§6502 Regulation of unfair and deceptive acts and practices in connection with collection and use of personal information from and about children on the Internet

Summary

Requires websites aimed at kids—or any site that knows it is collecting personal data from children—to follow rules the Federal Trade Commission had to write no later than 1 year after October 21, 1998. Those rules make sites tell parents what kid data they collect, how they use it, and who they share it with. Sites must get verifiable parental permission before collecting, using, or sharing a child’s personal information. Parents must be able to ask for a list of what was collected, stop the site from keeping or using the child’s data or from collecting more, and get the child’s data back. Sites must not make kids give more information than needed to play a game or join an activity, and they must keep children’s data safe. There are a few limited exceptions to the parental-permission rule, such as one-time replies to a child’s question that are not stored, using contact details only to get consent or to protect a child’s safety, and actions needed for site security, legal process, or public-safety investigations. A site may stop serving a child if a parent refuses further use or storage of the child’s data. If a site breaks these rules, it counts as an unfair or deceptive practice under federal law (subject to sections 6503 and 6505), and states may not impose conflicting liability for those same online activities.