§6502 Regulation of Unfair and Deceptive Acts and Practices in Connection with Collection and Use of Personal Information From and About Children on the Internet

Summary

Websites or online services aimed at children, or any site that knows it is getting personal information from kids, must follow rules made by the Federal Trade Commission (FTC). The FTC had to write those rules within one year after October 21, 1998. The rules make sites tell what information they collect from children, how they use it, and who they share it with. Sites must get verifiable permission from a parent before collecting, using, or sharing a child’s personal information. Parents can ask a site what specific information was collected about their child, stop the site from keeping or collecting more of that information, and get a copy of the child’s information by reasonable means. The rules also say sites cannot make a child give more information than needed to play a game or win a prize. Sites must protect the security and privacy of children’s information. There are limited exceptions where parental permission is not needed, such as one-time replies that are not kept, getting a parent’s contact only to get consent, certain safety or security uses, legal requests, and some follow-up replies when parents are notified. A site may stop service to a child if a parent refuses permission. Breaking the FTC rules counts as an unfair or deceptive practice under federal law, and states cannot impose rules that conflict with this treatment.