Frequently Asked Questions (and Answers) About
the Children's Online Privacy Protection Act (COPPA)


Protecting the privacy of children online is important and EFF feels that the implementation of COPPA is a positive first step. Self-regulation as the only means to protecting consumer privacy on the Internet is not realistically the best method to protect privacy. Ultimately, we will need to employ not only new technological developments, but consumer education programs and legislation as well.

There are some deficiencies with this piece of legislation. The first is that parents can still give consent to businesses to market to their children. If consent is given to disclose the personal information of the child then the business can share that information with third parties. In addition, COPPA only applies to users under 13. There are many other children in the 13-16 age group who are not savvy users of the Net. These children could also benefit from this kind of regulation.

What does it mean?

On April 21, 2000 COPPA becomes effective. Web site operators who operate commercial sites directed to children under 13 and who collect personal information about them OR those who operate a general audience web site and have actual knowledge that it collects personal information from children under 13 will have to comply with the rule.

This means that operators will have to:

  1. post their privacy policy;
  2. get parental consent;
  3. get new consent when information practices change in a material way;
  4. allow parents to review personal information collected from their children; and
  5. allow parents to revoke their consent, and delete information collected from their children at the parent's request.

How effective has COPPA been already?

Many web site operators are already in compliance so in that respect it has been effective, but many more are still not in compliance. For those already in compliance the problem is being nipped in the bud. It is important to note that many of these companies had no privacy policies before COPPA.

What should parents know?

They should know to look for a privacy policy so they can see what kinds of information are being gathered about their children. They should decide whether or not to give consent. They should know that they can ask to see what information has been gathered about their children, and that they can revoke consent at any time and have their children's information deleted.

What further steps can people take to protect kids online?

Use common sense. If you would hesitate doing something in the offline world, you should think twice about doing it in the online world. Educate your children about the dangers involved in giving personal information to strangers they meet on the Net. Make sure your children are aware that they shouldn't give out personal information to people they don't know. It is important that your children don't assume that people are who they say they are; just as a child can create a fictitious identity, so can others. Keep the computer in a public area of the home such as the living room.