COPPA AND SCHOOLS
- Can an operator of a Web site or online service rely upon an educational
institution to provide consent to the operator’s collection, use or disclosure of
personal information from students?
COPPA does not preclude schools from
acting as intermediaries between operators and parents in the notice and consent
process, or from serving as the parent’s agent in the process of collecting personal
information online from students in the school context. See 1999 Statement of
Basis and Purpose, 64 Fed. Reg. 59888, 59903. Determining whether the school
may provide consent on behalf of a parent, or whether the operator can rely on the
school for consent, will depend on the nature of the relationship between the online
service and the school or child, and the nature of the collection, use, or disclosure
of the child’s personal information. See FAQ M.2 below. Whether the operator is
working with the school, or obtaining consent directly from parents, it must
provide a complete and accurate disclosure regarding what data is collected from
children, how it will be used, and with whom it will be shared. The operator may
violate the Rule if it fails to disclose its data collection, use, or disclosure practices
to the consenting party. In addition, the school also must consider its obligations
under the Family Educational Rights and Privacy Act (FERPA), which gives
parents certain rights with respect to their children’s education records. FERPA is
administered by the U.S. Department of Education. For general information on
FERPA, see http://www2.ed.gov/policy/gen/guid/fpco/ferpa/index.html. Many
school systems have implemented Acceptable Use Policies for Internet Use
(AUPs) to educate parents and students about in-school Internet use.
Shareathon requests very basic information about users. We ask for first and last
name and we ask for a parent’s email address. That information is used to create
user take home sheets designed for parental approval. Parental signatures are
requested at the bottom of the take home sheet. We will also send one email telling
the parent about the Shareathon and requesting that they build a personal
Shareathon page for their user. Any parent can request that their user be removed
from the system at any time. The names and email addresses are not used for any
other purpose other than for those expressly pertaining to the specific Shareathon
- Under what circumstances can an operator of a Web site or online service rely
upon an educational institution to provide consent?
Many school districts contract
with third-party Web site operators to offer online programs solely for the benefit
of their students and for the school system, for example, homework help lines,
individualized education modules, online research and organizational tools, or
web-based testing services.
Where a school has contracted with an operator to collect personal information
from students for the use and benefit of the school, and for no other commercial
purpose, the operator is not required to obtain consent directly from parents, and
can presume that the school’s authorization for the collection of students’ personal
information is based upon the school having obtained the parents’
consent. However, the operator must provide the school with full notice of its
collection, use, and disclosure practices, so that the school may make an informed
decision. The school may also want to inform parents of these practices in its
Acceptable Use Policy.
If, however, an operator intends to use or disclose children’s personal information
for its own commercial purposes in addition to the provision of services to the
school, it will need to obtain parental consent.
Shareathon only uses the limited personal information for one Shareathon
fundraising event which is held for the benefit of the user and school or group
holding the Shareathon. We do not use any user information for any other
- What information should a school seek from an operator before entering into
an arrangement that permits the collection, use or disclosure of personal
information from students?
A school should be careful to understand how an
operator will collect, use, and disclose personal information from its students in
deciding whether to use these online technologies with students. Among the
questions that a school should ask potential operators are:
What types of personal information will the operator collect from
students? Shareathon only collects user first name, user last name and parents
email. Parents can opt to upload a personal photo or they can use one of our stock
How does the operator use this personal information? Shareathon uses the limited
personal information collected to build a Shareathon fundraising website on behalf
of the school or school that includes a user page that offers no specific contact
information about the user.
Does the operator use or share the information for commercial purposes not related
to the provision of the online services requested by the school? For instance, does
it use the students’ personal information in connection with online behavioral
advertising, or building user profiles for commercial purposes not related to the
provision of the online service? We do not use any information for any other
purpose other than the single Shareathon event that was created.
Does the operator enable parents to review and have deleted the personal
information collected from their children? Yes
What are the operator’s data retention and deletion policies for children’s personal
information? We delete all user personal information shortly after the completion
of each Shareathon fundraiser.
- I am an educator and I want students in my school to share information for
class projects using a publicly-available online social network that permits children
to participate with prior parental consent. Can I register students in lieu of having
their parents register them?
This question assumes that your school has not entered
into an arrangement with the social network for the provision of school-based
activities, but rather that you intend to use a service that is more broadly-available
to children and possibly other users. The Commission has recognized the school’s
ability to act in the stead of parents in order to provide in-school Internet
access. However, where the activities and the associated collection or disclosure
of children’s personal information will extend beyond school-based activities, the
school should carefully consider whether it has effectively notified parents of its
intent to allow children to participate in such online activities before giving
consent on parents’ behalf.
COPPA was designed to protect children from unscrupulous companies that might
take advantage of information entered online. Shareathon requests very limited
information that is used for specific and defined purposes. We do not share any
personal information for any other commercial purpose. We do not contact
children for any purpose other than the specific Shareathon the child signed up for.
Parents can always remove their child from the system. And, finally, data is
removed from the system in a timely basis once the Shareathon event has ended.