In an increasingly dangerous digital age, parents have a right to maintain control over the personal information companies collect online from individuals under age 13. According to the Federal Trade Commission (FTC), The Children’s Online Privacy Protection Act offers tools to do that. The FTC, the nation’s consumer protection agency, enforces the COPPA Rule. If a site or service is covered by COPPA, it has to get a parent’s consent before collecting personal information from their child, and it has to honor their choices about how that information is used.

The COPPA Rule was put in place to protect kids’ personal information on websites and online services, including apps, that are directed to pre-teens and those younger. The rule also applies to a general audience site that knows it’s collecting personal information from kids that age. The COPPA Rule requires those sites and services to notify parents directly and get their approval before they collect, use, or disclose a child’s personal information. Personal information in the world of the COPPA Rule includes a child’s full name, address, phone number or email address; their physical location; photos, videos and audio recordings; government identifiers like a Social Security number; biometric identifiers; and persistent identifiers, like IP addresses, that can be used to track a child’s activities over time and across different websites and online services.

If the site or service does not collect a child’s personal information, COPPA is not a factor. COPPA kicks in only when sites covered by the rule collect personal information from a person’s child. Practically speaking, COPPA puts you in charge of your youngster’s personal information.

How COPPA Works

Here’s how COPPA works: Let’s say your children want to use features on a site or download an app that collects their personal information. Before they can, one should get a plain language notice about what information the site will collect, how it will use it, and how they can provide their consent. For example, a person may get an email from a company letting them know their child has started the process for signing up for a site or service that requires their child to give personal information. Or they may get that notice on the screen where they can consent to the collection of your child’s personal information.

The notice should link to a privacy policy that’s also plain to read and in language that’s easy to understand. The privacy policy must give details about the kind of information the site collects, and what it might do with the information, say, if it plans to use the details to target advertising to a child or give or sell the information to other companies. Additionally, the policy should state how to contact someone who can answer specific questions.

That notice also should have directions on how to give consent. Sites and services have some flexibility in how to do that. For example, some may ask to verify a person’s identity using government-issued identification. Others may have a toll-free number they can call.

If the contact agrees to let the site or service collect personal information from their child, it has a legal obligation to keep it secure.

Parents Remain in Control

The first choice is whether they are comfortable with the site’s information practices. Start by reading how the company plans to use your child’s information. Then, it’s about how much consent a person wants to give. For example, they might give the company permission to collect their child’s personal information but still have the right to prevent the company from disclosing that information to others.

Once you give a site or service permission to collect personal information from your child, you’re still in control. Parents have the right to review the information collected about their child. If you ask to see the information, keep in mind that website operators need to make sure you are the parent before providing you access. You also have the right to retract your consent any time, and to have any information collected about your child deleted.

If you think a site has collected information from your kids or marketed to them in a way that violates the law, report it to the FTC at ReportFraud.ftc.gov.