FROM: U.S. FEDERAL TRADE COMMISSION
The Federal Trade Commission has approved a new method for companies to get parents’ consent for their children to access online services covered by the Children’s Online Privacy Protection Act (COPPA) Rule.
Based on an application submitted by Imperium, Inc., the Commission has approved the use of knowledge-based authentication as a method to verify that the person providing consent for a child to use an online service is in fact the child’s parent.
Under the COPPA Rule, online sites and services directed at children must obtain permission from a child’s parents before collecting personal information from that child. The rule lays out a number of acceptable methods for gaining parental consent, but also includes a provision allowing interested parties to submit new verifiable parental consent methods to the Commission for approval.
Knowledge-based identification is a way to verify the identity of a user by asking a series of challenge questions, typically that rely on so-called “out-of-wallet” information; that is, information that cannot be determined by looking at an individual’s wallet and are difficult for someone other than the individual to answer. This authentication method has been used by financial institutions and credit bureaus for a number of years, and has been acknowledged by the Commission and other government agencies as effective for that purpose.
The Commission’s letter to Imperium approves knowledge-based authentication as an acceptable method of obtaining verifiable parental consent, as long as the specific process uses dynamic, multiple-choice questions with enough options to ensure that the chances of a child guessing the correct answers is low and the questions used are of sufficient difficulty that it would be difficult for a child in the household to figure out the answers.
The Commission vote to issue the letter and accept knowledge-based authentication as an acceptable verifiable parental consent method was 4-0.
The Federal Trade Commission works for consumers to prevent fraudulent, deceptive, and unfair business practices and to provide information to help spot, stop, and avoid them. To file a complaint in English or Spanish, visit the FTC’s online Complaint Assistant or call 1-877-FTC-HELP (1-877-382-4357). The FTC enters complaints into Consumer Sentinel, a secure, online database available to more than 2,000 civil and criminal law enforcement agencies in the U.S. and abroad. The FTC’s website provides free information on a variety of consumer topics. Like the FTC on Facebook, follow us on Twitter, and subscribe to press releases for the latest FTC news and resources.
