To what degree do I have to comply to COPPA in this scenario? The Children's Online Privacy Protection Act (COPPA) is designed to restrict sites collecting information about children under the age of 13 years of age. If I am operating a general purpose web service that has, in its End User License Agreement (EULA) or Terms and Conditions/Terms of Use a clause that prohibits children under the age of 13 from registering on the site, am I still obligated to take action if they disregard this requirement?
COPPA is filled with references to "websites directed towards children or with actual knowledge the data was collected from a child." Actual knowledge means you actually did know; it's OK if you honestly and unreasonably thought the child was over 13, as that means you don't have actual knowledge. To quote the FTC (emphasis added): COPPA covers operators of general audience websites or online services only where such operators have actual knowledge that a child under age 13 is the person providing personal information. The Rule does not require operators to ask the age of visitors. However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate. In some circumstances, this may mean that children are able to register on a site or service in violation of the operator’s Terms of Service. If, however, the operator later determines that a particular user is a child under age 13, COPPA’s notice and parental consent requirements will be triggered.
What is emancipation of a minor? As I understand it, in some states in the US, a minor (i.e. younger than 18) who is at least 16 years old, can petition the state for emancipation; i.e. legal separation from their parents, and allowed to enter the world as a legal adult, despite being younger than 18. However, in order to be granted this, the minor must prove that they are capable of supporting themselves financially, that they have somewhere to live, and a few other things. This is true in some places, but not others. There are two different concepts for emancipation under U.S. law, and most states follow one or the other. One concept is that emancipation is a factual reality that exists when a minor is self-supporting or supported by a spouse or significant other, and not living in the household of a parent. In states that follow this concept, such as Colorado, a court ruling that a minor is emancipated is simply a finding of fact about what is, rather than a grant of permission. Another concept is that a minor is, as a matter of law, not emancipated until a court grants minor permission to deviate from the status implied by their age. My understanding that this is the concept used in California. In these jurisdictions, emancipation is granted only after an good faith attempt to give notice to the parents and a hearing, and involves an assessment of the capacity of the minor to be self-supporting without parental assistance and involvement. The question is focused on this concept, but it is not the only one and it is probably a close call as to which approach is the majority rule in U.S. states. Even in &quot;permission&quot; states, however, entering military service or marriage usually results in emancipation as a matter of law without any formal court proceeding. Common fact patterns There are certainly cases in which the fact that a minor is married or living in the household of a significant other as a stay at home parent would establish emancipation. Another fairly common fact pattern would be a employee whose employer also provides housing. Another fairly common fact pattern is a situation in which the whereabouts of the minor's parents are unknown and the minor has, somehow, been managing. Sometimes you see this when a minor's parents die and the minor goes on in an isolated wilderness area, for example. Adoption is indeed not an option Adoption is not possible without a termination of the rights of the parents (or at least one of them in the case of a stepparent adoption). The legal guardianship option The preferred arrangement when living basically as a child in a supportive adult's household would usually be a guardianship, to the detriment of the parent's role in most decision-making for the minor, rather than emancipation. Here are some quotes from a recent case from Colorado (In re Interest of A.D., 2023 COA 6 (January 19, 2023)), with that fact pattern: ¶ 2 L.D. is the sole living parent of A.D., one of her three children. A.D. was sixteen at the time of the guardianship proceeding. Although L.D. and A.D. once shared a healthy relationship, it deteriorated dramatically during the summer and fall of 2021. This deterioration gave rise to Petitioners’ request for — and the district court’s grant of — an unlimited guardianship over A.D. We turn to that history now. ¶ 3 In June 2021, A.D.’s car was vandalized while parked in front of the family home. A.D. and his mother had a heated argument about why it happened and who was responsible for cleaning it. Upset by this conversation, A.D. went to stay at his girlfriend’s house. Although he soon returned home, A.D. ran away from home five more times following disagreements with L.D. ¶ 4 In early July 2021, L.D. gave A.D. an ultimatum: he could (1) go to military school, (2) attend therapeutic boarding school, or (3) abide by her house rules. A.D. ran away again that night, but this 2 time he spent over a month away from home, staying with his girlfriend, couch surfing at friends’ homes, or sleeping in public parks. ¶ 5 On August 7, 2021, A.D. was taken to the emergency room after appearing to overdose while partying with friends at a park. The hospital made a mandatory report to the Department of Human Services (DHS). Once A.D. was stable, L.D. and V.T. (L.D.’s longtime colleague and family friend) met with a DHS representative to discuss next steps. L.D. agreed that, given the hostility between A.D. and herself, and between A.D. and his two siblings (who both lived with L.D.), it was in his best interest to stay with Petitioners. ¶ 6 On September 8, 2021, A.D. drove Petitioners’ car to L.D.’s house for his first night back since early July. When he arrived, L.D. became extremely upset that he had driven there. In her mind, A.D.’s operation of a car — and Petitioners’ facilitation of it — violated their agreement that he not drive until certain conditions were met. The next morning, without notice to Petitioners or her son, L.D. called the Division of Motor Vehicles (DMV) and withdrew her permission for A.D.’s driver’s license. The DMV revoked his license the next day. ¶ 7 A.D. became enraged when he learned that his mother had revoked her consent and subsequently sent a series of angry texts to her. L.D. then blocked A.D.’s number, thus preventing A.D.’s calls or texts from coming through to L.D.’s phone (though texts came through on her computer). ¶ 8 On September 24, 2021, DHS facilitated an “adults only” meeting with L.D., Petitioners, and DHS representatives. That meeting resulted in three shared priorities: (1) Petitioners were to provide regular updates about A.D. to L.D., who would, in turn, communicate with Petitioners before making decisions affecting A.D.; (2) A.D.’s license would be reauthorized within thirty days once to-be-defined conditions were met; and (3) A.D. would be allowed to be on the high school wrestling team, which all parties agreed was good for him. ¶ 9 Over the next month, Petitioners regularly emailed L.D. updates on A.D. L.D. provided few, if any, responses to these updates. Petitioners also sent L.D. a proposed plan for A.D. to get his license back, but L.D. did not respond. ¶ 10 On October 20, 2021, Petitioners filed their petition for appointment as A.D.’s guardians. L.D. objected to the petition, sought dismissal of the action, and requested attorney fees. ¶ 11 On November 8, 2021, Petitioners requested that the court appoint a guardian ad litem (GAL) to represent A.D.’s interests. Over L.D.’s objection, the court appointed a GAL pursuant to section 15-14-115, C.R.S. 2022, after concluding that, owing to their disagreement over the guardianship, the parties could not represent A.D.’s best interest in the guardianship proceedings. The GAL represented A.D.’s best interest throughout the litigation, and the court also instructed the GAL to provide a report about whether L.D. was “unable to exercise her parental rights.” ¶ 12 On November 14, 2021, before Petitioners filed their reply, L.D. — without consulting Petitioners or A.D. — revoked her permission for A.D. to wrestle the day before the first day of practice. Why she took this sudden action is unclear: L.D. testified it was because A.D. was not maintaining passing grades, while another witness testified that she wanted “leverage” over him to participate in family therapy. Regardless, A.D. was devastated by the timing and nature of this action. ¶ 13 While these motions were pending, Petitioners continued to care for A.D. Petitioners asked L.D. for permission to talk to A.D.’s teachers, coaches, and doctors about how to better care for him. Yet from August to early December 2021, L.D. refused to grant Petitioners permission to engage with these individuals. She ignored or outright refused to allow such communications until December 8, 2021, when, after repeated requests from a DHS representative, she allowed Petitioners to attend — but not participate in — a meeting with A.D.’s teachers. ¶ 14 L.D. also resisted Petitioners’ requests for financial support for A.D.’s care. To her credit, L.D. provided A.D. with $25 per week for groceries. These funds came from A.D.’s $1,800 monthly survivorship benefit, which was established following the death of A.D.’s father when A.D. was three. Petitioners knew the benefit existed and requested more financial support. L.D. did not respond to these requests. ¶ 15 Except for the text exchange between L.D. and A.D. following the revocation of L.D.’s consent for A.D.’s license, L.D. and A.D. never communicated directly. Instead, all such communications went through Petitioners or DHS. ¶ 16 Consistent with section 15-14-205(1), C.R.S. 2022, the district court conducted a hearing on Petitioners’ guardianship motion. The hearing spanned two days, with both sides calling numerous witnesses. ¶ 17 In a written order, the court granted Petitioners an unlimited guardianship over A.D. In so doing, the court concluded that Petitioners had proved by clear and convincing evidence that L.D. was, consistent with section 15-14-204(2)(c), “unwilling or unable” to care for A.D. and that the guardianship was in A.D.’s best interest notwithstanding his mother’s opposition to it. The linked appellate court decision then goes on to conduct legal analysis and affirms the trial court's ruling as correct. The official syllabus of the case summarizes that part of the opinion as follows: A division of the court of appeals reviews the guardianship appointment for a minor under section 15-14-204(2)(c), C.R.S. 2022. In so doing, the division adopts the analytical framework outlined in In re Parental Responsibilities Concerning B.J., 242 P.3d 1128 (Colo. 2010). Applying that framework to section 15-14- 204(2)(c), the division concludes that the moving party must prove, by clear and convincing evidence, that the parent is (1) “unable or unwilling” to exercise their parental rights, and (2) the guardianship is in the best interest of the minor notwithstanding the parent(s)’ opposition to the guardianship. Moreover, in entering such an order, the court must articulate the “special factors” it relies upon to justify this interference with parental rights. See Troxel v. Granville, 530 U.S. 57 (2000). Utilizing that framework here, the division concludes that the court did not err in appointing a guardian for the minor.
There was no actual child who was caused to view the material, so there was no offense under that provision. By contrast, inciting a child under 13 to engage in sexual activity is an inchoate offense, so it is not necessary for any harm to an actual victim to have occurred. Note that the relevant section of the Sexual Offenses Act 2003 concerns "causing or inciting," and that the charge was "inciting." The section concerning watching a sexual act, by contrast, only inludes "causing."
No, you're not required to sign any contracts. But since you're offering a service, you do have to manage some compliance tasks. You are a data controller under the UK GDPR, regardless of whether you have a company. This brings with it various compliance requirements. For example, you MUST post a privacy notice in accordance with Art 13 GDPR that explains how you process user's information. You must sign data processing agreements with your data processors, such as your server providers. And you should reconsider transfers of data to the US, since such transfers are illegal or at least quite questionable in the wake of the 2020 Schrems II ruling. You now have prospective users that are asking you for an Art 28 data processing agreement (DPA). These are likely other organizations that are data controllers of their own. For them to use your browser extension, they either need to find a legal basis that allows them to share their user's/employee's data with you (controller to controller transfer), or they need you to act as their data processor (controller to processor transfer). The third alternative is not to use your plugin at all. Of these, a C2P arrangement is most convenient for these other orgs, but involves a bit of paperwork to set up first. If you want to act as their processor, this doesn't mean you'd have to create a company (though a corporation might be very desirable as a liability shield). Being a processor means that you're contractually bound to only use the personal data as instructed by the controller, and not for your own purposes. This restricts what you can do, and has some special compliance requirements. For example, you cannot engage new subprocessors without your controller's approval. However, processor status can also be convenient for you because you're not responsible for interacting with the controller's data subjects, e.g. you're not responsible for handling their data subject access requests. Note that it's possible to simultaneously be a controller for some users, and a processor for others. E.g. Google Docs is offered directly to users as a B2C product so that Google is a controller, but also as a B2B product as Google Workspace, where Google acts as a data processor. Personally, I'd rather not sign any contracts unless I'm doing it as a business, and adequately compensated for providing this service. GDPR is only one compliance aspect out of many, making it unwise to offer a SaaS product as a hobby. For example, copying other people's web content has copyright implications… A potential alternative for some of the organizations asking you might be to make it possible for them to self-host your backend, so that they are not required to rely on you as a data processor. If you have no plans to commercialize your software, making it Open Source could be a solution. But you're in no way required to do that if you don't want to.
What you're asking about is extraterritorial jurisdiction, and it will depend on the country and crime(s) involved. As an example, under Australian law, it is a crime to engage in sexual activities with minors barring specific exemptions, which are not relevant to this example. There are countries where the age of majority is less than that in Australia. If you were to travel to this country, you are not necessarily committing a crime there. However, Australia's sex tourism laws make it a crime to do this anywhere in the world. This is enacted (I believe) under the foreign affairs power of the Commonwealth Government. It will largely depend on the legal system of your country, as to whether laws have extraterritorial effect. In general, however, laws do not have extraterritorial effect unless explicitly stated.
Is this limitation enforceable? Sure it is; you agree to a TOS or EULA with the company to use the API, and that's a legally binding contract. If the contract stipulates limits to caching, that's enforceable in civil court by lawsuit (possibly criminal court, which will depend on jurisdiction). What if the end-user is the one caching the data on their end? If your end users might be caching, that's something you may need to outline in your own TOS/EULA to adhere to the API's stipulations. And, the API may not allow you to serve API data to your own users; read it and see. the information provided by the API is not proprietary,... That doesn't matter; you're using their API and service. If you don't like that, you need to write your own API or develop your own queries for the information. I'm designing a web application that will make use of a (non-free) third-party API. If that App is going to be distributed and used by others, talk to a lawyer about the API and have them write a TOS/EULA for your App; you run the risk of significant legal liability with a publicly distributed App that uses someone else's API, paid or free.
One way in which it holds legal water is that if you use the website in violation of the terms, then you may forfeit your right to take civil action against the company. Analogous language especially regarding the age of the user may protect the site against actions by third party governmental entities (COPPA-like laws), though nothing patently obvious springs to mind (insofar as this deals with firearms and there is also an age 21 restriction both on the web site and in terms of US firearms law, this is not a totally crazy idea). The citation of 18 USC 1030 non-probatively points to an issue which may be disposed of by SCOTUS in US v. van Buren, that knowingly violating the terms of service is a crime (a proposition rejected by lower courts, see US v. Valle). Facebook v. Power Ventures in particular clarifies how &quot;being put on notice&quot; may make such unauthorized access indeed &quot;unauthorized access&quot; in the statutorily-relevant sense. This does not prevent a legally-authorized law enforcement investigation, pursuant to para (f), but if the &quot;violation of TOS = unauthorized access&quot; theory is upheld, it limits how LEOs can legally access the website (and the limitations extend past LEOs). It is a separate and potentially interesting question whether there actually are any legal limits on the investigative powers of the government – if any law enforcement officer has the liberty to investigate anyone they want, with no supervision or requirement of justification, then this would be a rather gaping loophole in their legal strategy. Web pages involve massive copying of copyright-protected data, and the function of terms of use is in part to conditionally grant access to that copyright-protected content. When a person copies protected material from someone's web page having been explicitly denied permission to copy, they run the risk of an infringement lawsuit.
It is neither legal nor illegal, but would depend on the circumstances. For example, such use of a smart assistant might be perfectly fine if the childcare provider could demonstrate a legitimate interest for using the smart assistant, and gave reasonable notice about audio being recorded. Parental permission is likely not necessary. In practice, doing this right would be far too much effort. For example: Has the necessary information per GDPR Art 13 been provided, taking into account the EDPB guidelines on transparency? Under what legal basis are conversations sent to Amazon, an US-based provider, taking into account the Schrems II ruling? How will data subject rights be satisfied, in particular the right to access to these recordings, the right to erasure, and the right to object to further processing? Having discovered such processing of personal data that isn't necessarily kosher, a parent/guardian might start by objecting (GDPR Art 21) to further processing. This could be satisfied by powering off the Alexa devices in all rooms where the child is expected to be. The childcare should respond within one month. If no satisfactory response has been received, one option would be to lodge a complain with the supervisory authority, which would be the ICO in the UK.