Better Business Bureau
Education Consumer Business
BBBOnLine
 
Pixel Pixel
Arrow BBBOnLine Programs
Pixel
Pixel
Arrow Privacy Seal
Pixel
Pixel Apply for Seal
Pixel
Pixel Kid's Privacy Seal
Pixel
Pixel Japanese Privacy Seal
Pixel
Pixel E.U. Safe Harbor
Pixel
Pixel Participant Benefits
Pixel
Pixel Requirements
Pixel
Pixel Pricing Information
Pixel
Pixel FAQs
Pixel
Pixel Dispute Resolution
Pixel
Pixel File a Complaint
Pixel
Pixel
Pixel Association Partnerships
Pixel
Pixel Application Confidentiality
Pixel
Pixel
Reliability Seal
Safe Shopping Site
Pixel
BBBOnLine Information
Pixel
Kid's Program Eligibility Requirements
KID'S SEAL REQUIREMENTS
  1. If all (or part) of your website or online service is directed to children, you must comply with the Kid's Seal Requirements in addition to the general program requirements, and carry the Kid's Seal on your website or online service at least once in each area directed to children.
  2. If you collect personally identifiable information from children, but no part of your website or online service is directed to children, you will not be required to carry the Kid's Seal if you so choose. However, you must complete the Kid's Privacy Profile and comply with all the substantive requirements of the BBBOnLine Kid's Seal.
COLLECTING, USING, & DISCLOSING INFORMATION FROM CHILDREN
  1. If you collect, use, or disclose personally identifiable information from children, you must have a special section in your general privacy notice that discusses your policies with respect to children OR you must have a separate kids' privacy notice (separate from your general privacy notice) that discusses your policies with respect to children.
  2. If you collect, use, or disclose personally identifiable information from children AND you use a separate kids' privacy notice (separate from your general privacy notice) that discusses your policies with respect to children, this privacy notice must restate all the disclosures required in your general privacy notice. There must be a link to your kids' privacy notice in your general privacy notice. There must be a link to your general privacy notice in your kids' privacy notice.
  3. If you collect, use, or disclose personally identifiable information from children AND all (or part) of your covered website or online service is directed to children AND you use a special section in your general privacy to discusses your policies with respect to children, the privacy notice links appearing in your areas directed to children must link directly to that portion of your privacy notice where you discuss your policies with respect to children (i.e., you use an anchor tag or similar device to target the kids' portion of your privacy notice) OR it must be clearly disclosed at the top of your general privacy notice that there is a specific section discussing your information practices with respect to children.
  4. If you collect, use, or disclose personally identifiable information from children, your privacy notice, or a link to your privacy notice discussing your information practices with respect to children must appear prominently on every homepage. Your privacy notice, or a link to your privacy notice discussing your information practices with respect to children must also appear in close proximity to all requests for personally identifiable information and posted email links for your organization.
  5. If you collect, use, or disclose personally identifiable information from children, your privacy notice discussing your policies with respect to children must clearly list the full name of your organization, as well as the address, telephone number, and email address by which an individual can contact your organization to express questions or concerns about your organization's privacy policies and practices.
  6. If you collect, use, or disclose personally identifiable information from children AND there are other organizations that collect personally identifiable information from children on your covered website or online service, your privacy notice must clearly describe how these other organizations use this information.
  7. If you collect, use, or disclose personally identifiable information from children AND there are other organizations that collect personally identifiable information from children on your covered website or online service AND your organization will not respond to all inquires from parents concerning these other organization's privacy and security policies, as well as their use of children's information, your privacy notice must clearly list the full name of each of these other organizations, as well as their address, telephone numbers, and email addresses by which an individual can contact them to express questions or concerns about their privacy and security practices.
  8. If you collect, use, or disclose personally identifiable information from children, you must provide a special disclosure in your privacy policy discussing your policies with respect to children that explains in language easily understood by a child why the personally identifiable information is being requested and whether you intend to disclose the information OR where you request personally identifiable information from a child you provide a statement (separate from the privacy notice) that explains in language easily understood by a child why the information is being requested and whether you intend to disclose the information.
  9. If you collect, use, or disclose personally identifiable information from children, your privacy notice discussing your policies with respect to children must clearly describe how personally identifiable information is collected (actively or passively).
  10. If you collect, use, or disclose personally identifiable information from children, your privacy notice discussing your policies with respect to children must clearly describe how a parent can, after providing proper identification, access his/her child's personally identifiable information and refuse further use or maintenance of that information, or refuse future online collection of personally identifiable information from that child.
  11. If you collect, use, or disclose personally identifiable information from children and upon request of a parent whose child has provided personally identifiable information to your website or online service, and where the parent provides proper identification, you must provide that parent without undue burden:
    1. a description of the specific types of personally identifiable information collected from the child.
    2. an opportunity at any time to refuse further use or maintenance of the personally identifiable information in retrievable form, or future online collection of personally identifiable information from that child, and
    3. notwithstanding any other provision of law, a means of accessing the personally identifiable information collected from that child.
  12. If you collect, use, or disclose personally identifiable information from children, a parent's ability to access his/her child's personally identifiable information may never be limited by frequency or fee.
  13. If you collect, use, or disclose personally identifiable information from children, you must not condition a child's participation in a game, the offering of a prize, or any other activity on the child disclosing more personally identifiable information than is reasonably necessary to participate; and your privacy notice discussing your policies with respect to children must clearly explain this fact.
SHARING CHILDREN'S INFORMATION
  1. If you collect, use, or disclose personally identifiable information from children, but do not share this information with outside parties or corporate affiliates with a different privacy notice, your privacy notice discussing your policies with respect to children must clearly disclose this fact.
  2. If you collect, use, or disclose personally identifiable information from children, and share this information with outside parties or corporate affiliates with a different privacy notice, your privacy notice discussing your policies with respect to children must clearly disclose:
    1. the fact that information is shared with such parties,
    2. the types of business in which such outside parties or affiliates are engaged,
    3. the general purposes for which such information is used by these parties,
    4. whether or not these parties have agreed to maintain the confidentiality, security, and integrity of the information they obtain from your organization, and
    5. that the parent has the option to consent to the collection and use of their child's personally identifiable information without also consenting to the sharing of that information with such parties.
WEBSITES OR ONLINE SERVICES DIRECTED TO CHILDREN
  1. If all (or part) of your covered website or online service is directed to children, and in those areas directed to children you also maintain links to other websites or online services maintained by outside parties, corporate affiliates with different privacy notices; or to areas within your own websites or online services that operate under a different privacy notice, you must engage in one of the following two practices:

      Practice One: You must provide a prominent statement to children that appears when all such links are activated, and this statement remains until the child closes the statement or clicks through to continue. This statement also explains in language easily understood by a child that (i) the child is leaving your website or online service (or your children's area), (ii) other websites or online services may use different information practices, and (iii) the child needs a parent's permission before answering any information gathering questions.

      Practice Two: You only link to the pages of other websites or online services direct to children, or to an area within your own websites or online services that operate under a different privacy notice, when those pages meet, and continue to meet, certain core privacy standards.

  2. If all (or part) of your covered website or online service is directed to children, and you do not collect, use, or disclose personally identifiable information from children, or give children the ability to publicly post, directly communicate with others, or otherwise distribute personally identifiable information, your privacy notice must clearly disclose this fact.
  3. If only part of your covered website or online service is directed to children AND you collect, use, or disclose personally identifiable information from children, your privacy notice, or a link to your privacy notice discussing your policies with respect to children must appear prominently on the homepage for each of these sub-parts.
PARENTAL CONSENT REQUIREMENTS
  1. If you collect, use, or disclose personally identifiable information from children; or give children the ability to publicly post, directly communicate with others, or otherwise distribute personally identifiable information in a way that does not meet one of the parental consent exceptions (below) you must also obtain prior verifiable parental consent. You must also obtain prior verifiable parental consent before making any material change in the way you collect, use, or disclose personally identifiable information from children; or give children the ability to publicly post, directly communicate with others, or otherwise distribute personally identifiable information.
  2. If you use the delivery of email to a parent as a method of obtaining parental consent, you must never use this type of parental consent where a child's personally identifiable information will be shared with outside parties or corporate affiliates with different privacy notices; or children are given the ability to publicly post, directly communicate with others, or otherwise distribute personally identifiable information.
  3. If you use the delivery of email to a parent as a method of obtaining parental consent, you must only use this method where your organization takes additional steps to provide assurances that the person providing consent is the parent. Such additional steps include sending a confirmatory email to the parent following receipt of consent; or obtaining a postal address or telephone number from the parent and confirming the parent's consent by letter or telephone call. In the course of these additional steps, you must also provide notice to the parent that they may revoke any consent given in response to the earlier email.
PARENTAL CONSENT EXCEPTIONS
  1. If you do not obtain prior verifiable parental consent AND collect online contact information from children solely to respond to their request on a one-time basis, you must:
    1. only use this online contact information within the scope of the request (and for no other purpose),
    2. only use this online contact information to contact the child a single time, and
    3. delete this online contact information from retrievable form after you have responded.
  2. If you do not obtain prior verifiable parental consent AND collect online contact information from children solely to respond to their request AND the response requires more than a single contact, you must:
    1. not use this online contact information for any purpose beyond the scope of the request,
    2. not maintain this online contact information in retrievable form after the last response, and
    3. before the second contact, you must also provide direct parental notification that states the following:
      1. that your organization wishes to collect personally identifiable information from the child,
      2. the complete text of your online privacy notice discussing your policies with respect to children,
      3. that your organization has collected the child's email address or other online contact information to respond to the child's request for information and that the requested information will require more than one contact with the child,
      4. that the parent may refuse to permit further contact with the child and require the deletion of the information, and how the parent can do so,
      5. that if the parent fails to respond to the notice, your organization may use the information for the purpose(s) stated in your privacy notice, and
      6. how the parent may respond to the notice.
  3. If you do not obtain prior verifiable parental consent AND collect the name or online contact information about either a parent or child for the sole purpose of obtaining parental consent or providing parental notice without obtaining prior verifiable parental consent, you must not maintain the name or online contact information in retrievable form if parental consent is not obtained after a reasonable time.
  4. If you do not obtain prior verifiable parental consent AND collect names or online contact information from children to the extent reasonably necessary to protect the safety of those children participating in your website or online service without obtaining prior verifiable parental consent, you must:
    1. only use these names or online contact information for the purpose of protecting that child's safety.
    2. not use these names or online contact information to re-contact the child for any purpose.
    3. not disclose the child's name or online contact information on your website or online service.
    4. make reasonable efforts to provide parental notification that contains the following elements:
      1. that your organization wishes to collect personally identifiable information from the child,
      2. the complete text of your online privacy notice,
      3. that your organization has collected the child's name and email address or other online contact information to protect the safety of the child participating on the website or online service,
      4. that the parent may refuse to permit the use of the information and require the deletion of the information, and how the parent can do so,
      5. that if the parent fails to respond to the notice, that your organization may use the information for the purposes stated I the notice, and
      6. how the parent may respond to the notice.
    5. process the response you receive from parents in a timely manner in the instance a parent does prohibit the further use his/her child's information.
  5. If you do not obtain prior verifiable parental consent AND you collect names or online contact information from children to the extent reasonably necessary to: a) protect the security or integrity of the website or online service, b) take precautions against liability, c) respond to judicial process, or d) provide information to law enforcement agencies for an investigation on a matter related to public safety only to the extent permitted under other provisions of law; you must not use these names or online contact information for any other purpose.
CHILDREN'S PUBLIC POSTING
  1. If you grant children the ability to publicly post personally identifiable information, you must make best efforts to prohibit children from posting contact information, and to remind children to use non-identifying names, such as aliases, first names only, nicknames, initials, or other alternatives in any activity which will involve public posting.
CHILDREN'S PASSIVE INFORMATION
  1. If you collect passive or behavioral information (like cookies) from children that is associated with a name or similarly specific identifier, you must provide a statement separate from your privacy notice that explains in language easily understood by a child what passive information is being collected OR you must provide a special disclosure in your privacy notice discussing your policies with respect to children that explains in language easily understood by a child what passive information is being collected. If you provide a statement separate from your privacy notice, this statement, or a direct link to this statement must appear on your homepage and on every secondary entry point. If you provide a special disclosure in your privacy notice discussing your policies with respect to children, this privacy notice, or a direct link to this privacy notice must appear on every secondary entry point.
CHILDREN'S SCREEN NAMES & PUBLIC USER NAMES
  1. If you use a system that corresponds a child's "screen name" or public user name with an email address or other method of direct communication, you must also provide before a child can engage in any activity on your website or online service that would disclose this screen name or public user name a statement or direct link to a statement that explains in language easily understood by a child that the child's contact information will be publicly disclosed by engaging in that activity. This statement or direct link to a statement must appear at the time, or immediately before, a child can engage in an activity that would disclose the screen name or public user name.
COMMUNICATING WITH CHILDREN BY EMAIL
  1. If you communicate with children by email, you must take steps to remind and encourage parents to regularly check and monitor their children's use of email and other online activities. Where you communicate more than once with a child by email, you must also include an opportunity with each mailing for the child to choose, by return email, to discontinue receiving mailings.
© 2003 Council of Better Business Bureau, Inc.
Contact Us | Privacy Policy | Site Map | About Us