On Providing Automatic Parental Consent over Information Collection from Children

Children’s privacy has become critical with the increasing use of the Internet for commercial purposes and corresponding increase in requests for information. 65% of children between the ages of 10 and 13 use the Internet for casual web surfing, chatting, games, schoolwork, e-mail, interactive learning, and other applications. Often, websites hosting these activities ask for personal information such as name, e-mail, street address, and phone number. The Children’s Online Privacy Protection Act (COPPA) of 1998 was enacted in reaction to the widespread collection of information from children and subsequent abuses identified by the Federal Trade Commission (FTC). COPPA is aimed at protecting a child’s privacy by requiring parental consent before collecting information from children under 13. In this paper, we describe an automated tool for protecting child privacy called Parental Online Consent for Kids Electronic Transaction (or POCKET). The POCKET framework is a novel, technically feasible and legally sound solution to automatically enforce COPPA. Parents answer a simple questionnaire regarding their privacy requirements and the POCKET user agent automatically converts it into a privacy preferences file. These preferences are enforced when a child uses the Internet. Only websites that adhere to the preferences can receive the child’s information, while websites whose policies do not match are blocked. A merchant-specific privacy information package and a signed digital agreement are uploaded to the qualified merchant from the client (child’s machine). POCKET framework incorporates a secure handshake protocol to protect the data exchange between the client and the merchant. A local log file created by POCKET and the digital agreement are used to enforce merchant accountability.