|
THREE YEARS OF COPING WITH COPPA
By Andrew Ackerman
(Reprinted in The CampLine, Winter 2004; ACA Texoma, Evergreen, Southeastern, Great Rivers, & NorCal Section Winter Newsletters, et. al.)
COPPA, the Children's Online Privacy Protection Act went into effect in April 2000. While we are not aware of any summer camp yet being fined, the Federal Trade Commission (FTC) has handed out some pretty stiff penalties so far:
2/27/03: Hershey Foods Corporation - $85,000
2/27/03: Mrs. Fields Cookies - $100,000
4/22/02: The Ohio Art Company (Etch-A-Sketch) - $35,000
2/14/02: American Pop Corn Company (Jolly Time) - $10,000
10/2/01: Lisa Frank, Inc. - $30,000
4/19/01: Looksmart Ltd. - $35,000
4/19/01: Monarch Services, Inc., et al. (Girls' Life) - $30,000
4/19/01: Bigmailbox.com, Inc. - $35,000
7/21/00: Toysmart.com - prevented from selling customer data in bankruptcy proceedings
Even Amazon.com has been accused of violating COPPA. Clearly, COPPA is here to stay.
The good news is that most child-focused websites are coming into compliance with COPPA. According to an FTC survey of child-focused websites conducted one year after COPPA went into affect and released in April 2002, 72% of the 144 sites surveyed collected children's personal information online. Of these sites collecting personal information:
89% had posted privacy policy
47% mechanisms in place to obtain parental consent
18% *might* have been exempt from the requirement to obtain parental consent (more on this below)
The bad news is that 35% of the sites collecting personal information that needed to obtain parental consent did not. Furthermore, the FTC survey covered only the sites' apparent compliance. Since the FTC did not actually audit the sites to be certain that the policies were being followed in practice, the number of non-compliant sites could be much higher. In fact, a New Jersey Law Journal article dated December 29, 2003 about COPPA compliance by summer camps, schools, and sports clubs states that most such organizations are not actually in compliance… even though they think they are!
A quick review
Essentially, COPPA was passed to protect children from being exploited by online marketers. A child under 13 doesn't necessarily have the good judgment to know when not to disclose his or her personal information (e.g., name, address, email, telephone number) so the idea of requiring verifiable parental consent makes a lot of sense. Unfortunately, how Congress went about doing this was hideously complex.
NOTE: Explaining the full ins and outs of COPPA would take more space than we have here. We'll try to hit on the highlights of what this means for summer camps below. Links to more information on COPPA are listed at the end of this article.
COPPA likely applies to you if your website has any of the following features:
- Pictures of campers posted online
- An online camp newsletter that include campers' names (or other information)
- Contests, raffles or games that require users to provide information to play
- Message Boards and/or Chat Rooms (including "guest books")
- Allows users (of any age) to sign up for an emailed newsletter
- Allows users (of any age) to contact camp via email or webform
- (the list goes on…)
What camps must do to comply
What exactly your camp has to do depends on exactly what your website does and, as importantly, how it does it. Here are just a few of the steps you may need to take:
- PROMINENTLY post a link to your privacy policy on your website home page and on any page where personal information is collected.
- Password protect any part of your website where pictures or other personally identifiable information (e.g., pictures, full names) is displayed.
- Ask for the user's age whenever data is collected.
- Get verifiable parental consent before using data collected from children under 13. COPPA is very specific on how to do this and it is not easy. You typically need a signed letter or fax, a valid credit card number, or a toll free telephone number that a parent can call with a operator available and trained to determine if the caller is in fact an adult.
- Allow the parent to review information submitted by the child and delete it if they so request.
- Monitor message boards and chat rooms so that no submissions from children under 13 are posted live without review (to ensure that they do not inadvertently reveal their personally identifiable information). Alternatively, you must prevent children under 13 from using Message Boards and Chat Rooms.
- At the same time, you cannot condition the child's participation in the website on collection of more information than is reasonably necessary.
Obtaining parental consent is by far the most onerous provision of COPPA. Fortunately, the following uses of data submitted by a child may be exempt:
- You may use an email address provided by a child under 13 once to answer his or her specific questions. After you respond, the information provided must be deleted.
- If the child was writing to subscribe to an email newsletter, you can use the email address to email the newsletter as often as it comes out. The parent must still be notified and, if he or she objects, the child's information must be deleted. Furthermore, the information can only be used for the email newsletter subscription and must be deleted when the subscription is cancelled.
A few examples of camps complying with COPPA
Some camps have limited their websites to no more than flat, non-interactive, online brochures. While this approach does side step COPPA, it essentially misses the point of having a website.
Many camps, particularly those without large parent organizations who maintain their own websites or have contracted with generalist web design firms (as opposed to companies focusing on child-focused sites), think they are in compliance when they are actually not. According to the New Jersey Law Journal article cited above:
Many providers incorrectly assume they are in substantial compliance with the spirit of COPPA because they subsequently contact the parents or guardians of the children from whom they have collected data….
If such behavior is representative of a significant sector of a particular industry (such as summer camp providers) and presented to the Federal Trade Commission, a formal exemption from COPPA may be granted. However, without such a grant, the aforementioned activity is clearly unlawful. [emphasis added]
Fortunately, much of what a camp needs to do to comply is also simply good business sense. If you provide a "More information" or "Contact us" webform, you would want to know if the information is being submitted by a parent or the prospective camper and you would certainly want to know the camper's age. If the data was submitted by a child under 13, when you contact the parents you have to make certain to review with the parent the data you received and get their consent to retain it. Otherwise you are all clear.
The same holds true to online camp enrollment. And if your online enrollment includes collecting credit card information, it's even easier. COPPA assumes that if a credit card number is submitted it is being provided by a parent (or at least a child with parental consent).
About COPPA came into effect, so did a few turn-key solutions to the problems it raised. Joey Waldman of Camp Blue Ridge (Mountain City, GA) found complying with COPPA a lot easier than he'd feared.
I wasn't too concerned about posting pictures of the camp facilities online even if there was a child in the photo but when parents asked me to put the camp newsletter online and to post pictures of children on the website while they were at camp for them to see, I got nervous. Even if COPPA weren't an issue, I wouldn't want any random stranger to have access to that information. I knew I had to password-protect these things but I also knew I couldn't spare the time or money to build anything like that. Luckily, Bunk1.com came along around the same time so I outsourced this to them. Not only is their solution COPPA compliant, it's easier to use than anything I could have come up with on my own. They even handle the customer service calls!
Unfortunately, some features are harder than others to manage. As children might post personal information to message boards (or guest books and the like) so COPPA dictates that web providers must review all postings by children under 13 and remove any such information before the post goes live on the website. Companies like Bunk1 do offer moderated message board services but even with their help, offering these features requires more effort by the camp staff. The sad fact is that the overwhelming majority of camps that offer these message boards, chat rooms, and/or guest books are simply in violation of COPPA.
When it comes to contests, polls, and interactive games, the options are few. These features are exactly the kind of things that might keep campers thinking of camp during the winter but there are currently no camp-focused vendors (that we are aware of) that specialize in COPPA compliant versions of these features. If you are interested these features, your safest bet is to have them built by a camp-focused web development firm with a long history of COPPA experience.
For more information on COPPA
Federal Trade Commission's website: www.ftc.gov/kidzprivacy
Prior Campline articles on COPPA:
October 2000 - www.acacamps.org/campline/0010protect.htm
October 2001 - www.acacamps.org/profmembers/campline/01o_ftc.htm
Prior Bunk1.com articles on COPPA: www.bunk1.com/press/pr_coppa.asp
Sample COPPA-compliant website with Photo Gallery, Newsletter, et. al.: www.test.bunk1.com
(Username: yourparent and Password: parent)
This article is for informational purposes only and is not intended to constitute legal advice.
Andrew Ackerman is the Chief Operations Officer of Bunk1.com. Bunk1.com provides password protected one way camper email and online photo galleries. Bunk1 also provides staffing services and custom website design for camps and maintains a widely used camp search engine. For more information regarding this article or Bunk1, please contact owners@Bunk1.com or call 1-888-465-CAMP.
Reprinted from The CampLine by permission of the American Camping Association, Inc.
copyright 2004 by the American Camping Association, Inc.
|
|
BUNK1 MESSENGER IS LAUNCHED
By: Andrew Ackerman
TECHNOTRENDS: BEYOND CAMPER EMAIL
-
WHAT HAVE YOU DONE FOR ME LATELY?
By: Andrew Ackerman
TECHNOTRENDS: CELLPHONES, BLACKBERRIES ... WHAT'S NOT TO LIKE?
(A LOT, ACTUALLY)
By: Andrew Ackerman
WHAT IF PHONE CALLS WERE AS EASY AS EMAIL?
By: Andrew Ackerman
THREE YEARS OF COPING WITH COPPA
By: Andrew Ackerman
KEEPING YOUR WEBSITE FRESH
By: Andrew Ackerman
10 THINGS YOUR CAMP WEBSITE ABSOLUTELY MUST HAVE
By: Andrew Ackerman
STAFFING
YOUR CAMP IN THE AFTERMATH OF SEPTEMBER 11TH
By: Andrew Ackerman
COPING
WITH COPPA:
PROTECTING CAMPERS' PRIVACY AND AVOIDING BIG GOVERNMENT FINES
By: Michael Steinig, Bunk1.com
CAMP
SEARCH ENGINES: IF YOU BUILD IT… SO WHAT?
By: Andrew Ackerman and Ari Ackerman
|
