72

We had a user who as far as we can tell on travel.se, was deleted on Puzzling for being underage, and so all their accounts were removed. They were an incredibly useful user on Travel, and if they were underage, we found that pretty surprising.

However, would it not be better than instead of deleting their accounts, suspend them until they are of age?

Disappointed, this user was so engaged in the site, the chat and was over 12k rep in a matter of months, but in a blink of an eye they're gone.

Maybe there's some legal thing I'm unaware of, but if their profile was cleansed, surely it'd be ok—I mean, SE is happy to keep all their contributions it seems.

7
  • 25
    How can you prove one way or another that a user is of age or not? And how do you prove how long it'll be until they are of age?
    – scohe001
    Commented Nov 12, 2019 at 20:11
  • 10
    @scohe001 I've no idea, but there must be a way if they determined they were not of age. If a user says "I'm 15" and the EU law says they need to be 16, just suspend for 366 days, regardless of when their birthday is, just to be safe.
    – Mark Mayo
    Commented Nov 12, 2019 at 20:13
  • 11
    This is likely a COPPA requirement. Users under 13 cannot have accounts without parental guardian permission. They can't be stopped from making accounts anyways, but I don't think getting rid of them is optional.
    – fbueckert
    Commented Nov 12, 2019 at 20:16
  • @WeareMonica. I'm saying there was a way they clearly identified the user as being under age. Maybe he said "I'm x" and x was too young. Great. Suspend until of age. If they were joking and they're actually 71, a simple process for getting the account unsuspended with evidence would suffice (like reddit AMAs, hold up a card with your username next to your driver's license, for example)
    – Mark Mayo
    Commented Nov 12, 2019 at 20:18
  • 4
    You can read up on some stuff about COPPA here. Notably, collecting information about kids under 13 is not allowed. Keeping those accounts probably falls afoul of that requirement, I'm betting. I'm not a legal expert in any sense.
    – fbueckert
    Commented Nov 12, 2019 at 20:20
  • 2
    @fbueckert that's why I wondered if their profile (and identifying data) could be cleansed, and then suspended. IANAL either, sadly, it just seems like such a waste.
    – Mark Mayo
    Commented Nov 12, 2019 at 20:21
  • I'd just like to point out that EU law doesn't require users to be at least 16. It sets a default minimum age of 16 and allows individual countries to choose an actual minimum age between 13 and 16. See the link in Tim Post's answer. It shows that the relevant age in the UK has (since 2017) been 13. If this user is expected to be 16 in 2021, then he was over 13 in 2019 and there was no legal need to delete his account.
    – phoog
    Commented Feb 10, 2020 at 18:08

5 Answers 5

92

I wish we could.

The problem is, individuals have to be a certain age to legally give us consent to store their PII (personally identifying information). The age where kids can do this varies (US:13 / EU:16 though not all countries have updated local laws which creates confusion). If you aren't that age, we can't keep your account, because we're not allowed to have the information necessary to establish one.

If we can't keep an account, we can't keep any sense of normalized ownership of posts and other contributions. We can't let them log in because that means storing a credential which contains, yep, PII.

I had to delete my daughter's account from Arqade when she started answering Minecraft questions (quite well, in fact) because she wasn't 13 yet and a US citizen. I completely feel for this, but the law is what it is.

18
  • 19
    Wait...doesn't COPPA allow websites to collect such info if the parent consents to it? In the case of your daughter, couldn't you have simply issued your consent, so she could keep her account? Commented Nov 12, 2019 at 20:26
  • 13
    @SonictheReinstateMonica-hog "Wait...doesn't COPPA allow websites to collect such info if the parent consents to it?" No, it doesn't, and companies have gotten in trouble claiming it does. Even parents think it does and have complained, but it doesn't fly.
    – Ron Maupin
    Commented Nov 12, 2019 at 20:29
  • 6
    @RonMaupin So then how do sites with a mostly underage audience (e.g. Disney) operate legally? Commented Nov 12, 2019 at 20:34
  • 18
    @SonictheReinstateMonica-hog By not collecting PII, or only collecting parental information. A parent can have an account and let the child use it, but the child cannot have his/her own account using PII.
    – Ron Maupin
    Commented Nov 12, 2019 at 20:35
  • 1
    @SonictheReinstateMonica-hog, I have seen multiple news articles about parents upset that their children's' accounts were deleted with no notice and all the information purged. One father even tried to sue a big social-media site because his 12-year old daughter's account was purged, even though she had his permission.
    – Ron Maupin
    Commented Nov 12, 2019 at 20:40
  • 7
    Of course, nothing stops users from just lying about their age. I was born on January 1st 1960 on a lot of websites :) Commented Nov 12, 2019 at 20:58
  • 1
    What if parent says account email is their? Could the child use it, or at least could it be put in suspension then? Commented Nov 12, 2019 at 21:02
  • 27
    @SonictheReinstateMonica-hog The process for getting a parent's verifiable consent is complicated and not worth the effort for any site not targeted at children: ftc.gov/tips-advice/business-center/guidance/…
    – animuson StaffMod
    Commented Nov 12, 2019 at 21:21
  • 2
    @SonictheReinstateMonica-hog COPPA allows collecting PII from children (note that COPPA's definition of PII isn't quite what you would expect) subject to parental approval and more than 500 characters of rules that boil down to don't collect more than you need. Commented Nov 13, 2019 at 0:13
  • 2
    @TimPost So, did all of their posts also get deleted?
    – A J
    Commented Nov 13, 2019 at 5:03
  • 4
    @AJ no, the posts don't automatically get deleted. They'll look like any other content written by deleted users. (source: I manually deleted such content on IPS recently)
    – Tinkeringbell Mod
    Commented Nov 13, 2019 at 10:42
  • 1
    @user56reinstatemonica8 No. COPPA regulates whom the PII is collected from, but not generally whose PII is collected. Commented Nov 13, 2019 at 15:33
  • 2
    @JonathanReezSupportsMonica we don't mind you're really 81 ...
    – rene
    Commented Nov 13, 2019 at 17:40
  • 3
    @TimPost After researching some more, I've changed my mind. Arqade probably doesn't just get close to the line, but crosses it altogether, and that drags all of SE with it to some extent. Commented Nov 13, 2019 at 19:33
  • 4
    This answer misstates EU age requirements under the GDPR and misinterprets the linked article on that topic. Under the GDPR, the minimum age is 16 by default, but individual states can lower the age as low as 13. The linked article says that Slovenia was planning to lower the age to 15, but because the law hadn't yet passed, the default age of 16 would apply in Slovenia. But the UK (which is no longer in the EU) had already lowered its age to 13 as of 2017, as reported on the same page, so there was never any reason to remove this user from the site.
    – phoog
    Commented Feb 10, 2020 at 17:51
27

I wish they could. But:

The Children's Online Privacy Protection Act requires that websites cannot collect personal information from children under the age of 13, including "full name, home address, email address, telephone number or any other information that would allow someone to identify or contact the child."

This also goes for users in the EU that are under 16:

The update will reflect that you need to be 13 years old, unless you live in the EU, which means we require you to be 16. However, there's nothing in the law that says we have to go proactively looking for underage users, which means the policy isn't any different from what we have, essentially. If someone says "I'm only x years old" and mods suspect the user might be underage, they just escalate it to us to investigate. A lack of action on our part is an indication that we looked, and found no grounds to delete the account.

Basically SE is not allowed to keep any user data (including the e-mail address you use for signing up and registering your account), and so a suspension isn't feasible. Moderators escalate these underage users to Community Managers instead of deleting them ourselves, to ensure all information is properly scrubbed.

1
  • 6
    Fair enough. I figured there might be a legal reason, but thought maybe I had a workaround. But yes, keeping their email even for a couple of years would count as PII :/ Thanks!
    – Mark Mayo
    Commented Nov 12, 2019 at 20:23
12

There is a legal reason for deleting their accounts in full, rather than simply suspending them.

In the United States, there's a law called the Children's Online Privacy Protection Act (COPPA) that requires any website accessible in the U.S. to not collect information from any user who is under 13, and to erase any information that has been collected from users who are under 13.

As per the relevant FAQ, How do I use Stack Exchange if I'm under 13 years old?:

The Children's Online Privacy Protection Act requires that websites cannot collect personal information from children under the age of 13, including "full name, home address, email address, telephone number or any other information that would allow someone to identify or contact the child."

Since Stack Exchange, during the registration process, allows users to enter their name, email address, and website URLs where other users might be able to contact the user, Stack Exchange is legally obligated to follow this law.

[...]

I'm under 13 and I created an account. What will happen?

Your account will be deleted and all information you provided will be removed from our servers. You can create a new account once you turn 13, or follow the procedures above to have your parent/guardian create an account. While you will be able to participate in Stack Exchange again, unfortunately, we cannot reinstate your old account, so any reputation you gained on your old account will be gone.

Since all their information has to be removed, the account has to be deleted in full, and the details have to be purged so that even moderators can't see them.

Note that in the past, SE used to suspend underage users until they were old enough to participate, as you mention:

As you know, users that are under the age of 13 can't participate on our sites, as per our terms of service. The way that we used to handle a disclosure from someone that they were only ten years old was to suspend them until they were old enough to participate. That required us to be able to suspend someone for longer than a year, so the maximum time the system would accept when a suspension was issued used to be quite high.

We changed that, moderators are no longer able to suspend accounts for more than 365 days. The community team now deals with reports of users under the age of 13, and we handle it quite differently.

I guess their legal department informed them that this would not be in compliance with COPPA, as it requires all information to be purged.


A quick note: Crucially, the law does not require that SE actively go out and seek underage users, or verify age; it simply requires them to take action if they happen to know that the user is underage (e.g. due to a self-disclosure, a report, etc.).

2
  • The quick note at the end is ultimately why the common inofficial guidance for users, even perpetuated as such by SE employees if I remember correctly, is simply "just lie!". Commented Nov 13, 2019 at 9:59
  • 3
    The "quick note" is not exactly true. The law does not require SE to verify age, but since SE now has content that is interesting to children, if SE doesn't verify age it is required to treat all its users as children (which it doesn't currently do.) Commented Nov 13, 2019 at 19:30
4

Collecting personal data without age verification or parental consent for users under 13 may not be COPPA compliant for Stack Exchange anymore

COPPA (the Children's Online Privacy Protection Act) is the US law governing websites' interactions with children under 13. Stack Exchange currently uses an exemption in the law that allows sites that are general-purpose or have adult-focused content sites to largely ignore COPPA, only being required to delete any personally identifying information from any user that they learn is under 13 years old. Such sites are not required to proactively take any steps to determine that users are 13 or older, only react if someone notifies an employee.

That exemption applied when SE focused on technology professionals, but it has since expanded in scope. It only takes an identifiable part of a website that is attractive to children to make the entire site fall under stricter provisions under COPPA. While a generic chat site would qualify for the exemption described above, a chat site with several rooms, one of which discussed dolls would not qualify. That doesn't necessarily mean the entire site is subject to onerous rules -- it depends on the nature of the site and which exemptions the operators are able to take advantage of. COPPA is an extremely intricate set of regulations, so the correct answer to almost any question about it is "it depends."

SE now clearly hosts content that is attractive to children. For example, at the time of writing, the most popular tag on Arqade is , and 20% of Minecraft users are under the age of 15. This means in the lingo of COPPA, SE is considered to be a website that is "directed to children" but "does not target children as its primary audience."

While websites that are directed to children but do not target children as their primary audience do not qualify for the exemption allowing them to collect whatever PII they want and delete the PII of any underage user they happen to find out about, they do qualify for the active age screening exemption. This allows them to ask for the user's age before asking for PII, which allows websites more flexibility in how they treat people above the minimum age. Websites in this category are not required ask any user their age, but the default flips; they are required to treat all of their users as children that they don't know to be adults.

The flexibility for sites in this category to treat adults and children differently is not unlimited: according to the FTC's official COPPA FAQ, they cannot prohibit children under 13 from using the site:

4. I run a site that I believe may fall within the FTC’s sub-category of a website directed to children but where it is acceptable to age-screen users. Can I age-screen and completely block users who identify as being under age 13 from participating in any aspect of my site?

No. If your site falls within the definition of a “Web site or online service directed to children” as set forth in paragraph (1) of 16 C.F.R. § 312.2, then you may not block children from participating altogether, even if you do not intend children to be your primary target audience. Instead, what the amended Rule now permits you to do is to use an age screen in order to differentiate between your child and non-child users. You may decide to offer different activities, or functions, to your users depending upon age, but you may not altogether prohibit children from participating in a child-directed site or service.

This rule was made under authority from Congress to prohibit deceptive practices, so it appears that the FTC considers a site that has content that is interesting to children but children are not allowed to participate in to be deceptive.

SE's options if they want to keep Arqade and any other sites that are interesting to children are varied and complicated, but the two most important things to keep in mind are that they must not prevent a child from participating in an activity because they haven't provided PII that is not reasonably necessary for the activity 16 CFR 312.7, and they must obtain parental permission if they collect/use PII for any reason not in the fairly generous list of exceptions.

After digging through the ins and outs of what is considered PII for COPPA purposes, I'm convinced that pinging and chat are the only major pieces of functionality that require PII currently1. That doesn't mean there aren't other issues that would need to be addressed. For instance, SE would have to ensure that the tracking used on the site by itself and its advertisers apply, and it would have to take steps to make reasonably sure that posts and comments by underaged users does not contain PII. (Pre-screening for PII by a staff member before publishing is explicitly defined as a reasonable approach for doing this.)

Alternatively, SE could obtain parental permission to display any personal information children put in post or comments. Third party services exist to make it easier to verify parental consent. They would still need to make sure they were in compliance with the various provisions of COPPA, but with parental permission there is much less that is restricted.


1: But note that the presence of pinging and chat turn anything that displays a username into "requiring PII" due to odd dependencies2 in the COPPA definition of PII.

2: This is not even the oddest interaction3 between definitions in the COPPA regulations.

3: I really want to see a ruling on how Chevron deference applies to an agency's resolution of Russel's paradox!

9
  • 1
    I think you're getting a bit twisted there. To be a "[w]eb site or online service directed to children" means that it has to target children, whether the primary audience or not (like Barnes & Noble). Merely having content that's attractive to children doesn't cut it (some video game companies). The determination considers models, animations, music, and advertisement on other child-directed websites, but not anything about interesting information. I don't think Arqade is targeting children by the definition.
    – gormadoc
    Commented Nov 13, 2019 at 20:23
  • 1
    "Subject matter" is literally at the top of the list of considerations in the definition of "directed to children" in 16 CFR 312.2. "[A]ttract[ing] a substantial number of children under 13" is not in the official definition, but it is in the FTC's official FAQ in relation to that definition, so unless you feel like rolling your Chevron dice really hard you should probably consider it part of the official definition. Commented Nov 13, 2019 at 21:29
  • 1
    Also, even if Arqade as a whole wouldn't count, the [tag: minecraft] tag has over 10,000 posts and is very recognizable as a portion of a website, which is enough for the definition in 16 CFR 312.2. Commented Nov 13, 2019 at 21:50
  • 2
    @gormadoc Of course Barnes and Noble are subject to COPPA. They'll even tell you so. B&N don't seem to collect PII from their users without a credit card transaction, which COPPA considers proof of adulthood. I wouldn't try too hard to find a violation, because their COPPA ninja managed to figure out how to collect personal information about children without parental knowledge or consent without violating COPPA. Commented Nov 14, 2019 at 5:09
  • I never said that Barnes & Noble wasn't - they target children - Arqade does not. Minecraft might be directed at children but that doesn't make it the same for Arqade. Rule 34 porn sites are not directed at children even if the original subject was, for instance.
    – gormadoc
    Commented Nov 14, 2019 at 23:46
  • 1
    Just stumbled upon this. But I don't see any problem in SE blocking users under the age of 13, as they can still use the site as anonymous users.
    – Luuklag
    Commented Feb 12, 2020 at 9:41
  • @Luuklag the whole topic is about points and badges Commented Nov 20, 2020 at 22:32
  • @OwnageIsMagic that requires an account, which requires an emailadres, which is PII, so that is impossible. So hence my remark they could still parttake as anonymous users. If this happens from the start there is nothing lost.
    – Luuklag
    Commented Nov 20, 2020 at 22:50
  • @Luuklag I just noted that your point of view is irrelevant to this question Commented Nov 20, 2020 at 22:56
-20

However, would it not be better than instead of deleting their accounts, suspend them until they are of age?

The better thing to do would be to not delete their accounts and not suspend them. It's excessively discriminatory and unfair to underage people, for them not to be able to ask questions on SE sites.

17
  • 32
    SE can't do that because it'd be blatantly against the law. Commented Nov 12, 2019 at 21:40
  • 21
    Making this argument here isn't going to change the law.
    – Kevin B
    Commented Nov 12, 2019 at 21:40
  • 3
    @KevinB: Maybe not, but: 1. It's what I believe and 2. It's not clear that things can't be arranged so that the law is not broken.
    – einpoklum
    Commented Nov 12, 2019 at 21:42
  • 3
    @SonictheReinstateMonica-hog: What, you mean because "individuals have to be a certain age to legally give us consent to store their PII"? Well, don't have them enter their PII then.
    – einpoklum
    Commented Nov 12, 2019 at 21:43
  • 10
    @einpoklum-reinstateMonica login info is PII. As Tim said: "We can't let them log in because that means storing a credential which contains, yep, PII." This seems like a non-trivial problem to design around, and you haven't proposed any way to do so. Commented Nov 12, 2019 at 21:57
  • 2
    A bit sarcastic answer, but we hate fun, I suppose. Commented Nov 12, 2019 at 21:59
  • 3
    It's not illegal for them to have an account under COPPA. SE would just need to get parental permission. Commented Nov 12, 2019 at 23:49
  • @Rubiksmoose: How so? You can't identify me (and most SE users) by their login credentials.
    – einpoklum
    Commented Nov 13, 2019 at 6:51
  • @einpoklum Usernames are considered PII under COPPA if they can be used to send "direct messages" between users. It's not clear to me that pinging and chat would be considered direct messages, since they are public, but it's not unreasonable for SE to just steer clear there. Passwords count as PII under COPPA but are largely exempted, so they may not technically have to be deleted. There question is moot since you need usernames for passwords to be useful. Commented Nov 13, 2019 at 15:09
  • @PeterMortensen: I wasn't being sarcastic actually.
    – einpoklum
    Commented Nov 13, 2019 at 17:22
  • 2
    @rockwalrus-stopharmingMonica: The US is crazy. But - has this ever been tested in the supreme court? It's an extremely onerous restriction of children's personal freedoms. It might even contradict some international treaty or something. Also - what about, instead of removing an account, preventing only "direct messages" (whatever those supposedly are), and letting underaged people use the rest of the site's facilities?
    – einpoklum
    Commented Nov 13, 2019 at 17:24
  • 1
    @einpoklum-reinstateMonica COPPA hasn't come up in the Supreme Court. AFAICT, no one has challenged its constitutionality in court. Once a website knows that a user is <13 it's required to not collect or display PII without parental consent. It would need either to get parental consent or take reasonable efforts to keep children from putting things like "I live at 123 Example Street" in their answers. SE is trying to avoid doing that. But as I noted, the exception that SE currently uses to restrict <13 users probably is no longer applicable. Commented Nov 13, 2019 at 18:17
  • 2
    The FTC will be accepting comments for the next round of COPPA rulemaking for the next few days. You can express your concerns to the very people who can change the rules. Commented Nov 13, 2019 at 19:36
  • @rockwalrus-stopharmingMonica: If the rules contradict a binding treaty or the US constitution, they're void. Also, I'm not even a US citizen, nor a moderator on SE. But if you make that suggestion to everyone on MSE, I'll do it too :-)
    – einpoklum
    Commented Nov 13, 2019 at 20:28
  • 2
    I promise you that if you do submit a comment it will have more of an effect than [this one] (regulations.gov/document?D=FTC-2019-0054-2757). Commented Nov 14, 2019 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .