COPPA AND SCHOOLS
- Can an operator of a Web site or online service rely upon an educational
institution to provide consent to the operator’s collection, use or disclosure ofpersonal information from students? COPPA does not preclude schools fromacting as intermediaries between operators and parents in the notice and consentprocess, or from serving as the parent’s agent in the process of collecting personalinformation online from students in the school context. See 1999 Statement ofBasis and Purpose, 64 Fed. Reg. 59888, 59903. Determining whether the schoolmay provide consent on behalf of a parent, or whether the operator can rely on theschool for consent, will depend on the nature of the relationship between the onlineservice and the school or child, and the nature of the collection, use, or disclosureof the child’s personal information. See FAQ M.2 below. Whether the operator isworking with the school, or obtaining consent directly from parents, it mustprovide a complete and accurate disclosure regarding what data is collected fromchildren, how it will be used, and with whom it will be shared. The operator mayviolate the Rule if it fails to disclose its data collection, use, or disclosure practicesto the consenting party. In addition, the school also must consider its obligationsunder the Family Educational Rights and Privacy Act (FERPA), which givesparents certain rights with respect to their children's education records. FERPA isadministered by the U.S. Department of Education. For general information onFERPA, see http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html. Manyschool systems have implemented Acceptable Use Policies for Internet Use(AUPs) to educate parents and students about in-school Internet use.Shareathon requests very basic information about users. We ask for first and lastname and we ask for a parent's email address. That information is used to createuser take home sheets designed for parental approval. Parental signatures arerequested at the bottom of the take home sheet. We will also send one email tellingthe parent about the Shareathon and requesting that they build a personalShareathon page for their user. Any parent can request that their user be removedfrom the system at any time. The names and email addresses are not used for anyother purpose other than for those expressly pertaining to the specific Shareathonevent.
- Under what circumstances can an operator of a Web site or online service rely
upon an educational institution to provide consent? Many school districts contractwith third-party Web site operators to offer online programs solely for the benefitof their students and for the school system, for example, homework help lines,individualized education modules, online research and organizational tools, orweb-based testing services.Where a school has contracted with an operator to collect personal informationfrom students for the use and benefit of the school, and for no other commercialpurpose, the operator is not required to obtain consent directly from parents, andcan presume that the school’s authorization for the collection of students’ personalinformation is based upon the school having obtained the parents’consent. However, the operator must provide the school with full notice of itscollection, use, and disclosure practices, so that the school may make an informeddecision. The school may also want to inform parents of these practices in itsAcceptable Use Policy.If, however, an operator intends to use or disclose children’s personal informationfor its own commercial purposes in addition to the provision of services to theschool, it will need to obtain parental consent.Shareathon only uses the limited personal information for one Shareathonfundraising event which is held for the benefit of the user and school or groupholding the Shareathon. We do not use any user information for any othercommerial purpose.
- What information should a school seek from an operator before entering into
an arrangement that permits the collection, use or disclosure of personalinformation from students? A school should be careful to understand how anoperator will collect, use, and disclose personal information from its students indeciding whether to use these online technologies with students. Among thequestions that a school should ask potential operators are:What types of personal information will the operator collect fromstudents? Shareathon only collects user first name, user last name and parentsemail. Parents can opt to upload a personal photo or they can use one of our stockphotos.How does the operator use this personal information? Shareathon uses the limitedpersonal information collected to build a Shareathon fundraising website on behalfof the school or school that includes a user page that offers no specific contactinformation about the user.Does the operator use or share the information for commercial purposes not relatedto the provision of the online services requested by the school? For instance, doesit use the students’ personal information in connection with online behavioraladvertising, or building user profiles for commercial purposes not related to theprovision of the online service? We do not use any information for any otherpurpose other than the single Shareathon event that was created.Does the operator enable parents to review and have deleted the personalinformation collected from their children? YesWhat are the operator’s data retention and deletion policies for children’s personalinformation? We delete all user personal information shortly after the completionof each Shareathon fundraiser.
- I am an educator and I want students in my school to share information for
class projects using a publicly-available online social network that permits childrento participate with prior parental consent. Can I register students in lieu of havingtheir parents register them? This question assumes that your school has not enteredinto an arrangement with the social network for the provision of school-basedactivities, but rather that you intend to use a service that is more broadly-availableto children and possibly other users. The Commission has recognized the school’sability to act in the stead of parents in order to provide in-school Internetaccess. However, where the activities and the associated collection or disclosureof children’s personal information will extend beyond school-based activities, theschool should carefully consider whether it has effectively notified parents of itsintent to allow children to participate in such online activities before givingconsent on parents’ behalf.In SummaryCOPPA was designed to protect children from unscrupulous companies that mighttake advantage of information entered online. Shareathon requests very limitedinformation that is used for specific and defined purposes. We do not share anypersonal information for any other commercial purpose. We do not contactchildren for any purpose other than the specific Shareathon the child signed up for.Parents can always remove their child from the system. And, finally, data isremoved from the system in a timely basis once the Shareathon event has ended.
