What law causes Web sites to prohibit EU users under 16 years old? Many Web sites, including Stack Exchange, do not allow users under 16 years old from the European Union. This includes sites that do not have (or at least are not intended to have) content considered inappropriate for children. American sites often do this at age 13 because it is so difficult to comply with COPPA; what EU law causes this?
It's probably due to GDPR. You will see that around 2018-05-25 when GDPR came into force, many US-based websites changed their terms of service to increase the age requirement from 13 (age below which the U.S. COPPA law applies) to 16 for European users. For example, here are Stack Exchange's terms of service from 2018-05-02, mentioning 13 years, and here is the version one day later mentioning 16 years. The GPDR allows companies to process personal data under a variety of legal bases, such as “legitimate interest”, “necessary for performing a contract”, or “consent”. But children are not able to give consent in this context. If a website wants consent from a child for some data processing, Art 8 GDPR requires the service to make “reasonable efforts” to check with the parents first. This reasonable effort is more effort than just banning children from using the services. The GDPR itself does not define exactly when someone is a child for these purposes – it lets individual EU member states define the exact age limit, which may be anything between 13 and 16 years. Thus, websites that definitely do not want to have to comply with Art 8 GDPR take the upper bound of that limit and mention in their terms of service that the service is only intended for persons aged 16 or older. The text of Art 8 GDPR is: (1) Where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child, the processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years. (2) The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology. (3) Paragraph 1 shall not affect the general contract law of Member States such as the rules on the validity, formation or effect of a contract in relation to a child.
In the U.S. Those stories could constitute &quot;obscenity,&quot; in which case they could violate all sorts of federal and state laws. I was surprised to discover on this DoJ page: 18 U.S.C. § 1465 and § 1466: It is illegal to sell and distribute obscene material on the Internet. Convicted offenders face fines and up to 5 years in prison. It is illegal for an individual to knowingly use interactive computer services to display obscenity in a manner that makes it available to a minor less than 18 years of age (See 47 U.S.C. § 223(d) –Communications Decency Act of 1996, as amended by the PROTECT Act of 2003). It is also illegal to knowingly make a commercial communication via the Internet that includes obscenity and is available to any minor less than 17 years of age (See 47 U.S.C. § 231 –Child Online Protection Act of 1998). Under some state laws merely authoring or possessing obscene material is a felony. However, if the material is not obscene then it is actually protected by the first amendment. In fact many public schools (at least when I was growing up) required us to read &quot;literature&quot; (e.g., The Color Purple) that included descriptions of child rape and sexual abuse. Descriptions of purportedly actual sexual abuse of minors are also common in the testimony and published biographies of abuse victims. In the U.K. Such obscene stories are also illegal in the U.K. The relevant law is the Obscene Publications Act 1959. The Crown Prosecution Service provides information on the specific application of that and related laws.
Disney's help page on this says I don’t want to provide my birthdate or gender. What can I do? Providing a birthdate is required for all Disney+ accounts/profiles while a gender is required for all accounts/profiles over the age of 13. Note that for gender submission, you may elect “Prefer not to say.” If you do not wish to provide your birthdate or gender, you may cancel your account by visiting your Account page or by contacting Disney+ Support. It's reasonable to provide proof of age: COPPA in the US requires it to protect those under 13. And you don't have to give them your gender.
There are not enough facts to draw a conclusion First, it’s not clear that the document you signed amounts to a contract. For example, what consideration did the school give you in return for the permission you gave them? Providing you with an education doesn’t count - they were legally obliged to do that already. If it is a contract then whether and how it can be revoked would depend on the terms of that contract witch I’m guessing you don’t have a copy of. Notwithstanding, as a minor, you have the right to void the contract until a reasonable time after you turn 18. Even if it is now many years since that happened, it might be reasonable since you only just discovered the website. If it isn’t a contract, then it would be revocable at any time. Practicalities Make a fuss and they may take the photos down even if they are not obliged to. They presumably have plenty of photos of kids who aren’t you and aren’t complaining and if you make it so it’s easier to change the website than to deal with you, thy’ll change the website. I suspect their inertia is because they once paid a web developer to create the site, it has never since been updated, they don’t know how to do it, and they don’t want to have to pay someone to find out. Otherwise, why would they have photos of ex-students rather than current students? If so, an offer by you to cover the costs, might solve your problem.
Each directives page on eur-lex has a "national transposition" page. For example, directive 2009/65/EC, concerning UCITS, is available at https://eur-lex.europa.eu/legal-content/EN/ALL/?uri=celex:32009L0065. There is a navigation box at the top left with several relevant pages: Text Document information Procedure National transposition Summary of legislation (Before the recent site redesign, these were shown as tabs across the top of the page, so for the lack of a better term, I will call these "tabs.") The Document information tab shows, among other metadata, relationships with other EU acts. One useful section on this page is the All consolidated versions section, which is a set of links to consolidated versions of the document, indicated by date. The answer to your question is the National transposition tab, which shows "National transposition measures communicated by the Member States." It is worth noting the disclaimer: The member states bear sole responsibility for all information on this site provided by them on the transposition of EU law into national law. This does not, however, prejudice the results of the verification by the Commission of the completeness and correctness of the transposition of EU law into national law as formally notified to it by the member states. The collection National transposition measures is updated weekly. The list of national acts is in the form of links, which lead to pages that seem designed to present the text of the national legislation, but in the examples I have checked say nothing more than "Text is not available." Perhaps there are some instances, or will be in the future, where these contain links to national legal information sites. As it is, there is enough information to enable one to search the national sites to find the relevant legislation.
However, if a website is based in the US and the terms of service say that the law governing the terms is US law, how can GDPR have any affect? It is unlikely that the EU will be able to enforce financial penalties against a company with no presence in the EU. But they could for example block your website in the EU, depriving you of your EU user base. The actual measures that they could or would take against such a company are still unclear, since the GDPR is quite new, and there has been no action under the GDPR against foreign companies. I'm not a lawyer, but I've signed many contracts in my life and nearly all of them have some form of "governing law" clause. The governing law clause in a contract identifies the law that will be used to interpret the contract and to resolve any disputes arising from the contract. The law identified in the clause does not become the sole law governing every aspect of the relationship between the parties, however. For example, a business in New Jersey could have a contract with a client in New York with a clause specifying New Jersey law as the governing law of the contract. But that does not mean that New York's consumer protection law doesn't apply to the transaction.
It may depend on what offences are suspected of being committed. One example is: In the united-states under 18 U.S. Code § 2258A an Electronic Service Provider (ESP) is required to report apparent violations of sections: 2251 [Sexual exploitation of children] 2251A [Selling or buying of children] 2252 [material involving the sexual exploitation of minors] 2252A [material constituting or containing child pornography] 2252B [Misleading domain names with intent] 2260 [sexually explicit depictions of a minor etc] The report is made to the National Center for Missing &amp; Exploited Children (NCMEC) who in turn forward the information to the relevant domestic or foreign law enforcement agency. The ESP is protected from commiting distribution or related offences when making the report by virtue of subsection (g)(4): Permitted disclosure by a provider.— A provider that submits a report under subsection (a)(1) may disclose by mail, electronic transmission, or other reasonable means, information, including visual depictions contained in the report, in a manner consistent with permitted disclosures under paragraphs (3) through (8) of section 2702(b) only to a law enforcement agency described in subparagraph (A), (B), or (C) of paragraph (3), to NCMEC, or as necessary to respond to legal process.
Yes, you could do this be means of the EULA, provided you are not in the EU yourself. You only have to comply with the GDPR if you are offering a product or service to people that are in the EU. If you are making it clear that whatever you offer is not available to Europeans, you make your site exempt from the GDPR.