1.1 What is consent?

Consent essentially consists of granting permission. Under the law, for consent to be valid or meaningful, it must result from an informed decision based on the person’s full understanding of why their consent is being requested.

The ability of children to provide meaningful consent depends greatly on their level of cognitive and emotional development. It can be unrealistic to expect a child to understand the complexities and potential risks associated with certain online practices. Accordingly, in some cases it may be preferable to obtain valid consent through an authorized person like a parent or legal guardian.

1.2 Types of consent and ways of obtaining it

Consent falls into two main categories:

• Express (explicit): the user grants consent explicitly through a specific action (e.g. an electronic signature) that indicates their understanding of what they are consenting to.
• Implicit (tacit): when consent may be reasonably inferred from the circumstances of a particular situation, relationship or transaction. For example, consent can be implied from an existing business relationship with the user.

There are various mechanisms for obtaining consent, based on the situation:

• Positive (opt-in): a specific action on the part of the user to express positive agreement to the identified purpose (e.g. “If you agree to let your child participate in our contest, check this box.”)
• Negative or passive (opt-out): a specific action on the part of the user to express non-agreement to the identified purpose (e.g. “Your child would like to enter our contest. If you do not consent to this, check the box.”)

1.3 What is parental consent?

Parental consent is when the parent or legal guardian provides the producer or operator with the authorization needed to allow the child to engage in certain activities.

When is it required? While regulations can vary between countries, parental consent is rarely required by law. However, the law often encourages producers to seek parental consent for anything involving the collection of personal information.

1.4 What is “verifiable” parental consent?

Verifiable parental consent aims to have the producer adopt measures that are reasonably calculated to ensure that the person providing the consent is indeed the child’s parent. One such measure is to have parents call a telephone number staffed by trained personnel.

1.5 What is direct notice to parents?

Direct notice is when the producer contacts the parent, normally through the email address provided by the child. Direct notices are used for various reasons, but generally to seek parental consent or to inform parents of changes to practices to which parents have previously consented.

1.6 The right to revoke consent

Parents have the right to revoke their consent. Doing so prevents the future collection and use of personal information and in some cases, allows previously collected information to be deleted.

In the digital space, the notion of consent is most commonly linked to personal information handling practices and online transactions. For more information on the regulatory framework governing online consent, consult backgrounders Collection of personal information and Online transactions.

The United States is the sole country among those presently studied with specific legislation (COPPA) based on obtaining verifiable parental consent to collect personal information about children under 13 years of age.

UNITED STATES

Children’s Online Privacy Protection Act (COPPA)

COPPA is a federal law that protects the privacy of children under 13 years of age. Based on verifiable parental consent, its goal is to enable parents to supervise and intervene in the online collection of personal information about their children. It applies to products that collect personal information from U.S. children under 13 years of age, including collection by companies based outside the U.S.

Before collecting any personal information about a child, you must send a direct notice to the parents. The direct notice must:

1. State that you are contacting them for the purpose of obtaining their consent
2. State that you wish to collect personal information about their child
3. State that their consent is required for the collection, use and disclosure of this information
4. Specify the type of information you wish to collect and how it will be shared
5. Include a hyperlink to your privacy policy
6. Indicate the means by which the parent can provide their consent
7. Indicate your time frame for deleting their online contact information from your records should you fail to secure their consent

Since children are quick to learn how to bypass typical parental consent mechanisms, the law requires you to take “reasonable measures” to ensure that it is the parents you have contacted. COPPA sets forth a number of non-exhaustive options for obtaining verifiable parental consent — for example, mailing parents a consent form to be signed and returned.

Should you make changes to the personal information handling practices for which consent has previously been secured, you must notify the parent with a direct notice and again request their verifiable parental consent before resuming collection.

For more information on verifiable parental consent and direct notice under COPPA

App stores incorporate parental consent systems but disclaim any responsibility regarding compliance with different privacy policies. Because of this, you must ensure that your product complies with the regulations in effect wherever it is available.