Consent is not required when a site is collecting an email address to:
- respond to a one-time request from the child.
- provide notice to the parent.
- ensure the safety of the child or the site.
- send a newsletter or other information on a regular basis as long as the site notifies a parent and gives them a chance to say no to the arrangement.
Our email collection is done in order to ensure the safety of the site and protect us against legal liability from something anyone may write in their diary. In other words, people need to have a way to contact an author who slanders them.
This presents us with a problem.... A big problem actually.
The site is, as you know, run by two people primarily. Two people who already don't have enough time to dedicate to the site. We require email addresses in order to provide administration features (simple things like, changing your password, notification that someone has left a comment). The email address is required ONLY so that you CAN use the site. Without it, you can't use the site. To suggest otherwise is ludicrous. But, this now means we have a few choices;
- Stop collecting any age information (which to be honest we've never used anyway so its pretty pointless to us). This seems like a bury head in sand and pretend children don't access the site, which would be a lie.
- Immediately remove the email address from the database of anyone under 13. This present incredible logistical problems because it makes it impossible to reset someones password if they lose it, and is the reason I consider the email address collected for the safety of the site.
- Get parental consent from 1000 people who probably would rather their parents didn't know they were writing a diary anyway.
- Adjust the system so that people under 15 (since thats the age range we know about, 1-15) can't be notified when someone leaves a comment.
- Ban children under 13
Anyway, I have now called the United States COPPA Helpline and await their instructions.
One thing is for certain, I won't be retro-requesting parental consent from 1000 diarists (for one thing I don't have the time!) so it may well be that 1000 users suddenly find that they no longer get notifications when someone leaves a comment to their diary, or that if they lose their password they're toast because we had to delete their email address...
Thanks US lawmakers, well thought through again.