Federal Trade Commission P Bureau of Consumer Protection P Office of Consumer and Business Education

HOW T O P ROTECT K IDS’ PRIVACY O NLINE

Whether playing, shopping, studying or just surfing, today’s kids are taking advantage of all that the web

has to offer. But when it comes to their personal information online, who’s in charge? In an effort to

put parents in the catbird seat, the Federal Trade Commission has established new rules for website operators

to make sure that kids’ privacy is protected while they’re online. These rules are part of the 1998 Children’s

Online Privacy Protection Act. Here’s a look at what the law requires, starting April 21, 2000.

 Website Operators Must: Parents Should:

Post their privacy policy.

Websites directed to children or that knowingly

collect information from kids under 13 must

post a notice of their information collection

practices that includes:

W types of personal information they collect

from kids—for example, name, home

address, email address or hobbies.

W how the site will use the information—for

example, to market to the child who supplied the information, to notify contest

winners or to make the information available through a child’s participation in a chat

room.

W whether personal information is forwarded

to advertisers or other third parties.

W a contact at the site.

Look for a privacy policy on any

website directed to children.

The policy must be available through a link on

the website’s homepage and at each area where

personal information is collected from kids.

Websites for general audiences that have a

children’s section must post the notice on the

homepages of the section for kids.

Read the policy closely to learn the kinds of

personal information being collected, how it will

be used, and whether it will be passed on to

third parties. If you find a website that doesn’t

post basic protections for children’s personal

information, ask for details about their information collection practices.

Get parental consent.

In many cases, a site must obtain parental

consent before collecting, using or disclosing

personal information about a child.

Consent is not required when a site is collecting

an email address to:

W respond to a one-time request from the child.

W provide notice to the parent.

W ensure the safety of the child or the site.

W send a newsletter or other information on a

regular basis as long as the site notifies a

parent and gives them a chance to say no to

the arrangement.

Decide whether to give consent.

Giving consent authorizes the website to collect

personal information from your child. You can

give consent and still say no to having your

child’s information passed along to a third party.

Your consent isn’t necessary if the website is

collecting your child’s email address simply to

respond to a one-time request for information.
Get new consent when informationpractices change in a “material” way.

Website operators need to notify parents and get

consent again if they plan to change the kinds of

information they collect, change how they use

the information or offer the information to new

and different third parties. For example, new

parental consent would be required if the

website decides to:

W send information from children to marketers

of diet pills instead of only marketers of

stuffed animals, as covered in the original

consent.

W give a child access to a chat room if the

parent’s original consent covered only

sending a newsletter.

Decide whether to approve information collection from your kids based

on new uses for the information.

Website operators will let you know about the

need for new consent by sending you a new

notice and request. They will do this when they

are changing the terms-of-use of the information

in a “material” or significant way.

Allow parents to review personal information collected from their children.

To do this, website operators must verify the

identity of the requesting parent.

Ask to see the information your child

has submitted.

The site will ask you to verify your identity to

ensure that your child’s information isn’t given

out improperly.

Allow parents to revoke their consent,

and delete information collected

from their children at the parents’

request.

Parents can revoke their consent and ask that

information about their children be deleted from

the site’s database. When a parent revokes

consent, the website must stop collecting, using

or disclosing information from that child. The

site may end a child’s participation in an activity

if the information it collected was necessary for

participation in the website’s activity.

Understand that you may revoke your

consent at any time and have your

child’s information deleted.

To stop a website from collecting additional

information from your child, you can revoke

your consent. You also may ask a site to delete

any personal information it has already collected

from your child.

 The FTC works for the consumer to prevent fraudulent, deceptive and unfair business practices in the

marketplace and to provide information to help consumers spot, stop and avoid them. To file a complaint

or to get free information on consumer issues, visit www.ftc.gov or call toll-free, 1-877-FTC-HELP (1-

877-382-4357); TTY: 1-866-653-4261. The FTC enters Internet, telemarketing, identity theft and other

fraud-related complaints into Consumer Sentinel, a secure, online database available to hundreds of civil

and criminal law enforcement agencies in the U.S. and abroad.

February 2000

 Website Operators Must: Parents Should:

Toll-free 1.877.FTC.HELP For the Consumer