§6502 Regulation of Unfair and Deceptive Acts and Practices in Connection with Collection and Use of Personal Information From and About Children on the Internet

Summary

Websites or online services aimed at kids, or any site that knows it is collecting information from a child, must follow rules the Federal Trade Commission had to create within 1 year after October 21, 1998. Those rules make sites tell what child data they collect, how they use it, and who they share it with. Sites must get clear, verifiable permission from a parent before collecting, using, or sharing a child’s personal information. If a parent asks and proves who they are, the site must say what kinds of information it collected, let the parent stop any future use or storage of that information, and give the parent a way to get the actual information the site has about the child. Sites must not make a child give more personal data than needed to play a game, win a prize, or take part in an activity. They must also use reasonable steps to keep kids’ information safe. The rules list limited cases where parental permission is not required, such as one-time replies to a child’s request, collecting a parent’s contact info to get consent, certain safety-related uses of a child’s name or contact info, and actions needed for security, legal process, or law enforcement. A site may stop service to a child if a parent refuses further use or storage of the child’s data. Breaking these rules is treated as an unfair or deceptive practice under federal law, and states may not impose conflicting liability for operators doing business across state or international lines.