10

IANAL

While reading this answer, I realized that the ToS is ambiguous (at least to me, a non lawyer).

It first defines "Services" as

Please read these terms of service (“Agreement”) carefully before using the Network or any services provided on the Network (collectively, “Services”).

At this point it seems like "services" includes anything you do on *.stackexchange.com. However, note that the ToS is something you accept when you create an account (I think), so "services" may exclude "reading stuff". Either way, exactly what is defined by "services" (lowercase) isn't really clarified here.

This gets clarified later:

Services shall include, but not be limited to, any services Stack Exchange performs for Subscriber, as well as the offering of any Content (as defined below) on the Network. Stack Exchange may change, suspend or discontinue the Services at any time, including the availability of any feature, database, or Content.

The definition of "Subscriber" is a tad circular, It seems to be first defined as "The Services are accessed by You (“Subscriber” or “You”) under the following terms and conditions", however "Services" includes "any services Stack Exchange performs for Subscriber". O.o


However, there's the COPPA clause:

Subscriber certifies to Stack Exchange that Subscriber is an individual (i.e., not a corporate entity) at least 13 years of age. No one under the age of 13 may provide any personal information to or on Stack Exchange (including, for example, a name, address, telephone number or email address). Subscriber also certifies that they are legally permitted to use the Services and access the Network, and takes full responsibility for the selection and use of the Services and access of the Network. This Agreement is void where prohibited by law, and the right to access the Network is revoked in such jurisdictions.

Wait ... what? Does this mean that children under 13 are not allowed to read this website? This doesn't make sense, and I don't see COPPA preventing 13 year olds from accessing this network.

The only PII that is stored for anon users is the IP address in the logs AFAICT. It's not liked to any other personal details, so this seems innocuous to me. Besides, to the best of my knowledge, this is covered by section 1303(b)(2)(E)(i) ("The regulations shall provide that verifiable parental consent under paragraph (1)(A)(ii) is not required in the case of ... the collection, use, or dissemination of such information by the operator of such a website or online service necessary ... to protect the security or integrity of its website;"). Logging is pretty necessary for the security of the site. If this was prohibited then children wouldn't be able to use almost any site on the Internet without permission (including Google for search), and I doubt that that is the case.

Besides, IP addresses are not explicitly listed under Section 1302(8) "The term "personal information" means individually identifiable information about an individual collected online, including ...", though subsection (F) ("any other identifier that the Commission determines permits the physical or online contacting of a specific individual; or") may include it, depending on what the Commission has decided.


So, is it legal for child younger than 13 years of age to read and use content1 on the SE network? If not, why?

1. Of course, given that the content policy is obeyed when using the information

  • That clause applies to "Subscriber(s)". Is a non logged in user a subscriber? – yannis Jul 10 '13 at 7:29
  • @Yannis It depends on the definition of "services". "Subscriber" derives its definition from that: "The Services are accessed by You (“Subscriber” or “You”) under the following terms and conditions". – Manishearth Jul 10 '13 at 7:31
  • 2
    @Yannis The phrasing of the definition of a "Subscriber" would imply anyone who uses the StackExchange services, regardless of registration. – Aza Jul 10 '13 at 7:32
  • Hmm, I noticed that "services" is defined later on, so I edited my question to ask specifically about the COPPA thing. – Manishearth Jul 10 '13 at 7:35
  • I found an old deleted post related to it. (that 13 year old user set his display name as Jeff Atwood) – hims056 Jul 10 '13 at 7:45
  • 1
    @hims056 I remember that. However, that's about a user with an account. I'm aware of those policies -- if a user with an account reveals his or her age as below 13, the details from the account are scoured. Not just deleted, scoured. – Manishearth Jul 10 '13 at 7:53
  • I don't believe the TOS applies here, for the reason that an individual doesn't agree to the TOS until he/she makes an account, in which case said individual does need to be at least 13 years old. But anyways, IANAL. – waiwai933 Jul 10 '13 at 8:23
  • @waiwai933 Yeah, that's what confuses me. However "subscriber" is defined as anyone who uses the "services", and reading seems to be included as a service. For that matter, the definition of "service" is dependent on the definition of "subscriber" too – Manishearth Jul 10 '13 at 8:25
  • Every time I see the "I am not a lawyer" acronym, I think of a caveman declaring how retentive he is. – Esoteric Screen Name Jul 10 '13 at 16:42
  • @EsotericScreenName me too, actually :P – Manishearth Jul 10 '13 at 16:45
  • 1
    if you are not allowed to read the site, then you can't read the TOS... If you can't read the TOS, how do you know if you are breaking them? Sucks to be a <13 year old in this world. – SeanC Jul 10 '13 at 17:54
9

It does appear to be ambiguous.

The Services are accessed by You (“Subscriber” or “You”) under the following terms and conditions:

According to that, anyone who accesses any Services is a Subscriber, and those Services include reading content.

However...

So, is it legal for child younger than 13 years of age to read and use content on the SE network?

Yes, of course it is. Even if we assume the worst case, that "children under 13 aren't allowed to even read content on Stack Exchange" is the intended policy, breaking Stack Exchange policy isn't the same as breaking a law. As long as they don't provide any PII, we have no way of knowing if a 12 year old kid is using content on the network, so no one is violating COPPA. As long as that's the case it doesn't really matter, since we also can't know if anyone is violating the (probably unintended) letter of the SE policy.

  • And if we assume the worst case, that "children under 13 aren't allowed to even read content on Stack Exchange" is the intended policy, would such a policy be valid/lawful or not? – ypercubeᵀᴹ Jul 10 '13 at 17:17
  • 2
    @ypercube It could be a valid policy, sure. There are plenty of sites that don't allow children to access their content. It's not really enforceable under the current sign-up/login implementation, but that's a whole other barrel of fish. – Bill the Lizard Jul 10 '13 at 17:38
3

The COPPA has been recently updated to include IP addresses as personally identifiable information.

Reading any content, even anonymously, counts as consuming the services (emphasis added):

Services shall include, but not be limited to, any services Stack Exchange performs for Subscriber, as well as the offering of any Content (as defined below) on the Network. Stack Exchange may change, suspend or discontinue the Services at any time, including the availability of any feature, database, or Content.

Also, one does not need to be a registered user to be a "subscriber" (emphasis added):

The Services are accessed by You (“Subscriber” or “You”)

Since content, which is explicitly part of the services, can be accessed anonymously, unregistered users must be included as subscribers.

The critical clauses related to those under 13:

Subscriber certifies to Stack Exchange that Subscriber is an individual (i.e., not a corporate entity) at least 13 years of age. No one under the age of 13 may provide any personal information to or on Stack Exchange (including, for example, a name, address, telephone number or email address)

I assume that SE immediately logs the IP of every visitor, and/or issues a cookie. Any user under 13 who consumes services on SE, even anonymously, has violated both of these items. Such users who don't consume the services - say by starting off reading the TOS, because we all know that's what everyone does immediately upon accessing any site - have not violated the first rule, but still break the second. Thus, the terms explicitly bar all users under 13.

However, SE is probably not in violation of COPPA for collecting IP addresses. It can reasonably be considered not a "child directed" site, and parental consent is not required for the collection of "passive" PII such as IPs and cookies as long as...

(1) you collect no other “personal information,” and (2) such persistent identifiers are collected on or through your site or service solely for the purpose of providing “support for the internal operations” of your site or service

Source, section C.6. See also sections F, I.5, and I.7.

I am not sure of the legal status if a user under 13 supplied additional, non-passive PII.

  • By this logic, any site that logs IP addresses are not for children under 13. And, most if not all sites keep an access log somewhere. Ban everyone less than 13 from the internet! Great idea US Govt. – Kaz Wolfe Dec 29 '14 at 12:43
  • So what about a child who uses a proxy and thus does not provide their IP address? – forest Mar 15 '18 at 5:05
0

As for who is a subscriber the ToS clearly states (emphasis mine):

Please read these terms of service (“Agreement”) carefully before using the Network or any services provided on the Network

SO this should include reading because serving webpages is part of the SE range of services.

As for 13 year olds:

No one under the age of 13 may provide any personal information to or on Stack Exchange (including, for example, a name, address, telephone number or email address).

How can it be clearer then that? If you are under 13, You can't give stack exchange personal information.

That's it.

It continues to state the if you use the service you certify you are not breaking any laws by doing it.

In the United Stated IP is not considered personal information (as to a court ruling in the subject) short source & actual ruling

A persistent identifier that can be used to recognize a user over time and across different websites or online services. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier;

The amended Rule will become effective on July 1, 2013.

http://www.ftc.gov/os/2012/12/121219copparulefrn.pdf page #154.

  • Read the question again. Does visiting the site (which leads to your IP being logged) count as "giving"? Are IPs, in the absence of any other data, considered PII? – Manishearth Jul 10 '13 at 8:52
  • Also, afaict, If a child uses this site, the child is not breaking any law, but SE is (well, only if they are aware of the child's age). COPPA is about restricting the collection of PII, not about restricting children from using the Internet. – Manishearth Jul 10 '13 at 8:53
  • 1
    @Manishearth that's my point. I don't believe IP is considered personal information. It doesn't provide anything recognizable and is usually not permanent. You are saying they can't even use a browser. what about user agent? – raam86 Jul 10 '13 at 8:55
  • Yes, but that is debatable. To be sure of this, one would need to know what fits within Section 1302(8)(F). By the strict interpretation, it is OK to use a browser, but it is not OK for a website to keep logs of anon data for a long time. Which is probably false. But this isn't about COPPA, this is about what SE defines as a "Subscriber". My point is that SE's ToS seem much stricter than what COPPA needs it to be – Manishearth Jul 10 '13 at 9:01
  • In my country (well, actually in all European Union afaik) IP can be considered to be Personal Information, if it's a public static IP assigned to a device serving one owner. Example: IP of a cell phone, if it's as immutable as phone number, would be personal info for court, just as a phone number is. Dunno how it looks in jurisdictions where SE servers are located. – Mołot Jul 10 '13 at 9:02
  • Also, while No one under the age of 13 may provide any personal information to or on Stack Exchange (including, for example, a name, address, telephone number or email address). is clear, it doesn't stop Subscriber certifies to Stack Exchange that Subscriber is an individual (i.e., not a corporate entity) at least 13 years of age. from applying. – Manishearth Jul 10 '13 at 9:02
  • @Mołot this is why I said usually – raam86 Jul 10 '13 at 9:02
  • @raam And that is why I say debatable. – Manishearth Jul 10 '13 at 9:03
  • @Manishearth I am sorry I am not sure what you are referring to. – raam86 Jul 10 '13 at 9:03
  • To be concise, you're putting up something akin to a straw man here. I'm not talking about the line you have quoted, I am talking about the line preceding it. The line you quoted is in accordance with COPPA, and I don't see much of an issue with it. The line preceding it is possibly much, much stricter. – Manishearth Jul 10 '13 at 9:05
  • @Manishearth so your only question is who is considered a subscriber? – raam86 Jul 10 '13 at 9:07
  • That, and if readers are considered subscribers, then why is the policy stricter than COPPA? – Manishearth Jul 10 '13 at 9:08
  • @Manishearth ToS clearly states: any services provided on the Network, That must include reading. However the only clause regarding 13 year olds is that they can give out IIP and since IP isn't IIP they can read it. – raam86 Jul 10 '13 at 9:16
  • @raam86 Your information on IPs as PII is outdated, please see my answer. – Esoteric Screen Name Jul 10 '13 at 16:41
  • @EsotericScreenName Internet Protocol is only mentioned while defining what is internet[6] here coppa.org/coppa.htm term IP is never mentioned – raam86 Jul 10 '13 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .