COMPLIANCE BRIEF

Secure Children’s Data and Comply With COPPA Regulations

How Kiteworks Supports Organizations in Meeting Stringent Requirements for Protecting Children’s Online Privacy

The Children’s Online Privacy Protection Act (COPPA) is a federal law enforced by the Federal Trade Commission (FTC) that regulates the online collection of personal information from children under 13 years old. COPPA applies to website operators, online services, and mobile apps that are directed at children or knowingly collect personal data from children. Under COPPA, covered operators must post a privacy policy explaining their information collection practices. They must also obtain verifiable parental consent prior to collecting, using, or sharing a child’s personal data. Exceptions for parental consent apply in limited cases, such as to respond to law enforcement or protect a child’s safety. Operators must give parents the ability to review their child’s personal information and request its deletion. They must also take reasonable steps to keep collected data secure and confidential. COPPA strictly limits the retention of children’s personal data—operators can only keep it as long as necessary to fulfill the purpose it was collected for. Websites and apps that use persistent identifiers like cookies, geolocation, or mobile device IDs to track children over time are subject to additional COPPA requirements. Violations can incur civil penalties of over $43,000 per violation. Overall, COPPA aims to provide special privacy protections for children online who may not fully understand data collection risks. By requiring parental notice and consent, it puts control in parents’ hands over their children’s data. Kiteworks provides the technical safeguards and evidence trails mandated to protect children’s data and demonstrate adherence to COPPA regulations. Here’s how:

Solution Highlights

  • Consent web forms
  • Robust audit logs
  • Hardened virtual appliance
  • Least-privilege defaults
  • Strong encryption
  • Secure data deletion

Establish Procedures to Protect Confidentiality, Security, and Integrity of Collected PII

The Children’s Online Privacy Protection Act makes it illegal for websites, apps, and services directed at children to collect personal data from children under 13 without verifiable parental consent. Operators must establish reasonable procedures to protect confidentiality, security, and integrity of children’s personal data. They must release information only to service providers capable of properly safeguarding it. COPPA mandates strict data protections and parental controls on collecting children’s personal information online. Kiteworks provides robust capabilities to help organizations comply with COPPA regulations around protecting children’s personal information. Features like audit logs, least-privilege access, encryption, and its hardened appliance work together to safeguard confidentiality, security, and integrity of sensitive data as mandated by COPPA.

Comprehensive audit logs capture detailed visibility into all user activity, including who accessed what data, when, and from where. These immutable logs support detecting and investigating any unauthorized access to children’s personal information. They also provide the activity records needed to demonstrate COPPA compliance. Least-privilege access control ensures users only get default access to the minimal data required for their role. This prevents unauthorized viewing of children’s private information. Granular permissions can be tailored at the role level for precise control over data access. End-to-end AES-256-bit encryption protects children’s personal data both at rest and in transit. Even if intercepted, encrypted data remains inaccessible without the cryptographic key. This adds an extra layer of protection beyond access controls. The Kiteworks hardened virtual appliance provides a secure framework fortifying the platform against external threats. Its firewall, encryption, and other defenses create an environment purpose-built to safeguard sensitive data like children’s information.

Together, Kiteworks’ robust access controls, unfalsifiable audit logs, powerful encryption, and hardened virtual appliance enable organizations to implement the stringent confidentiality, integrity, and security measures required for COPPA compliance.

Gain Consent to Collect PII Utilizing Web Forms

COPPA requires operators to provide clear notice and obtain verifiable parental consent before collecting, using, or disclosing children’s personal information. Notice must explain what data is collected and how it will be used. Parents can consent to collection and internal use only, without third-party sharing. Operators must give parents review access to see all specific types of their child’s collected personal data. Parents can refuse further collection or use and require deletion of their child’s data. To obtain consent, operators must use robust verification methods like calls, postal mail, or multistep emails—simple email alone is insufficient. Parents can revoke consent at any time. Operators who don’t disclose data can use email paired with additional confirmation steps for consent. Overall, COPPA mandates transparent notice to parents on data practices. It grants parents strong rights to control collection of their child’s information through affirmative, verified consent. Parents also have ongoing access, deletion, and revocation rights over their child’s data.

Kiteworks provides secure web forms for transparently collecting consent from parents for use of their child’s information. Custom branding and text explain data practices and uses to align with COPPA notice requirements. Web forms sent to authenticated parent users then capture verified consent or non-consent for collecting and sharing their child’s data. Once consent is captured, parents can access, export, or delete their child’s information anytime. Comprehensive audit logs create immutable records of all submission, access, and deletion activity for compliance reporting. Configurable notifications also alert designated staff of form submissions so they can take immediate action. Together, Kiteworks’ encrypted web forms, access controls, detailed activity logs, and notifications empower organizations to provide the parental transparency, consent, and ongoing control over children’s data mandated by COPPA. Web forms give clear notice, capture affirmative consent, and enable access and deletion rights, while logs create records to demonstrate full COPPA compliance.

Give Notice Allowing Parents and Operators to Retain, Review, and Delete PII Securely

COPPA requires operators to provide clear notice and obtain verifiable parental consent before collecting children’s personal data. Parents can refuse consent or require deletion of their child’s information. Operators must provide parents access to review their child’s collected personal data. COPPA mandates operators can only retain children’s personal data for as long as reasonably necessary for the purpose it was collected. Operators must use reasonable measures to protect against unauthorized access when deleting data. Overall, COPPA grants parents control over their child’s information including consent, access, deletion, and strict limits on retention.

Kiteworks provides the visibility and control capabilities organizations need to comply with COPPA regulations, granting parents oversight of their children’s data. Comprehensive audit logs capture detailed records of all user activity, including personal information submission, access, modifications, sharing, and deletions. This immutable log enables tracking the full life cycle of children’s data to support investigations and demonstrate COPPA adherence. Once a parent requests deletion of their child’s information, Kiteworks ensures it is permanently and securely removed from the system to protect privacy. The encrypted content can no longer be recovered, going beyond basic delete operations. By maintaining unfalsifiable visibility into children’s data collection, retention, access, and removal, Kiteworks empowers organizations to provide the transparency, control, and assurance over children’s information mandated by COPPA.

Kiteworks provides the robust technical safeguards and auditable logs organizations need to comply with COPPA’s stringent regulations for protecting children’s personal data. Its encryption, access controls, and activity logging enable confidentiality, integrity, and security of collected information. Consent web forms deliver transparent notice and capture verifiable approval from parents. Audit logs create detailed records to manage retention periods and support parental access and deletion rights. Together, Kiteworks’ capabilities empower organizations to implement the rigorous protections and oversight COPPA mandates for securing children’s sensitive information and preserving privacy. With Kiteworks, organizations can fully meet COPPA requirements while enabling compliant collection of data needed to provide online services safely to children.

Get started.

It’s easy to start ensuring regulatory compliance and effectively managing risk with Kiteworks. Join the thousands of organizations who feel confident in their content communications platform today. Select an option below.

Lancez-vous.

Avec Kiteworks, se mettre en conformité règlementaire et bien gérer les risques devient un jeu d’enfant. Rejoignez dès maintenant les milliers de professionnels qui ont confiance en leur plateforme de communication de contenu. Cliquez sur une des options ci-dessous.

Jetzt loslegen.

Mit Kiteworks ist es einfach, die Einhaltung von Vorschriften zu gewährleisten und Risiken effektiv zu managen. Schließen Sie sich den Tausenden von Unternehmen an, die sich schon heute auf ihre Content-Kommunikationsplattform verlassen können. Wählen Sie unten eine Option.

Share
Tweet
Share
Explore Kiteworks