Is asking a website user their age the same as asking their birthdate? COPPA says you must ask a user's age in a neutral way. Most websites make you enter your birthdate to check whether you're old enough to be using it. But what if you just simply ask the user's age? That seems to be just as neutral as asking their birthdate. Legally speaking, is that the same? Assume that there are no unique sections of the site. Only 13+ users are legally allowed on any given part.
The Children's Online Privacy Protection Rule, 16 C.F.R. 312 (COPPR), which is a regulation issued by the Federal Trade Commission (FTC) under the Children's Online Privacy Protection Act, 15 U.S.C. 91 (COPPA), applies to: ... any operator of a Web site or online service directed to children [under 13: see §312.2], or any operator that has actual knowledge that it is collecting or maintaining personal information from a child ... [§312.3] Many operators simply choose to block children to avoid these obligations. The purpose of age-screening is to ensure that your website is not directed to children and that you are not knowingly collecting personal information from children. Whether your website falls into this category will depend on all the facts and circumstances. Your question about a website operator's obligation to &quot;ask a user's age in a neutral way&quot; is reflected in the FTC publication Complying with COPPA: Frequently Asked Questions, which states: If you choose to block children under 13 on your general audience site or service, you should take care to design your age screen in a manner that does not encourage children to falsify their ages to gain access to your site or service. Ask age information in a neutral manner at the point at which you invite visitors to provide personal information or to create a user ID. In designing a neutral age-screening mechanism, you should consider: Making sure the data entry point allows users to enter their age accurately. An example of a neutral age-screen would be a system that allows a user freely to enter month, day, and year of birth. A site that includes a drop-down menu that only permits users to enter birth years making them 13 or older, would not be considered a neutral age-screening mechanism since children cannot enter their correct ages on that site. Avoiding encouraging children to falsify their age information, for example, by stating that visitors under 13 cannot participate or should ask their parents before participating. In addition, simply including a check box stating, “I am over 12 years old” would not be considered a neutral age-screening mechanism. In addition, consistent with long standing Commission advice, FTC staff recommends using a cookie to prevent children from back-buttoning to enter a different age. Note that if you ask participants to enter age information, and then you fail either to screen out children under age 13 or to obtain their parents’ consent to collecting these children’s personal information, you may be liable for violating COPPA. See, e.g., the FTC’s COPPA cases against Path, Inc., Playdom, Inc. and Sony BMG Music Entertainment. None of the three cases cited in the last paragraph deal directly with the situation you have asked about, but they contain useful factual examples of how the law is actually applied, as well as a detailed legal complaint filed by the FTC which precisely sets out the legal basis for the defendants' alleged violations. For example, the FTC's case against Path, Inc. involved allegations that the operators of the Path social network had violated various federal laws, including COPPR. The case was settled on terms that Path admitted no wrongdoing but agreed to pay an $800,000 penalty. Count III of the FTC's complaint sets out the COPPR allegations. Basically, Path asked users for their date of birth but then failed to actually block users under 13 or obtain verifiable parental consent. In Path, Inc., Playdom, Inc. and Sony BMG Music Entertainment, it was clear that the defendants had actual knowledge that they were collecting information from children. These were not cases involving operators who were found to be subject to COPPR because their age-screening mechanism was not robust enough. However, it is difficult to go wrong by following the advice of the federal regulator. The FTC says that an example of a neutral age-screen is one that allows a user freely to enter month, day and year of birth, and that a screen which only allows users to specify an age of 13 or older is not neutral. Your question falls in between these two extremes. There is no rule which makes it absolutely mandatory to ask for a full date of birth. What matters is that your website is not directed to children and that you are not knowingly collecting information from children. Obviously, it's safer to err on the side of caution and take the approach recommended by the FTC. If you don't want to follow the FTC's advice, you should take other active steps to ensure that your website is not directed to children and that you are not collecting personal information from children.
IP addresses are personal data. That means you need a legal basis to process them, but not necessarily consent from the user. That IP addresses should be treated as personal data in most contexts is clear, regardless of whether you can associate the IP address with a user ID. That you make such an association affirms that both the IP address and user ID are personal data in your context though. As the answers in the questions you linked indicate, there are alternative legal bases to consent. The GDPR offers a choice of six legal bases (Art 6(1) lit a–f). In most cases, you would instead rely on a “legitimate interest” for logging. But it's not enough to claim that you have a legitimate interest. You must have a clear purpose for which such logs would be necessary, and you would then have to weigh this legitimate interest against the interests, rights, and freedoms of the affected data subjects. If such logs are necessary for security and anti-abuse purposes, your legitimate interest test is likely to prevail. However, you must limit retention of the logged data and the included information to what is actually necessary. For example, keeping user IDs in there might not be necessary. If the association of IP addresses and user IDs is not necessary for a legitimate interest, then you would indeed need consent. Discussion on why IP addresses are personal data. You see many answers and opinions that IP addresses might not be personal data. Some of these are technically correct, but most are misinformed or outdated. I know only a single well-informed person that still disagrees. For everyone else such as the EU Commission, IP addresses are clearly personal data. Under the GDPR, personal data is any information that relates to an (indirectly) identifiable natural person. In the context of log files we can assume that the entries usually “relate” to a person, namely the person making the request. The exception would be requests triggered by automated systems. The more interesting question is whether the person to which the log entry relates is identifiable. While the GDPR does provide further guidance on the concept of identification in Recital 26, it does not provide clear unambiguous criteria. Thus, there is lots of debate about what that precisely means. One approach is to sidestep that debate and and notice that the GDPR's definition of personal data explicitly notes that a person might be identified “in particular by reference to an identifier such as a name, an identification number, location data, an online identifier” (Art 4(1)). Another but otherwise unrelated part of the GDPR mentions “internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags” as examples of online identifiers (Recital 30). We can also look more deeply into Recital 26 and see that “singling out” already counts as identification. We can use the IP address to single out one person's log entries from the set of log entries, so this could be interpreted as meaning that any stable user ID renders the data personal data – and an IP address is sufficiently stable in this context. Another part of Recital 26 says that we must consider “all the means reasonably likely to be used” for identification, even if this involves additional information from third parties. This phrasing is virtually identical to the GDPR's predecessor, the EU Data Protection Directive. On the basis of that DPD, the EU's top court (ECJ/CJEU) was asked to rule on the question whether dynamic IP addresses are personal data (the Breyer case, C‑582/14, judgement from 2016-10-19). It said yes. “It did not say yes”, some people will object. And they are technically correct. When someone rents an internet connection from an ISP, the ISP will have logs that connect the user's real-world identity to the IP address they were assigned at a time. You don't have access to the ISP's logs. But, if that user violated your rights (e.g. a cyberattack or copyright infringement), then you could (depending on civil vs criminal matters) report this to the appropriate authorities or to petition the court and they would have the right to order the ISP to disclose this information. The CJEU said that if this chain (you → authorities → ISP → user identity) is grounded in law, then the IP address would be identifiable. But whether there are suitable laws to compel the ISP to disclose this data would be up to national laws, and the CJEU doesn't concern itself with that. Spoiler: such laws are pretty common. To summarize typical objections: The IP address doesn't relate to a person: Can be a valid objection, but is not typically the case for user-facing web services. The Recital 30 argument is not valid because it's about profiling, not identification, and it only says that IP addresses may be used for profiling, not that they are always identifying: Technically correct, but I think that Recital 30 merely expresses the implied understanding that of course an IP address is an online identifier and permits identification by itself. “Singling out” does not apply because SOME_REASON: Indeed, this is an ill-defined term with no case law to guide us. However, regulators such as the EDPB and their predecessor WP29 routinely use “singling out” to mean being able to distinguish one person's data from other people's data. An IP address lets us do that. The Breyer judgement is not applicable because the defendant in that case was the German state, and the state has other legal means than ordinary website operators: Nothing in that case was specific to the website operator being a state or other authority. If the website operator can contact the appropriate authority and if they have the right to order the ISP to disclose the relevant data, then the IP address is identifiable. The CJEU didn't say “yes” in Breyer, it said “if”. So I'll take that as a “no”: The CJEU concerns itself with the interpretation of EU law, not with national laws. Specifically in the Breyer case, lower courts confirmed that German law has the necessary means. In other EU member states, further checks would be necessary but it would surprise me if there wouldn't be equivalent subpoena powers. If the ISP doesn't have the data, then the IP addresses are anonymous: Indeed, the CJEU scenario collapses if there is no additional data to be linked with the IP address. However: The CJEU used this scenario as an example to show that IP addresses can be identifiable. If that particular scenario fails, there could be other scenarios that still allow identification. The question of whether IP addresses are identifiable had of course been the subject of wider debate at the time. That the GDPR explicitly mentions IP addresses can be seen as a reaction to this debate. Thus, in a sense, the Breyer case is moot. It is still useful as an explanation of how broad “reasonably likely means” must be interpreted.
There are several policy goals surrounding the age of criminal responsibility. One aspect is that by the age of criminal responsibility people have a sufficient awareness of societal norms and understanding of the wrongfulness of their conduct that they be eligible for criminal charges. Another aspect is that for people under the age of criminal responsibility, they may not respond to criminal charges and punishment in the same way as older people. That is, the criminal system may not be the most effective means of correction and rehabilitation of such young offenders. There is no bright line that accurately captures these factors, and thus many jurisdictions have more than one step in transitioning from the incapable child to the fully capable adult. For example, in the US and Canada, juveniles/youth over the age of criminal consent but not yet 18 years old are generally not treated the same as adults. The policy goals behind the age of consent relate to understanding of the consequences of sex, vulnerability to people in positions of power or influence, and protection of society's norms of purity. There is no reason why these different policy goals would result in the same age threshold.
There is no law governing the 'number' of the president. Common sense suggests that a person can't be 45th and 46th; there must be someone in between having the presidency and they will become the 46th president. In the extremely unlikely scenario that a foreign power occupies the United States this year, eliminates the office of President, and a few years later the US is liberated and Donald Trump is re-elected, I guess people could name him the 45th and 46th President, but it makes no sense to speculate about this.
According to the US Army's web site, which gives an overview of the entry requirements, the minimum age is 17 and it seems that only felony convictions and juvenile offences are a bar to recruitment - however the Army Recruiter should be able to confirm whether or not dropped charges fall in to these categories or exclude a candidate for any other reason. Section 1 &quot;meeting with a recruiter&quot; section includes this: Your local recruiter will conduct a prescreening to see if you qualify for enlistment. At the recruiting station, he or she will ask you about your: Education level Criminal history Age Marital/dependency status Physical condition And one of the &quot;see if you pre-qualify&quot; quick-quiz questions asks if one's age is between 17 and 34 Section 2, &quot;required documents&quot;, includes this: The U.S. Army makes every attempt to assess the moral quality of potential recruits. To this end, a thorough background check is done on all prospects. It is imperative that you disclose all legal offenses Felony convictions will result in candidates being exclude Drug and domestic violence charges will exclude candidates (Some minor drug offenses may be waived on a case-by-case basis) Juvenile offenses will also exclude you Certain Army jobs requiring higher security clearance may necessitate more thorough investigations
Discrimination is legal, so long as there is not based on a protected category or class(e.g. race, sex, religion). Age is generally not a protected category. Some states do treat age as a protected category, but: 1) It is generally only in employment, so, for example charging someone differing amounts based on their age is legal (e.g. senior discounts, kids under X are free, etc.). 2) It is generally only protecting higher ages (i.e. discriminating against someone in employment because their age is higher than what you'd like would be illegal, but discriminating against someone because their age is lower than you'd like is not; and in some cases the later is mandatory).
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
The comments have basically covered this, but: It's a slightly weird parallel structure ("who shall not be at least 25, and been a citizen for 7 years, and who shall not be a resident"). The Constitution is not written in fluid 21st-century English. But the obviously correct way to parse the sentence is that no one can be a representative who isn't a 25-year-old or older who's been a citizen for at least 7 years; furthermore, no one can be a representative who wasn't a resident of the state they represent when they were elected. With some parts of the Constitution (like the Second Amendment), the drafting results in actual disputes about the intended meaning. With other parts (like here), only one reading makes any sense. It's the same with the requirements to be President. The Constitution says "No Person except a natural born Citizen, or a Citizen of the United States, at the time of the Adoption of this Constitution, shall be eligible to the Office of President," which could be read as "you're not eligible unless, when the Constitution was adopted, you were either a citizen of the US or a natural-born citizen." But that's a silly reading, so "at the time of the Adoption" is read as only applying to "a Citizen of the United States:" natural-born citizens are eligible period, and people who were born before the US was a thing but were citizens by the time the Constitution was adopted were grandfathered in.