Which act imposes requirements on website owners and online services directed to children under 13?

Which act imposes requirements on website owners and online services directed to children under 13?

• A. Personal Information Protection and Electronic Documents Act (PIPEDA)
• B. Common Criteria (CC)
• C. Children's Online Privacy Protection Act (COPPA)
• D. Cloud Security Alliance's Security Trust Assurance and Risk (CSA STAR)

Answer: (C)

COPPA is a U.S. law that specifically protects the privacy of children under 13 online. It applies to operators of websites and online services that are directed to kids or that knowingly collect information from children in that age group. The act requires obtaining verifiable parental consent before collecting any personal information from a child, providing clear and accessible privacy notices, limiting what is collected and how it’s used or shared, and giving parents the ability to review and delete their child’s data. It also demands proper security measures to protect that information and practical controls around data retention. This is the best fit because the scenario focuses on protections and obligations for websites or online services aimed at children under 13. The other options deal with different areas: PIPEDA covers general personal data protection in Canada, Common Criteria is a security evaluation framework for IT products, and CSA STAR is a cloud security assurance program.

COPPA is a U.S. law that specifically protects the privacy of children under 13 online. It applies to operators of websites and online services that are directed to kids or that knowingly collect information from children in that age group. The act requires obtaining verifiable parental consent before collecting any personal information from a child, providing clear and accessible privacy notices, limiting what is collected and how it’s used or shared, and giving parents the ability to review and delete their child’s data. It also demands proper security measures to protect that information and practical controls around data retention.

This is the best fit because the scenario focuses on protections and obligations for websites or online services aimed at children under 13. The other options deal with different areas: PIPEDA covers general personal data protection in Canada, Common Criteria is a security evaluation framework for IT products, and CSA STAR is a cloud security assurance program.