Children And The Web A New Law Makes It Harder To Gather Information Online From Youngsters Under Age 13. The Measure Has Resulted In Many Changes, But Some Say It Doesn't Go Far Enough.

Posted: May 18, 2000

A new federal law that helps protect her 8-year-old daughter, Natalie, from the prying eyes of online marketers is fine, as far as it goes. But Deborah Lamb of Lafayette Hill also has a 13-year-old son, Adam, and a daughter, Lilli, 17.

What about them?

"I think restrictions on giving out information should be set at a higher age," Lamb said. "I think it should be 18."

Lamb, who organized an Internet safety program for the parents association at Springside School in Chestnut Hill in the fall, only recently learned about the Children's Online Privacy Protection Act.

The law, which took effect last month, curbs the personal information that Web sites can collect from children under 13 without their parents' consent.

Even though it stops short of protecting two of her children, Lamb thinks it is a step in the right direction.

"I think it is great," she said. "What parent wouldn't be in favor of this?"

A study on family Internet usage released Tuesday by the Annenberg Public Policy Center at the University of Pennsylvania supports her view. Fully 96 percent of the parents and 79 percent of the children surveyed agreed that teenagers should have to obtain parents' permission before divulging personal information online.

But the Annenberg study also found that teens age 13 to 17 were more likely than younger children to say it was OK, in exchange for a free gift, to reveal whether their parents discuss politics and how much allowance the child receives.

A total of 1,001 parents and 304 youngsters between the ages of 10 and 17 participated in the national telephone survey in January and February.

A brand preference here. The model and make of the family car there. Details about how parents spend their weekends.

Pretty soon, the scraps of information gleaned from unsuspecting children filling out surveys to play free online games or registering to win prizes add up.

"On the Web, the smallest bits of information divulged by kids about their home life can be brought together using increasingly sophisticated tracking tools," said Joseph Turow, professor of communications at the University of Pennsylvania's Annenberg School for Communication, who wrote the Internet report. "Web sites can develop that information to create a detailed portrait of a family's lifestyle."

While obtaining personal information from children under 13 became more difficult when the new law took effect, Turow said families need to discuss privacy issues with children of all ages.

Signed into law in October 1998, the new measure says parents must provide verifiable consent before Web sites and Internet providers can collect personal data from children. So parents now decide who can collect information, how it can be used, and whether it can be shared with third parties.

The law is aimed at commercial Web sites and online services that are aimed at children and general sites that knowingly collect personal information about a child.

"This is the first online privacy law," said Loren G. Thompson, an attorney at the Federal Trade Commission, the agency overseeing enforcement of the law. "That is why it is so interesting."

She said Internet service providers and Web-site operators who violate the law could be fined as much as $11,000 per child from whom information was collected improperly.

The law was drafted in response to concerns raised by children's and privacy advocates that the Internet increasingly was being used to collect sensitive information from children.

A 1998 FTC survey of 212 commercial Web sites for children found that while 89 percent collected personal information from their young visitors, only 24 percent had privacy policies posted on their sites.

Just 1 percent of the sites required parental consent before gathering personal information and disclosing it to others.

Based on those findings, the FTC urged Congress to pass a law to protect children's privacy online. The nonprofit Center for Media Education and other children's advocates supported the bill. It also had industry backing, including from America Online and the Direct Marketing Association.

To get ready for the new law, AOL announced in mid-April that children would not be permitted to create personal profiles for its membership directory that include their name, age and interests. And on the day the law took effect, AOL deleted all existing profiles from its directory that contained birthdays from 1988 on.

Spokesman Andrew Weinstein said less than one-half of 1 percent of AOL's 22 million members had their profiles dropped. He said approximately 80 percent of parent-subscribers use AOL's parental controls features, which let parents restrict children's level of access to the Internet according to their age.

Those parental controls, he said, prohibit children under 13 from creating personal profiles. So only the children whose parents were not using parental controls lost profiles.

One nettlesome issue has been how sites can verify parents' consent. Under the sliding scale the commission has adopted, the level of verification required depends on how the information is to be used.

For example, if a child visits Nickelodeon's popular site and wants to enter a sweepstakes, the information gathered is limited to the child's first name and e-mail address and a parent's e-mail address. The parent, who is notified by e-mail, can authorize the child's permission by e-mail or have his child's information deleted from the sweepstakes database.

To comply with the law, some sites, such as, where members can find out whether the person they have a crush on feels the same way about them, simply dropped access for children under 13.

Karen DeMars, president, said the company deleted 25,000 accounts from its subscription list of 360,000.

"The nature of the service requires that we get some personal information, including name and e-mail address," she said. concluded it could not meet the stringent parental-verification requirements.

"Kids have reacted angrily, or they have reacted in a really concerned way," DeMars said. "They kind of feel like they are being discriminated against. . . . Others seemed to understand the reasons."

One former member vowed to establish a Web site to protest the action; others e-mailed DeMars to say they will be back as soon as they turn 13.

"Here are kids who grew up with the Internet, and they are having something taken that they have had," she said. "They don't understand that not everyone out there has their best interests in mind. From our perspective, this is a completely legitimate law, and we are happy to comply with it."

Thompson, the FTC lawyer, said most Web sites and Internet companies "have worked hard and spent time to try and comply."

She said the commission is surfing the Internet to make sure sites are in compliance, and it has established a hotline where consumers can report suspected violations: 1-877-382-4357. She said the commission had not tallied the number of complaints.

Amy Aidman, research director for the Center for Media Education, said the law already has changed the way Web sites deal with privacy. Sites the center had criticized in the past now post their privacy policies.

"Organizations are making it very clear that they want to be seen as caring about children's privacy and want to comply," she said.

And if parents want to know about a site's privacy policy, they can find it easily. "Before," Aidman said, "it was not possible."

Peter DiDonato, director of technology at the Springside School, said that despite the good intentions of the privacy act, parents need to pay attention to what their children do online.

"I don't think [the law] is going to address the issue totally," he said. "There are no silver-bullet solutions to these technological problems. . . . We can have all kinds of policies set up and filtering software, but it comes down to education. There are ways around everything."

MAKING SITE CHANGES America Online: No longer allows children under 13 to create personal profiles; deleted existing profiles of those born from 1988. Enlarged, purple privacy statement. For sweepstakes, asks children for first name, e-mail address and e-mail address of a parent; then notifies parent, who decides whether child may participate. No longer accepts subscriptions from those under 13 and dropped 25,000 accounts of those under 13. Sports Illustrated 'for Kids limits information collected for such features as "What Do You Think?" to a child's first name, age, state and e-mail address.

CHILDREN'S PRIVACY ACT The Children's Online Privacy Protection Act says Web sites and online services must:

Provide parents notice of their information practices.

Obtain verifiable parental consent before collecting personal information from children under 13, with certain limited exceptions.

Let parents decide whether their children's information can be given to third parties.

Give parents access to their children's personal information so they can decide if they want it deleted.

Give parents the opportunity to prevent further use or collection of information.

Not require children to provide more information than is reasonably necessary to participate in an activity.

Maintain the confidentiality, security and integrity of information collected from children.


comments powered by Disqus