<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
<title></title>
</head>
<body bgcolor="#ffffff" text="#000000">
Hi Brendon,<br>
<br>
All US based OP's and consumers fall under the definition of "The
operator" - meaning "any person who operates a website located on the
Internet or an
online service and who collects or maintains personal information from
or about the users of or visitors to such website or online service."<br>
<br>
If you store personal information obtained via
SREG/AX/any_other_extension or from a form (as a consumer) or you give
out information requested by SREG/AX/any_other_extension (as an OP)
then you will need to comply with COPPA.<br>
<br>
Here is the act for those that want to know more ->
<a class="moz-txt-link-freetext" href="http://www.coppa.org/coppa.htm">http://www.coppa.org/coppa.htm</a><br>
<br>
Whilst it does not affect OpenID authentication specifically COPPA
should be noted in guidelines for web developers. If you are concerned
and you want to check your service then the way around COPPA is to
provide an Eligibility clause in you terms of service which denies
service to under 13 year olds. You can find an example in the Facebook
terms of service - <a class="moz-txt-link-freetext" href="http://www.facebook.com/terms.php">http://www.facebook.com/terms.php</a> - [hint] <b>In a
quick survey I found 3 OP's this morning that I know have servers in
the US and DO NOT have COPPA protection in their terms of service</b>.
Ladies and Gentlemen - you've been warned,<br>
<br>
Tom<br>
<br>
<br>
<br>
<br>
<br>
<br>
<br>
Brendon J. Wilson wrote:
<blockquote cite="mid1524665E-8896-43EE-B4E5-347797E673AF@gmail.com"
type="cite">
<pre wrap="">Hi all,
I'm curious if anyone has given any thought to the possible
ramifications of COPPA (the Child Online Privacy and Protection Act)
on the proliferation of OpenID? My understanding is that COPPA
requires service providers to obtain permission from a parent to
collect, disclose, etc information from a child less than 13 years of
age. It appears to me that the Simple Registration Extension would
qualify as disclosure of the user's personal information, and hence a
relying party would need some way to confirm a user's age and parental
permission prior to, or perhaps as part of, allowing an underage user
to authenticate via OpenID?
Brendon
---
Brendon J. Wilson
<a class="moz-txt-link-abbreviated" href="http://www.brendonwilson.com">www.brendonwilson.com</a>
_______________________________________________
general mailing list
<a class="moz-txt-link-abbreviated" href="mailto:general@openid.net">general@openid.net</a>
<a class="moz-txt-link-freetext" href="http://openid.net/mailman/listinfo/general">http://openid.net/mailman/listinfo/general</a>
</pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Tom Calthrop
Founding director, Barnraiser.
Dedicated to giving people the tools they need to share
knowledge and advance society through social software.
Web site: <a class="moz-txt-link-freetext" href="http://www.barnraiser.org/">http://www.barnraiser.org/</a>
OpenID: <a class="moz-txt-link-freetext" href="http://tom.calthrop.info/">http://tom.calthrop.info/</a>
</pre>
</body>
</html>