coppa news
  

Articles

Eleven months ago I filed a complaint with the FTC over some bizarre informal polices in place at YouTube and twitter. Mostly these involve ther resurrection of deleted accounts of children under 13 when parents give their consent. While this form of quasi-compliance may be admirable, it is not in line with the law because it does not follow the notification requirements as outlined in the COPPA Rule (notification must be direct such as e-mail but also must be present on the site or child directed parts of the site).

Twitter recently has taken this a step further by formally instituting a non-delete policy for children under 13 except in cases where a parent complains. COPPA is violated when personally identifiable information (PII) is coupled with actual knowledge of a child’s age being under 13 unless there is verified parental consent and notification. In the case of twitter is actual knowledge is revealed when the age is included in a tweet or bio.

Twitter is a general audience website and is not required to ask user’s age (age gate) or patrol tweets or other content to discover and terminate accounts of those underage. However, all sites including twitter are required to act if they inherit actual knowledge which basically means that if the site finds out a kid is on there that shouldn’t be, they must stop collecting personally identifiable information unless they have parental permission. Twitter however has reversed this by stating that it’s OK to collect PII from a child until a parent tells them not to. The actual knowledge standard in regards to children under 13 is covered in Complying with COPPA: Frequently Asked Questions (A GUIDE FOR BUSINESS AND PARENTS AND SMALL ENTITY COMPLIANCE GUIDE) in answer G1 which states:

1. Am I responsible if children lie about their age during the registration process on my general audience website?

The Rule does not require operators of general audience sites to investigate the ages of visitors to their sites or services. See 1999 Statement of Basis and Purpose, 64 Fed. Reg. 59888, 59892. However, operators will be held to have acquired actual knowledge of having collected personal information from a child where, for example, they later learn of a child’s age or grade from a concerned parent who has learned that his child is participating on the site or service.

It is interesting that the grade a child is in is enough to cause a problem under the actual knowledge standard. The question remaining may be is a parent the only one that can be concerned or is this just one example? To put it another way, can a stranger who is a concerned citizen rat out a child that is under 13? The answer comes in direct correspondence to me from an FTC spokesperson:

As to your specific question, whether an operator has actual knowledge they have collected personal information from a child is fact specific, but it is not the case that they can only get that actual knowledge from a parent. There are cases where operators may learn they have collected personal information from children from a school or teacher or other third party.

Cheryl Hackley
Office of Public Affairs

Some sites, especially Google go through great length to not acquire actual knowledge. Google for instance has no age violation reporting mechanism and you cannot flag a YouTube video based upon age. Twitter comes close to Google by not having a formal policy available online to report minors and by having a formal policy offline to take no action when they do receive a report unless that report comes from a parent. In reality though there is no easy way to report an age violation even if you are the parent. Inf act, it may be impossible.

The safety/privacy issues that can be reported on twitter are located here. Age violations are not listed as a reportable issue but there’s a clue on he page on how to turn in under 13s. The way to do it is simply by e-mailing privacy@twitter.com. The following is a walk through of the process of first reporting and then being rejected.

Here’s a snippet of the role player’s bio:

seb

One of the reasons I am convinced that this person is a role player (an adult on twitter pretending to be a child) is because the boy on the left side of the avatar is the son of a photographer that I am familiar with. The photo is 4 years old and was lifted from flickr. Flickr and a certain Russian photo site are popular places to shop for avatars for fake kids. This person known as “Seb” has more than 1000 followers with at least one verified as being 12. Plenty of others appear to be under 13 but they are also likely role players. If your kid has any level of popularity on YouTube or twitter, role players are likely to find them. As far as the real kids following him, that is mostly due to complimentary follow-backs which is where someone follows someone that followed them as a courtesy. Children should be warned to be cautious of this on twitter because a follow-back means the parties can contact each other privately (direct message).

The first step for reporting an underage kid is to e-mail the details to privacy@twitter.com. When I do this I mention COPPA and actual knowledge in the subject line:

From: CoppaNOW
Sent: Tuesday, September 30, 2014 7:13 AM
To: Twitter Support
Subject: ACTUAL KNOWLEDGE 12 YEAR OLD / COPPA

@****** says on his profile that he’s 12. I believe he’s an adult and his photos of “himself” are stolen from a professional photographer in the Netherlands. Either way he’s in violation and a termination would go a long way to help kids.

He is in violation of your terms of service and you are collecting PII from a 12 year old without parental consent which is against COPPA once it’s pointed out to you.

Thanks for your consideration.

That’s step one. A report will not be accepted though until you respond to an auto-response e-mail making sure you understand what the “privacy” address is for. That is step two. Step three is the rejection:

From: Twitter Support [mailto:support@twitter.com]
Sent: Tuesday, September 30, 2014 7:14 AM
To: CoppaNOW
Subject: Case# 06442421: FW: ACTUAL KNOWLEDGE 12 YEAR OLD / COPPA

******* This is an AUTOMATED response from our support system. *******

Hello,

Thanks for your request. This email address is for the following issues only:

• Questions regarding privacy on Twitter, and specifically our Privacy Policy
• Reports of underage users
• Report of deceased users
• Requests for own account information

If you have one of these privacy-related questions, you must reply to this email in order to open a ticket for review. All unconfirmed emails will not be read or responded to.

[…]

Thanks,

Twitter Trust & Safety

————————————————-

This e-mail shows you that the e-mail address I used is appropriate for these reports. However, unless you are a parent this process is not for you. And if you are a parent the next step is also not for you.

Here’s the official reply that comes next. This is a canned message but outlines their formal policy on this matter:

From: Twitter Support [mailto:support@twitter.com]
Sent: Tuesday, September 30, 2014 3:44 PM
To: CoppaNOW
Subject: Case# 06442421: FW: ACTUAL KNOWLEDGE 12 YEAR OLD / COPPA –

Hello,

Thanks for bringing this to our attention. However, we require the individual directly involved or someone legally authorized to act on their behalf to report this issue.

If this is someone with whom in you’re in contact, please encourage them to file a report here: https://support.twitter.com/forms.
Once we’re in touch with the individual, we’ll be able to provide them with the information they need to resolve the issue.

Thanks,
Twitter
————————————————-

I find this surprising. A good ticketing system would have already brought up the bio in question and the account could be suspended faster than reading and replying to the e-mail. To add further insult, the “forms” URL above doesn’t included a way to report underage kids even if you are the parent. In short, twitter states you must be 13 in order to use their service, doesn’t provide a way to report illegal children, tells you when you reach the right place and then puts you on a street that leads to nowhere.

The only time I report a violation is when I feel that a real flesh and blood child is in danger and the suspect purports their age to be under 13. In this case I did (and still do) think children are at risk because of this account. This is the second report I have done in past 30 days with the same result.

It is clear to me that twitter’s posture on this is against COPPA and against the best interests of families and twitter itself. There is no logical reason for twitter not to respond to these requests as it is against their TOS. Twitter can ignore COPPA and follow their own TOS and go a long way in protecting children on the service.

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

Yelp recently reached a settlement agreement with the Federal Trade Commission regarding a bug in our mobile registration process that allowed certain users to register with any birth date when it was supposed to disallow registrations from individuals under 13 (birthdates on Yelp are optional in the first place, so users are always free to register without one).

via Yelp Official Blog: Yelp and FTC Agree to Settle Claim Concerning Mobile Registration Bug.

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

Today in the Northern District of California, a lawsuit was filed against Yelp! along with a stipulation for a settlement. Because of the timing of the action (filed and settled the same day) it is apparent that this was worked out in advance and the FTC is filing in order to have a judge approve the deal.

FTC & Yelp Stipulations

In part:

A. Judgment in the amount of Four Hundred Fifty Thousand Dollars ($450,000) is entered in
favor of Plaintiff against Defendant as a civil penalty.

B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the
United States, Four Hundred Fifty Thousand Dollars ($450,000). Such payment must be made
within seven (7) days of entry of this Order by electronic fund transfer in accordance with
instructions previously provided by a representative of Plaintiff.

C. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all
assets transferred pursuant to this Order and may not seek the return of any assets.

D. The facts alleged in the Complaint will be taken as true, without further proof, in any
subsequent civil litigation by or on behalf of the Commission, including in a proceeding to
enforce its rights to any payment or monetary judgment pursuant to this Order.

E. Defendant acknowledges that its Taxpayer Identification Numbers, which Defendant
must submit to the Commission, may be used for collecting and reporting on any delinquent
amount arising out of this Order, in accordance with 31 U.S.C. § 7701.

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

There has been talk with a lot of re-tweets about an impending COPPA crackdown by the FTC. A lot of the “news” around this crackdown warns of $16K fines for COPPA violations per download. I do not know if there’s a crackdown coming but I do know we aren’t too far off to the 2nd anniversary of the last COPPA action. At this rate we might not hit any enforcment actions for two years. That’s not much of a crackdown but it’s always possible that some day there might be.

I don’t know what the future holds for COPPA enforcement but I do believe that no one knows outside the FTC. As far as the $16K figure, I have contacted the same FTC official that is quoted in the original article (but not quoted saying there’s a crackdown coming or to expect $16K fines) and this is what he said:

 

The Commission had announced, in denying the request to move the effective date, that we’d give an additional month or two for smaller developers to come into compliance.

Our civil penalty authority takes into account a number of factors, not just the number of violations.

 

The first line is in response to the grace period that the FTC gave after the debut of the revised COPPA Rule. A month or two means September 2013 at the latest and there have been exactly zero enforcement actions made public since then. The second line is vague but basically says they look a lot more than just the number of violations which is enforced by one of the COPPA FAQs.

Section B of the Complying With COPPA FAQ says the following:

(B)2.    What are the penalties for violating the Rule?

A court can hold operators who violate the Rule liable for civil penalties of up to $16,000 per violation.  The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company.  Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center.

Looking back on past enforcements we see that for the most part the fines per child have been pretty low. Even with settlements greater than a million dollars, the per child fine isn’t that much. It all adds up but these figures are not counting individual infractions such as multiple logins or downloads.

The following chart outlines published fines and the reach in number of children reported. This allows us to extrapolate an average fine per child. For the sake of absurdity, I’ve included a column of how much the fines could have been if the total fine was taxed at $16K for each. This would have brought the Treasury department more than $56 billion dollars if enforced by the max that the FTC Act allows.

I have not included cases where the fine was revealed but not the reach and older cases typically did not care about reach or at least did not disclose the formula that was used. You can read about all the cases made public on the FTC website by clicking on the Case Highlights listed in the above FAQ answer.

See the chart here (scroll down).

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

The FTC staff has posted revisions to three Frequently Asked Questions (“FAQs”) related to obtaining verifiable parental consent under its COPPA Rule. For a comparison of the old and new FAQs, click here.

Although the changes (which include a new FAQ H.16) may appear substantial, they mostly reaffirm the FTC’s longstanding position that the agency’s list of approved verifiable parental consent mechanisms is not exhaustive and that companies can implement different methods as long as they meet the statutory standard of amounting to a “reasonable effort (taking into consideration available technology) . . . to ensure that a parent of a child receives notice of the operator’s personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child.” 15 U.S.C. § 6501(9).

Specifically, the revisions:

via FTC Staff Updates Children’s Online Privacy Protection Act (COPPA) FAQs on Verifiable Parental Consent Methods | The National Law Review.

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

I’ve done a lot of research and monitoring of YouTube over the past few months and have discovered some peculiar things. Since YouTube is part of the universal Google account system this article will drift back in forth. It’s not 100% Google and not 100% YouTube. This article explains how to report a child for having an unauthorized YouTube channel and when it’s good to do so and when it’s better to just move along.

First, you may be surprised to know that the umbrella Google policies that reign over YouTube do not mention an age requirement. This includes their terms of service (http://www.google.com/intl/en/policies/terms/) and privacy policy (https://www.google.com/intl/en/policies/privacy/).  There is no mention of children at all and the only place you’ll find “13” is the year part of the date on the policy revisions.

Google is perfectly OK in doing this because they use a neutral age-gate under COPPA. To be neutral they can’t come right out and say why they are asking. That would actually be a problem under the rules. Sites like Twitter don’t use an age gate and therefore it is easier for them to disclose the rule which is actually the law.

Instead of telling you at sign-up what the policy is, YouTube provides the following information on a parental resource page:

How old does my child have to be to use YouTube?

In order to create a YouTube account, we require users to confirm that they are at least 13 yrs old. Users who enter any age younger than 13 will be prohibited from creating YouTube accounts. In addition, if a user’s video gets flagged and, upon review, we determine that the user has inaccurately stated their age during the account creation process, we will suspend their account.

Source: https://support.google.com/youtube/answer/126289?hl=en

Unfortunately this policy is not linked from the TOS or privacy pages and is very hard to find. The easiest way to find it is actually to use Google Search otherwise you’re likely to get lost in their help system trying to find the answer. I’ve complained about this before because in my articles. If a parent were to review the documents presented to them when creating an account for their child they wouldn’t be wrong to think the age policy isn’t presented at signup.

But things get even quirkier Though Google forbids access to children under 13 there is no official way to turn someone in. Often you will hear kids threatened to be flagged for being too young but there’s no documented way to do that. Google does say that if a video is flagged and they determine the user lied then the account will be suspended (but not always terminated). This still leaves two issues. First, you can’t turn a kid in for age violation on non YouTube properties because the video flag system isn’t there. But you can’t turn them in through the video flag mechanism either because there isn’t a direct mechanism for age violations.

The problem with YouTube and COPPA is the Actual Knowledge standard. This dictates that a general audience site like YouTube isn’t held responsible for kids they don’t invite unless they have actual knowledge that they are under 13. About the only way to obtain actual knowledge on a particular video is for the child to state their age but you can’t report it unless you can report on an additional offense.

So no matter how much a child looks like they are 8 YouTube will not usually remove an account unless the video has both actual knowledge disclosure and another reportable violation. In other words two violations are needed.

These are the reportable issues for videos to be flagged:

 

  • Sexual content
Flagged videos and users are reviewed by YouTube staff 24 hours a day, seven days a week to determine whether they violate Community Guideline. Accounts are penalized for Community Guidelines violations and serious or repeated violations can lead to account termination. If you would like to report a channel, please click here.

As you can see “age” is not a listed issue. If you report child abuse or flag the channel instead of the video but if there is no appropriate sub-category you risk being ignored at best or deleted for abusing the reporting system.

In my opinion age isn’t here because YouTube doesn’t want it to be here. They are avoiding deploying resources to support actual knowledge. Don’t ask don’t tell internet style.

One caveat though is fetish videos. YouTube does not allow this for kids of any age even if older than 13. Usually when a kid makes a fetish video they have no idea it is for the gratification of an adult or any idea what a fetish is. iCarly opened a lot of kids up to this through dares which usually feature feet or even uvulas. Search on YouTube for “iCarly foot dares” but this isn’t SFW. If you see a kid make a fetish video (hogtie is also a popular dare) flag it under Sexual Content and then sub flag it under involving minors. Put in the comments that it is fetish and not explicit so they don’t launch a nuclear response.

The video I reported under the terms of the last paragraph was of an 8 year old boy doing a request for who he thought was a teen girl. The title even mentioned “iCarly”. YouTube deleted the video within 5 minutes of the report which is very commendable. However, I also asked them to look at other videos on the channel to evaluate the account but they didn’t remove it even though he admits age he did so in a different video than the one I flagged. The fetish video is gone but the account remains and now the kid is setting up Skype “interviews” with strangers.

The title of this article though is how to rat out a child under COPPA on YouTube so there must be a way and there is.There just isn’t official and it probably won’t stick in the long term because the kid will just make a new account. I only flag an account if I feel the kid is doing something so dangerous that could risk real world safety. If they are careful with PII and aren’t making videos for perverts then I’m not going to troll for them. If they give out their address or constantly upload Skype chats with adults then I will pull the trigger to at least get current content removed. Let them start over and maybe they’ll be smarter. I am not fooling myself by thinking an 8 year old is going to take a 5 year break from YouTube.

I very much encourage anyone to follow these steps under the circumstances I describe above. And by all means keep flagging videos that break rules. A removed video earns the kid a strike and after 3 strikes the account is gone.

Here’s what you need for a third party age complaint to YouTube:
  1. The URL that leads to the child self disclosing their age. This can be to a video (make a note of the timestamp), their About page, or a comment on a video. The URL needs to be onsite. YouTube is not under obligation to hunt down info on other sites.
  2. Send an e-mail to legal@support.youtube.com. Understand that they might not like this address being used for this purpose but it has worked. You might want to create a new e-mail account for this purpose in case they become irritated by you using it.
  3. Make sure to include the channel name.
  4. I recommend quoting the law a bit in case the support person is new and trained to respond with this:

In order to review legal claims, we must be notified directly by the party in question or their authorized legal representative. If you are authorized to act on the party’s behalf, please respond to this email specifying your relationship to the party in question.”

This alleges that a third party complaint cannot be made but that isn’t the case. I recommend pointing out in advance that the COPPA rules changed in July and that third parties can trigger actual knowledge. Feel free to use this:

This is a notification under the actual knowledge standard of the Children’s Online Privacy Protection Rules  issued pursuant to the Children’s Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501 et seq. as amended July 1, 2013. Furthermore, the FTC has made this statement regarding third party complaints:

‘Whether an operator has actual knowledge they have collected personal information from a child is fact specific, but it is not the case that they can only get that actual knowledge from a parent.  There are cases where operators may learn they have collected personal information from children from a school or teacher or other third party.’ Source: FTC Office of Public Affairs 202-326-2480.

When sending e-mail avoid using anything but plain text. Anything with links, HTML or other formatting may trigger a rejection by their e-mail system upon receipt.Everything in this article has been tested several times and the results are consistent. My purpose here is to show what can be done and to point out the quirks in the system. In most cases it isn’t worth it unless something seriously is wrong and there’s no better way. Flagging a video is good to get rid of naughty content quickly so use it when available.

Using the above e-mail should only be done in urgent cases where a child might be giving out too much PII to be a danger to themselves offline. The child is likely to recreate their account so trying to be a vigilante is fruitless and e-mailing a legal department with the above wording is a bit dramatic so use it as a tool and do so wisely.

Special thanks to @Rob at ThirdParent for providing great how to articles including YouTube Will Shut Down Accounts If Users Are Under 13 which is based on earlier research leading up to this article.

 

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

In a nutshell here are the points:

  1. COPPA requires that a website or operator that collects information from preteens post prominent notices to their data collection policies regarding children including methods a parent can take to revoke consent.
  2. Twitter and YouTube have policies forbidding preteens on their sites.
  3. Twitter and YouTube allows some preteens on their sites through a proper COPPA consent mechanism.
  4. There is a conflict between the policies that do not allow preteens and the policies that allow exceptions at YouTube and Twitter.
  5. There is a conflict between the policies and the law because the services appear to think they do not need to post polices for children they do not allow when they allow them.

PDF: complaintTYT.pdf

 

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

Here’s the truth about whether YouTube and Twitter allow underage accounts.

YouTube and Twitter are generally considered to be general audience services under the Children’s Online Privacy Protection Act (COPPA) of 1997. This means that the services claim to only be for those over 13 and apply an age limit in these cases through their Terms of Service, Privacy, or in the case of Google deeply buried regulations and an age gate:

Google/YouTube:

Age requirements on Google Accounts

Below are the minimum age requirements to own a Google Account:

  • United States: 13 or older

https://support.google.com/accounts/answer/1350409?hl=en

(A specific age is not defined in Google’s privacy policy or TOS though COPPA sets a worldwide minimum age of 13 for its services including YouTube though other countries may set a higher but not lower age.)

Twitter:

Our Policy Towards Children

Our Services are not directed to persons under 13. If you become aware that your child has provided us with personal information without your consent, please contact us at privacy@twitter.com. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we take steps to remove such information and terminate the child’s account. You can find additional resources for parents and teens here.

https://twitter.com/privacy

(There is an out for Twitter in the form of them saying that they do not collect information without consent but note they also state that any child under 13 will have their account terminated.)

The only problem with these statements is that both of these services knowingly allow accounts for minors because both will resurrect a preteen’s account under certain albeit inconsistent circumstances. . This shouldn’t be a problem as long as COPPA consent requirements are met but it brings up two interesting issues. First, why do these secret policies exist and second, does having them change the nature of the sites from being of general interest to that of being child directed?

Why do these polices exist?

I am not a huge fan of COPPA because the loopholes are too large but it intersects with my personal belief that preteens are of an age that requires some level of protection especially on highly interactive social media sites. I believe that YouTube and Twitter are such sites and the best thing they can do law or no law is to stick to the policy of not allowing preteens publish on the sites. I care far less about fPII leaks used to invade privacy by marketing companies than I do perverts making special request dare videos on YouTube or trading contact info on Twitter. At least on the much maligned Facebook site there are settings to allow for friends only which is not the case for YouTube and Twitter.

So why have the secret exception policy to begin with? The only people that qualify for an exception are children that lie during signup. You can’t request an exception during signup and the stated policy is quite clear that preteens are not welcome.

Some of the exceptions seem to be granted for some level of celebrity or success of the channel but none of the samples appear to be of earth shattering value at least in the terms of immediate monetary payback. Perhaps the companies don’t want to make enemies of future pop stars or perhaps they don’t want to make enemies at all. But as I will address later, I think this creates a paradox I’ve already introduced in a previous post.

Policies? What policies? Where can I read about these secret policies?

You can’t read about the secret policies anywhere but here because they are a secret.  I know they are secret because the policies are directly against the TOS & Privacy policies stated at both Twitter and YouTube as linked below. I know the policies are real because of observation and sometimes active experimentation.

YouTube’s Secret COPPA Policy

I have observed the take down and reinstatement of YouTube accounts for both “celebrity” and non-celebrity accounts on YouTube as I first pointed out here. There are two cases of note that differ somewhat compared to Twitter. First, the 11 year old mentioned in the previous article had some level of fame but in the big picture isn’t even a blip. But there was another account that was removed as collateral damage when his was removed and both were re-instated. The 12’s account was that of a regular vlogger who currently has fewer than 300 subscribers and under 10,000 combined video views. While I don’t know exactly what happened with the 11 who is mentioned in the article, I know exactly what happened to this 12.

As previously reported by ThirdParent Google will shut down a YouTube account of a preteen if they acquire actual knowledge of their age. Sometimes this is done immediately without the option of appeal but sometimes not. In the case of the 12, Google terminated the account on their own initiative. But in this case, lucky for the kid, he was given a chance to be reinstated.

The option came in the form of an e-mail that implied that parental consent could be given to re-open the account if the account is controlled by [a] parent or guardian (whatever “controlled” means). The e-mail was determined to be authentic by tracing back the e-mail header and comparing it with the few similar letters that can be found in Google Search. Of course the proof in the pudding is the account was terminated, the child claimed the e-mail was sent, that his parent replied to the e-mail and that his account was indeed re-instated.

I have also been in communication with the department you can rat kids out to at YouTube and will share that info in a future article.

Suffice it to say, it is clear that a preteen cannot sign up for a YouTube account without lying to the age-gate but can regain their account if terminated if their stars are aligned properly. This offer only applies to liars but is 100% OK under COPPA even if I think it isn’t the greatest idea on the net.

Twitter’s Secret COPPA Policy

Twitter is more interesting because my observations seem to show that some level of fame is needed to keep a preteen account open (EDIT: this may not be the case in at least in one instance as listed below). This can come in the claim of being a professional of some type (actor, future pop star) but strictly being a relative of a star may not be good enough.

Testing Methodology

A list of Twitter followings was extracted from an adult who almost exclusively tweets to preteens. From this list the following criteria was used to determine which accounts would be good test subjects for a third party COPPA complaint to Twitter:

1) User must self admit age in twitter bio.

2) Tweets must appear to be in the first person. This means that tweets that appear to come from a parent, agent or manager would disqualify for the test.

Self admitting age makes means Twitter inherits actual knowledge through the third party complaint only using data provided on the account itself. Actual knowledge is the standard set by COPPA rules by the FTC for taking action on an account.

First party tweets are also important because it shows that twitter is collecting PII directly from a child and not a representative.

From this criteria 17 accounts were chosen to be reported as a batch to twitter. Of these, 7 were either not deleted or were deleted and then later restored (noted below as resurrected). It is highly likely that accounts not marked resurrected actually were, or that more will be resurrected soon. This is assumed because in every case where an account came back the bio was changed to either remove information about age or that the account was owned and operated by an adult or at least monitored by a parent. I anticipate parents to intervene where possible to get accounts restored.

The following table shows the accounts that survived or were revived after being suspended by twitter. The first 11 listed in bold is a bit confusing because of his low follows and YouTube channel followers of 42 leads me to believe that he actually isn’t a celebrity. However stating that one is a “singer” and your channel is “monitored by Mum” may be all you need for twitter.

Age Status Tweets Following Followers Notes
9 Resurrected 1663 1868 25491 Musician claims account managed by parents
10 Resurrected 5381 2252 2210 Musician claims account managed by parents
10 Resurrected 4526 558 20480 Singer claims account O&O by management company. Also has Instagram.
11 Resurrected 691 465 171 Removed age reference and states “monitored by mum”
11 Exists 1441 297 551 Professional actor claims account operated by agency.
12 Resurrected 3490 1382 1377 Actor with IMDB entry states account monitored by “Mum”
12 Resurrected 1876 2148 2845 Musician claims account managed by parents

It appears though I do not know that Twitter is offering the steps to violate their own terms of service in order to allow some preteens on even if they are not a celebrity. It seems obvious that they are tipping off the account holders and making COPPA exceptions as one of the tweeters went as far as to give other kids directions on what to do so they won’t be deleted.

(Example not included in order to protect privacy of the child regardless of how twitter feels about it.)

For both Twitter and YouTube this seems paradoxical considering their TOS but would make them compliant with the law as long as verified consent was acquired and I have no reason to think that it wasn’t.

General Interest versus Child Directed

As I outlined in an earlier article the other paradox that is introduced is that if the kid’s are cleared by these secret policies, then what about the audience? Who are the viewers of preteen videos and tweets? If it is likely that a preteen entertainer is going to attract a preteen audience, does that make at least part of these sites child directed rather than general interest? If so, does that put these sites in a pickle as far as verifying not the channel holder but the viewers themselves?

And in one case each above, both Twitter and YouTube have resurrected channels that do not appear to be ran by celebrities. Who is the audience for those channels if not other preteens?

This can prove most interesting for Google I think because they use an age-gate and from what I have read that cannot be done to keep preteens out of child directed sites but rather only to segregate them. But because these policies are secret that’s exactly what they are doing. If you say you are a preteen then you are not allowed on (Twitter does not use an age gate).

I am not a lawyer (IAMAL) but I am hoping to run this by FTC staff this week @FOSI. I do not know what payback these sites are expecting for allowing kids that lie about their age (or simply click I AGREE after reading they aren’t welcome) to be on their site but they just might be shooting themselves in the foot by not considering the ramifications of changing their nature to being child directed with these policies.

Conclusion

I am not an advocate of COPPA. I am also not against it. I question its effectiveness in protecting children versus penalizing sites designed to help kids. I am a safety advocate and I think if we are going to have a law it should be consistent and should strive to meet the goal of safety and privacy. From a safety standpoint, COPPA notwithstanding, I do not think preteens should be using sites to create interactive content for strangers. The law has enough giant loopholes without sites creating secret exceptions to allow or even encourage preteens to actively participate in this adult world. It would be best for YouTube and Twitter to follow their own stated policies and not allow exceptions but if they do they need to accept that they are a now a child-directed site and activate COPPA compliance accordingly.

What do you think? Leave your thoughts here or tweet me @coppaNOW

Special thanks to Rob Zidar @ thirdparent.com for edits.

Email this to someoneShare on FacebookTweet about this on TwitterShare on Google+Share on TumblrDigg thisFlattr the authorShare on RedditShare on StumbleUponBuffer this page

January 2019
M T W T F S S
« Oct    
 123456
78910111213
14151617181920
21222324252627
28293031  
business.ftc.gov | Your Link to the Law