Maya's son wants to make a birthday card with an AI image maker. He suggests uploading a photo of himself and typing his full name and school.
"Then it will look like me," he says.
Maya is not sure. She has heard there are special rules for children online. What do they say, and what do they mean at her kitchen table?
COPPA is the Children's Online Privacy Protection Rule. It is a US rule from the Federal Trade Commission, the FTC.
Under COPPA, a child is a person under the age of 13.
The rule lists what counts as a child's personal information. The full list has eleven items.
| Some items on the COPPA list | Example |
|---|---|
| Full name | A first and last name together |
| Home address | A street and town |
| Online contact information | An email address |
| Phone number | A mobile number |
| A photo, video or audio file with the child's image or voice | A selfie or a voice recording |
| Street-level location | A pin on a map at home |
| Biometric identifiers | A face or fingerprint scan |
COPPA also says something about consent. Whoever runs an online service, which the rule calls an operator, has a duty.
They must get verifiable parental consent before they collect, use or share a child's personal information.
The rule is about operators, not parents. But its list is a useful guide for your own family rules.
A photo with her son's face, his full name and his school would all give away who he is.
Maya decides on a simpler card. No photo, no name, no school. He can add his name by hand after it is printed.
Whether a child uses any AI tool is a parent's decision. If they do, a parent sits with them.
| Detail about a nine-year-old | On the COPPA list? |
|---|---|
| A photo of the child's face | ? |
| The child's home address | ? |
| The child's phone number | ? |
| The child's favorite animal | ? |
Sources: 16 CFR Part 312, COPPA Rule (eCFR)
Tomorrow: a request about a student, and the private details hidden in it.