COPPA compliance for websites

Most small business owners assume COPPA is a problem for app companies and social networks. On the Outer Banks it reaches further than that: a surf school, a summer camp, a kids' activity page on a rental company's site or a family attraction's games page can all be directed at children. The rules are federal, specific and older than most people realise.

The dates and the age line come first. Congress enacted the Children's Online Privacy Protection Act in 1998 and directed the FTC to write the rules, and the FTC's own summary is COPPA — under-13 rule, effective April 21, 2000. That tells you both halves: the original COPPA Rule took effect on April 21, 2000, and it applies only to collecting personal information from children under 13. A site aimed at teenagers is outside it; a site aimed at younger children, or a section of one, is inside.

The requirement owners find most surprising is the privacy policy. The FTC calls it the COPPA privacy-policy duty even with no collection: even a child-directed website that collects no personal information must still post a privacy policy, and operators must link their children's-data practices from the home or landing page of the children's area, as 16 C.F.R. section 312.4(d) provides. 'We do not collect anything' is not an exemption; it is the content of the policy.

In practice, the collection is often hidden in tools rather than forms. A newsletter box, a photo contest, a comment feature, an embedded game or an analytics tag on the children's section can each collect information. The safe approach on a small business site is to keep any child-directed pages free of sign-ups and third-party tracking, and to state that clearly in the policy.

COPPA sits beside the rules every business site carries. The Justice Department's position is that the ADA applies to websites of public-facing businesses, and a children's page with games or video needs captions and keyboard access as much as any other. North Carolina's own statutes define personal information more narrowly, around identifiers such as account numbers and passwords, so COPPA is the rule to follow for children's pages.

If you are unsure whether a page is child-directed, look at it the way the FTC would: the subject matter, the images, the language and the activities it offers. A page that looks built for young children should be treated as though it is.

Decide whether any part of your site is aimed at children under 13. If it is, post a privacy policy, link it from that section's front page, and collect nothing you do not need. It is a short list, and the FTC wrote it down.