Does this mean if you don't ask for a birthdate on your service, you're safe, or are you required to ask for birthdate and reject anything that comes in under 13?
An easy fix for this: dynamically populate the date drop-downs so you can only select (today - 13 years)
You don't have to ask for a user's age if your site is intended for a "general audience". You'll still need to purge information from users who are discovered to be under 13.
"""
40. I operate a general audience site and do not ask visitors to reveal their ages. I do have a button that users can click to send feedback, comments, or questions by email. What are my responsibilities if I get an email that says, “Hi, I am Steve, age 10, and I really like your site. When do you think you will add some more games?”
Under the Rule’s one-time contact exception, 16 C.F.R. § 312.5(c)(2), you may reply to the child once without sending notice to the parent or obtaining parental consent, if you do not re-contact the child, and you delete the child’s personal information, including email address, from your records after responding to the email.
"""
Legal Corollary of 40: If you send spoofed email to a site operator claiming to be under 13, you could legally force them to delete another user's account.
Comments
Does this mean if you don't ask for a birthdate on your service, you're safe, or are you required to ask for birthdate and reject anything that comes in under 13?
An easy fix for this: dynamically populate the date drop-downs so you can only select (today - 13 years)
You don't have to ask for a user's age if your site is intended for a "general audience". You'll still need to purge information from users who are discovered to be under 13.
See questions 40/41 http://www.ftc.gov/privacy/coppafaqs.shtm#teen
""" 40. I operate a general audience site and do not ask visitors to reveal their ages. I do have a button that users can click to send feedback, comments, or questions by email. What are my responsibilities if I get an email that says, “Hi, I am Steve, age 10, and I really like your site. When do you think you will add some more games?”
Under the Rule’s one-time contact exception, 16 C.F.R. § 312.5(c)(2), you may reply to the child once without sending notice to the parent or obtaining parental consent, if you do not re-contact the child, and you delete the child’s personal information, including email address, from your records after responding to the email.
"""
Legal Corollary of 40: If you send spoofed email to a site operator claiming to be under 13, you could legally force them to delete another user's account.