Marketing to Children

MARKETING TO CHILDREN

Article #13

Definitions:

Covered Entities for COPPA and related online data issues: These include operators of commercial websites and online services (including mobile apps or any service available over the Internet or that connects to the Internet or a wide-area network) directed to children under 13 that collect, use or disclose personal information from children; third parties (e.g. social plug ins and ad networks) with actual knowledge of such information collection. Further, first parties are held strictly accountable for the actions of third parties on that first party’s site or service.

Personal Information:
This includes the following:

• First and last name;
• A home or other physical address;
• Online contact information;
• A screen or user name that functions as online contact information;
• A telephone number;
• A social security number;
• A persistent identifier that serves to recognize a user over time across different websites or online services;
• A video, photograph or audio file where such file contains a child’s image or voice;
• Geolocation information sufficient to identify street name and name of a city or town; or
• Information concerning the child or the parents of the child that the operator collects online from the child and combines with an identifier described above.

Direct Notice to Parents: Parents must be provided with a detailed direct notice of the operator’s personal information collection, use and disclosure practices, not through a hyperlink.

PARENTAL RESPONSIBILITY AND CHOICE

Article #14

Marketers communicating commercial appeals, operators of commercial websites, and online services (such as mobile apps) directed to children under 13 should provide direct notice (as defined above) and an opportunity to opt out of the marketing process so that parents have the ability to limit the collection, use, and disclosure of their children’s names, addresses, or other personally identifiable information prior to such collection, use and disclosure.

Parents must be provided the choice of consenting to the operator’s collection and internal use of a child’s information. Such information may never be disclosed to third parties (unless the disclosure is integral to the site or service, in which case that must be made clear to the parent.)

Parents must have access to their child’s personal information to review and/or have that information deleted.

Parents must be given an opportunity to prevent further use or online collection of a child’s personal information.

COLLECTION AND USE OF INFORMATION FROM OR ABOUT CHILDREN

Article #15

Marketers should limit the collection, use, and dissemination of personally identifiable information collected from or about children to that information that is required for the promotion, sale, and delivery of goods and services; the provision of customer services; conducting market research; and engaging in other appropriate marketing activities.

Marketers should effectively explain that the information is being requested for marketing purposes. Information not appropriate for marketing purposes should not be collected.

Upon request from a parent, marketers should promptly provide the source and general nature of information maintained about a child and allow for removal or correction.

Marketers should implement the strictest security measures to ensure against unauthorized access, alteration, or dissemination of the data collected from or about children, and should provide information regarding such measures upon request to the parent or guardian of the minor.

Operators should retain personally identifiable information only as long as is reasonably necessary, and must delete personally identifiable information using reasonable measures.

ONLINE MARKETING TO CHILDREN UNDER 13 YEARS OF AGE

Article #16

This Article applies to online marketing as follows:

Online marketers (operators of general audience websites or online services) should not knowingly collect personally identifiable information online or via wireless handsets or devices from a child under 13 without prior verifiable parental consent and direct parental notification of the nature and intended use of such information, and shall provide an opportunity for the parent to prevent such use and participation in the activity.

Operators of websites and online services must provide a privacy notice with clear and concise description of their information policies and practices. This notice should be easy to read on smaller screens (e.g., mobile devices.) for parents and allow them to provide verifiable consent.

Marketers are not required to ask the age of a child and may rely on the information provided by the user. Marketers may age screen users and apply notice and consent requirements only for users that identify themselves as being under age 13. If an operator later determines that a particular user is a child under the age of 13, parental notice and consent requirements are triggered.

Online and wireless/mobile contact information should only be used to directly respond to an activity initiated by a child and not to re-contact a child for other purposes without verifiable prior parental consent.

Marketers should not knowingly collect, without verifiable prior parental consent, personally identifiable information online or via a wireless handset or device from children that would permit any offline contact with the child.

Marketers should not knowingly distribute to any third parties, without verifiable prior parental consent, information collected from a child that would permit any contact with that child.

Marketers should take reasonable steps to prevent the online publication or posting of information that would allow a third party to contact a child offline unless the marketer has verifiable prior parental consent.

Marketers should not entice a child online to divulge personally identifiable information by the prospect of a special game, prize, or other offer.

Marketers should not make a child’s access to website or mobile content contingent on the collection of personally identifiable information. Only online contact information used to enhance the interactivity of the site is permitted.

The following assumptions underlie these online guidelines:

• When a marketer directs a site at a certain age group, it can expect that the visitors to that site are in that age range, and
• When a marketer asks the age of the child, the marketer can assume the answer to be truthful.