COPPA, part two: New study suggests a majority of kids are on Facebook… by age 12

A newly published study quantifies some of the fears I expressed earlier this year in a post about the Children’s Online Privacy Protection Act [COPPA].

The title lays out the problem: “Why parents help their children lie to Facebook about age: Unintended consequences of the ‘Children’s Online Privacy Protection Act’.” It’s by Danah Boyd, Eszter Hargittai, Jason Schultz, and John Palfrey and appears in First Monday, a peer-reviewed Internet journal from the University of Illinois-Chicago.

The study reports the results of a survey of 1,007 U.S. parents, age 26 and over, who have children between 10 and 14, and who do not work in the software industry. The survey found that 55 percent of those children had Facebook accounts by age 12.

This is in violation of Facebook’s COPPA-inspired Terms of Service, which prohibit anyone under age 13 from creating an account. COPPA makes it illegal for Web publishers to knowingly collect personally identifiable information from children under age 13. But that’s not what today’s kids want, I wrote in September:

“By effectively closing the social Web to preteens, COPPA has had the unintended consequence instead of simply encouraging kids to break the rules of the websites and services they wish to use – and by extension flouting the law’s purpose.”

The survey confirms that not only are children violating the spirit of COPPA by lying to register for online social networks, it suggests that the majority of children might be breaking the spirit of the law.

As I wrote before, what’s the point of keeping this element of a law that so many people are consciously breaking?

Remember, it’s the parents who are reporting their children’s Facebook activity in this survey, so presumably there might be some children who’ve registered for Facebook on the sly, too. The study survey not only found that the parents were aware of their children’s Facebook accounts, in the majority of cases they actually helped their children set up the accounts.

Nearly four out of five parents surveys said that there were situations where they would allow their children to create an account on an online service, knowing that their children were younger that the service’s age limit. Here’s the breakdown of why they would, according to the survey: (Respondents could select multiple reasons.)

Yes, for educational or school related purposes – 54%
Yes, but only under supervision – 50%
Yes, to communicate other family members – 48%
Yes, to communicate with me – 47%
Yes, to communicate with friends – 22%
Yes, because their classmates use the service – 9%

Only 22 percent of parents said that they would never knowingly allow their children to register for an online service in violation of the site’s age rules, according to the survey.

The data suggests that parents want to remain a strong influence, if not the focus, of their children’s online social network, with half the parents willing to approve their children’s participation under supervision and a near-majority wanting their children on Facebook in order to communicate with them and to enable the children to communicate with other family members.

The study’s authors suggested that parents aren’t seeing COPPA-inspired terms of service as legal requirements, but as suggestions – ones that can be overruled by their own parental authority. COPPA actually tried to give parents that authority, but the offline verification procedures that the law allowed are so burdensome for online publishers to support that most of them have decided simply not to allow registrations from kids under 13.

But those restrictions are there. And when parents allow their children to break those rules, they are, unfortunately, showing their children that it’s okay to break the rules of a community in order to get something (such as access) from that community. Ultimately, that’s not the healthy way to engage that a law such as COPPA should be encouraging.

COPPA does some great things for kids, helping to keep the Internet from becoming a commercial free-for-all, where Big Business hunts kids’ money and data freely. But why should children be the only ones to have their personal information and identity so well shielded by default?

The authors agree. They write:

“Our data suggest that … relying on age–based models is producing unintended consequences that undermine COPPA’s goals. In response, we propose that policy–makers shift away from privacy regulation models that are based on age or other demographic categories and, instead, develop universal privacy protections for online users.”

That ought to be the issue. Let’s ditch the parts of COPPA that parents don’t want – and don’t abide by – in favor of regulations that can better protect adults as well as kids from having their personal information and identities treated and traded as a business assets without their consent.

Kids want to engage. So do their parents. And parents want a role in helping teach their children how to engage socially online. Let’s let them do this – legally.

About Robert Niles

Robert Niles is the former editor of OJR, and no longer associated with the site. You may find him now at


  1. says:

    Prof. Kathy Montgomery and I led the effort in 1998 to have COPPA enacted to ensure that there would be safeguards related to children’s privacy and commercial advertising in the online era. We have urged the FTC to extend its children’s privacy rules to also include mobile and location data tracking, online gaming, and behavioral data tracking. COPPA is the only US privacy law requiring an affirmative opt-in before personal data is collected (in this case done by a parent). Companies dislike the new FTC proposals, which would set a key precedent on consumer privacy protection in the digital era.

    This new research is very flawed and has several financial conflicts of interests not disclosed. First, Facebook forces parents and kids to lie because it refuses to set up a COPPA compliant section for children. Facebook is fearful of creating an opt-in regime precedent where users would begin demanding for the right to control what data is collected and how it is done. Facebook is a privacy problem, stealthily tracking and targeting a user and their friends for digital marketing. The paper fails to address why privacy on Facebook is a special concern. If parents had been told when they were questioned about Facebook’s data practices, a different set of responses would likely have been given. COPPA has been a success, because the kind of data practices found everyone online once someone turns 13 aren’t generally found on commercial kids sites.

    The study was funded by Microsoft Research. Among the conflicts that should be noted: Microsoft owns a small piece of Facebook; its ad division focuses on social media marketing; the Research division itself works on online ad targeting; and Microsoft is involved in the COPPA regulatory proceeding now at the FTC. It has a financial stake in the outcome of the COPPA proceeding. Readers of the research should have been told about the many conflicts.
    Jeff Chester, Center for Digital Democracy

  2. says:

    What struck me in Coppa part two is the assumption that what kids want should be immediately available to them – an assumption I can’t agree with. I realize it’s very prevalent in parent-child relationships, but I can’t agree that it could ever be in the best interests of the child. It’s similar to providing every member of the family his/her choice for dinner. It’s likel little girls permitted to dress like teens, because they want to. It’s like the inmates running the asylum.

    Social media probablly has a place for adults, but do children actually need it?