How to block children under 13 to access my website and still comply with COPPA? (This is a follow-up question from How to make sure my website complies with things like COPPA?) COPPA stands for Children's Online Privacy Protection Rule. In their FAQ they say &quot;yes, you can block children under 13 from visiting your website if you choose to&quot; (assuming the website is not directed to children - and for the sake of this question, indeed it is not). Great! But later on they say that I should ask their age in a certain manner that confuses me. Quoting FTC's COPPA FAQ: G. GENERAL AUDIENCE, TEEN, AND MIXED-AUDIENCE SITES OR SERVICES 3. Can I block children under 13 from my general audience website or online service? Yes. COPPA does not require you to permit children under age 13 to participate in your general audience website or online service, and you may block children from participating if you so choose. By contrast, you may not block children from participating in a website or online service that is directed to children as defined by the Rule. See FAQ D.2 above. If you choose to block children under 13 on your general audience site or service, you should take care to design your age screen in a manner that does not encourage children to falsify their ages to gain access to your site or service. Ask age information in a neutral manner at the point at which you invite visitors to provide personal information or to create a user ID. In designing a neutral age-screening mechanism, you should consider: Making sure the data entry point allows users to enter their age accurately. An example of a neutral age-screen would be a system that allows a user freely to enter month, day, and year of birth. A site that includes a drop-down menu that only permits users to enter birth years making them 13 or older, would not be considered a neutral age-screening mechanism since children cannot enter their correct ages on that site. Avoiding encouraging children to falsify their age information, for example, by stating that visitors under 13 cannot participate or should ask their parents before participating. In addition, simply including a check box stating, “I am over 12 years old” would not be considered a neutral age-screening mechanism. In addition, consistent with long standing Commission advice, FTC staff recommends using a cookie to prevent children from back-buttoning to enter a different age. Note that if you ask participants to enter age information, and then you fail either to screen out children under age 13 or to obtain their parents’ consent to collecting these children’s personal information, you may be liable for violating COPPA. See, e.g., the FTC’s COPPA cases against Path, Inc., Playdom, Inc. and Sony BMG Music Entertainment. This is looking weird to me. So I can block children under 13, but I can't tell them that? Please re-read this part: In addition, consistent with long standing Commission advice, FTC staff recommends using a cookie to prevent children from back-buttoning to enter a different age. Note that if you ask participants to enter age information, and then you fail either to screen out children under age 13 or to obtain their parents’ consent to collecting these children’s personal information, you may be liable for violating COPPA. Their suggestion about using a cookie can be easily bypassed. For example: if a child tries to register and gets blocked for being too young, the child can use another computer and then claim to be older (this was just an example, there are thousands of ways to bypass that). Then what is the correct way to block children under 13 to access my website and still comply with COPPA? Note: I have read this question, and I think its answer might be incomplete, considering my question here.
So I can block children under 13, but I can't tell them that? You can tell them after they fail, you cannot tell them on the asking screen. Then what is the correct way to block children under 13 to access my website and still comply with COPPA? I agree with you that it is odd that they recommend using a cookie but they do!* So you have a entry page with a simple question, "Please indicate your age" and then block based on the response. That's it. Note that the rule is neutral. This means that you do not need to disguise your purpose or try to trick people into entering their correct age. *I think that what is happening here is that any parent who wants to complain to their legislator can be met with the response, "If your kid is so sneaky that they are using different computers to lie about their age what do you want us to do about it?" The fact is, this scheme keeps innocent kids from seeing stuff they shouldn't; the sneaky ones are going to find a way.
Under United States law, it is not illegal to simply make an account on a forum where criminal activity takes place. The closest thing I can think of would be misprision of felony (AKA failure to report a crime), which requires active concealment (see United States v. Johnson, 546 F.2d 1225 (5th Cir. 1977)). Simply observing evidence of criminal activity and not reporting it would not qualify. However, if that forum also contains material that is illegal to posses (such as child sexual abuse material), downloading that (even by simply viewing it using your browser) could be a crime. I would note that I am specifically not advising you whether or not doing any of the other things, like making and publishing tutorial videos on how to access such sites, is likely to get you into trouble with the law. If you want that sort of legal advice, you should contact a lawyer, as the advice is going to be very specific to the exact details.
Yes, a site may check for a cookie indicating past consent before prompting for consent to read and store cookies When people speak of the &quot;Cookie law&quot; they usually mean the ePrivacy Directive, (ePD) more formally the Privacy and Electronic Communications Directive 2002/58/EC. The full text of the directive is here First of all, being a directive and not a regulation, the ePD is not itself legally binding. Instead it instructs the legislatures of member states to implement it, which they generally have done. So the actual binding law is the law of a particular country, which could vary from the wording of the directive. However, in this case, my understanding is that the implementations do not vary significantly. An updated and revised ePrivacy Regulation (ePR) has been proposed, which would replace the ePD and complement the GDPR. But there has been dispute over the proposed terms of the ePR, and it has not yet been passed. Article 5 section (3) of the ePD reads: Member States shall ensure that the use of electronic communications networks to store information or to gain access to information stored in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user concerned is provided with clear and comprehensive information in accordance with Directive 95/46/EC, inter alia about the purposes of the processing, and is offered the right to refuse such processing by the data controller. This shall not prevent any technical storage or access for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network, or as strictly necessary in order to provide an information society service explicitly requested by the subscriber or user. Notice that this covers both writing (storing) and reading (gaining access to) cookies and other information stored on a user's device. Cookies ar one form of such locally stored information (LSI). Note that the GDPR, which replaces Directive 95/46/EC, is used to define &quot;consent&quot; in the ePD. In general, one must have consent to read or store, and consent must be sought only when the user has been given &quot;clear and comprehensive information ... about the purpose&quot; of the stored information. The relevant exception for this question is that information (including cookies) which is &quot;strictly necessary&quot; to provide a service specifically requested by the user. Here the user has requested access to the web site, and may have previously agreed to accept cookies. The site must prompt for consent if the user has not previously consented (and the site will store cookies not strictly needed), and should not if the user has. Therefore, it is strictly necessary to check for and read if present a cookie indicating that such consent has previously been granted. If such a cookie is not found, no consent has been granted. Strictly required LSI should not have a dual purpose where one purpose is not strictly needed. For example, an &quot;I accept cookies&quot; cookie should not also be used for tracking. That should be done (if at all) with a separate cookie, and only after consent is received. Note that there should be an easily found and easily used method or link on the site (preferably on each page of the site) to review the purposes of stored or accessed LSI, and to withdraw previous consent. If consent is withdrawn, the cookie indicating that consent has been granted should be erased, as should any cookies or other LSI not strictly needed to provide the services requested by the user. Keep in mind that the legal distinction is not between cookies that contain &quot;technical&quot; information and those that do not. That is not relevant. Nor is the distinction between cookies that might be used to identify a person and those that do not. The legal distinction is between cookies (or other LSI) that are strictly needed to provide the services requested by the user, and all other LSI. Strictly needed LSI does not require consent, all other LSI does. For example, a random string, used to determine the number of unique visitors, but not linked to any identifying info about the user, does not help to identify an individual user. But it is not strictly needed, so it can only be stored with consent. Data that are associated with an identifiable natural person (human being, not a firm or organization), are governed by the GDPR (where it applies). There must be a lawful basis for processing such data, which includes reading them from LSI, and storing them. Consent is one of the six possible bases for such processing, but consent need not be obtained if another lawful basis applies. When consent is the basis, it must be easily withdrawn by the user. Note that this applies to all data (PI) that is associated with a person, not just data that can readily be used to identify the person (PII). Note that other workflows are also lawful. For one example, if a site is a strictly membership site, it could prompt for a login before reading or storing any LSI, and then read previous preferences stored on the server by that user to determine whether consent for cookies has been granted. Conclusion A cookie indicating that consent to access and store cookies hs previously been given by a particular user can lawfully be read before a user is prompted for consent, under the ePD and its implementing laws.
Does Amazon prohibit a family of adults from sharing a single Amazon account? No, or at least it seems unlikely. As outlined in my answer &amp; comments on Law Meta, a domestic or family-oriented character is palpable in the clause. That weakens the notion that Amazon's intent is to preclude scenarios which are of a personal-domestic nature and short of commercial/sublicensed use. The language &quot;You are responsible for [...] restricting access to your account&quot; seems more permissive than something akin to &quot;only you are allowed to access your account&quot;. The former language is consistent with the term &quot;non-exclusive&quot;, which otherwise seems to have no relevance or purpose in the clause. Users' ability (if any) to enter multiple payment methods with different names (i.e., card holder name) could be an additional indication that the scenario you have in mind is acceptable to Amazon. It is easy for a company to implement a validation for the purpose of identifying significant discrepancies of holder names and/or to have the user confirm that all payment methods refer to one same owner. The latter approach is more conclusive for scenarios where a woman has changed names as a result of getting married or divorced. The fact (?) that Amazon declined to include that simple validation weakens the notion that the company is genuinely interested in sticking to a rule of one-person per account.
It is neither legal nor illegal, but would depend on the circumstances. For example, such use of a smart assistant might be perfectly fine if the childcare provider could demonstrate a legitimate interest for using the smart assistant, and gave reasonable notice about audio being recorded. Parental permission is likely not necessary. In practice, doing this right would be far too much effort. For example: Has the necessary information per GDPR Art 13 been provided, taking into account the EDPB guidelines on transparency? Under what legal basis are conversations sent to Amazon, an US-based provider, taking into account the Schrems II ruling? How will data subject rights be satisfied, in particular the right to access to these recordings, the right to erasure, and the right to object to further processing? Having discovered such processing of personal data that isn't necessarily kosher, a parent/guardian might start by objecting (GDPR Art 21) to further processing. This could be satisfied by powering off the Alexa devices in all rooms where the child is expected to be. The childcare should respond within one month. If no satisfactory response has been received, one option would be to lodge a complain with the supervisory authority, which would be the ICO in the UK.
You have to serve the defendant Unless and until you do, you aren’t going to court. If you can’t find the defendant, you can’t sue the defendant. Rules of service vary by jurisdiction but under the Uniform Civil Procedure Rules (UCPR) implemented in all jurisdictions in australia they are (for an individual): hand it to the defendant leave it in the presence of the defendant and explain what it is leave it with a person at the defendant's home address who appears to be over the age of 16 years and living at that address leave it at the defendant's work address, with a person who appears to be over the age of 16 years, if the defendant is a sole trader ask the Local Court to post it to the defendant either at the defendant's work address if they are a sole trader, or the defendant's residential address. So, it is really not that hard. However, if this proves too difficult, you can apply to the court for substituted service. Courts will generally allow any method where you can prove that the Statement of Claim came to the defendant’s attention. For example, service by Facebook has been acceptable.
You need a privacy notice for any website (if you're subject to GDPR). Having a PayPal button alone does not trigger such an requirement, since any website is already processing personal data such as IP addresses even if there's no third party content. But it's good that you think about issues for including third party content. As rulings such as the Fashion ID case and the more recent Google Fonts judgement have clarified, you are responsible having a suitable legal basis when you cause visitor's personal data to be disclosed to third parties. Even just embedding/loading a button or logo can cause personal data such as IP addresses to be disclosed to the recipients. You might have a legal basis if earlier, the user already opted in to payment with PayPal (could be consent per Art 6(1)(a) GDPR, or necessity for performing the contract per Art 6(1)(b)). Loading the embedded content just because the user might want to use it is probably not compliant though. For example, the common PayPal donation button is problematic. Thus, instead of linking a PayPal SDK, you might want to host the code + assets for the PayPal payment functionality on your own servers, or only load the PayPal content after the user unambiguously indicated that they want to use this content. I've discussed the PayPal donate button previously, as well as background on the Fashion ID case and click-to-consent wrappers for embedded content. What the Fashion ID case made very clear though is that you're only responsible for compliance for those data processing activity where you can actually influence the “purposes and means” of processing. You have no control over what PayPal does with the data on their servers, so they are solely responsible for that. And if the PayPal button navigates to a PayPal website, you're not responsible for what cookies PayPal sets on its own website. It is thus correct that the PayPal popup has its own cookie banner – you are not responsible for the contents of the popup. You also don't need to collect consent for cookies and similar technologies that are strictly necessary to provide a service that was explicitly requested by the user. For example, session cookies, XSRF protection cookies, and cookies containing a shopping cart are often such strictly necessary cookies. You must still be transparent about the use of such cookies, but you probably don't need a banner to announce this. So I think that you can probably go without a cookie banner, though you should probably get consent before loading PayPal content into your page, and you will likely want to be transparent about cookies as part of your privacy notice.
Summary: there's no minimum age; rather, you must use the seat in accordance with the manufacturer's instructions. Instructions for reversible seats typically do not depend on age but on the child's weight and height. Arkansas law (AR Code § 27-34-104 (2020)): (a) While operating a motor vehicle on a public road, street, or highway of this state, a driver who transports a child under fifteen (15) years of age in a passenger automobile, van, or pickup truck, other than one operated for hire, shall provide for the protection of the child by properly placing, maintaining, and securing the child in a child passenger restraint system properly secured to the vehicle and meeting applicable federal motor vehicle safety standards in effect on January 1, 1995. (b) A child who is less than six (6) years of age and who weighs less than sixty pounds (60 lbs.) shall be restrained in a child passenger safety seat properly secured to the vehicle. (c) If a child is at least six (6) years of age or at least sixty pounds (60 lbs.) in weight, a safety belt properly secured to the vehicle shall be sufficient to meet the requirements of this section. The key passage is &quot;properly placing, maintaining, and securing the child in a child passenger restraint system properly secured to the vehicle.&quot; This implies that you can put the seat in the forward-facing position only if it is designed to be used that way and then only when the manufacturer's instructions say that it's acceptable. In my experience this typically depends on the child's height and weight rather than on the age. For example, one manufacturer says of its seats [Convertible seats] in the rear-facing mode should be used for children weighing 5-40 lbs, with a height of less than 49 in. and whose head is 1 in. or more below the top of the car seat. [Convertible seats] in the forward-facing mode should be used for children weighing 22-65 lbs. and height less than 49 in. and can walk unassisted and whose top of the ears are below the top of the car seat. So if the instructions for your seat have the same criteria then you can turn it around when the child reaches 22 lbs. CDC weight data for boys shows that virtually every 21-month-old boy is heavier than this (note that the data are in kilograms and that 22 lbs is 9.979 kg). Therefore, the legal answer is that there is no minimum age; the requirement is to use the device &quot;properly.&quot; Follow the manufacturer's instructions. (Aside: the incorrect belief about the 2-year threshold could be a widespread misconception among Arkansas police. If this is so, and if they are therefore in the habit of ticketing people for having children under 2 in a forward-facing seat, then you could get a ticket. You might be able to convince the officer of the reasoning in this answer, but you might not, in which case you would have to take it to court to show that you were following the manufacturer's instructions and therefore the law. You will have to weigh the potential hassle of having to do this, including the likelihood of its happening or not, against the benefit of letting your child see the back of your head while you're driving. My guess is that you're unlikely to get a ticket for several reasons, and that your child is likely to be significantly happier facing forward, but I don't know Arkansas police and I don't know your child.) If you do not have the instructions for your seat, you should be able to find them online. Some seats are not designed to be used facing forward. If yours is such a seat, you will need to get one that is. Remember that complying with the law may seem more important because you're more likely to get pulled over by a police officer than to be in a collision. But in fact the most important consideration is safety. If you are in a collision you will want your child to have the greatest protection possible.