropriate. See page 6.

B. Does your privacy policy tell

parents how they can stop the

further collection and use of

their childís personal

information?

❏ If YES, go to the

next question.

❏ If NO, revise the

privacy policy.

See page 6.

16

Consider testing your

privacy policy’s clarity with

a parent or a youngster.
STYLE

25. Is your privacy policy clear and understandable? Easy to read? Consider

testing it with potential readers.

❏ If YES, go to the next question.

❏ If NO, rewrite and simplify the privacy policy so the parents of

your visitors would be likely to find it easy to read and

understand. See pages 2-3.

26. Does your privacy policy give a complete description of your information

practices? Does it explain all the personal information you collect? Does it spell

out how you will use the information?

❏ If YES, go to the next question.

❏ If NO, review the privacy policy and add information to make the

description complete. See page 4.

27. Does your privacy policy include any contradictory, confusing or ambiguous

language?

❏ If YES, edit the policy. See pages 2-3.

❏ If NO, go to the next question.

28. Does your privacy policy contain any material or content that doesnít relate to

your information practices?

❏ If YES, edit the policy so it focuses on your information

practices. See pages 3-4.

❏ If NO, go to the next question.

29. Is your privacy policy well-organized and easy to follow?

❏ YES.

❏ NO. Itís time to reorganize the information in the policy to make

it easier to follow. Consider using a question and answer format.

30. Do your practices reflect the promises you make in your privacy policy?

❏ YES. Keep up the good work.

❏ NO. Go back to square one.

17


FEDERAL TRADE COMMISSION FOR THE CONSUMER

WWW.FTC.GOV TOLL-FREE 1-877-FTC-HELP

COPPA