# Security for underage users
**URL:** https://meta.discourse.org/t/security-for-underage-users/12783
**Category:** Feature
**Created:** [February 17, 2014, 10:48pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783 "2014-02-17T22:48:43Z")
**Posts on this page:** 17
**Page:** 1
### Author:  [@josiastobias](https://meta.discourse.org/u/josiastobias)
#### Post date: [February 17, 2014, 10:48pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/1 "2014-02-17T22:48:43Z")
I’m excited about your take on forums structure and organization of online communities.
I’m considering using it in the near future for an educational community for children, where children aged 6-17 would be the main users, perhaps a few thousand of them.
Naturally I worry about their online safety, and how Discourse could be used to an advantage over existing forums.
For simplicity considering an all-private discourse forum, what security features are there to keep dangerous people away? Such as requiring an approval or invitation from X number of people before signing in, or the absence of private messages all-around.
I know about the 4 levels of trust already, but this is not enough to protect children, I think.
Thanks
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [February 17, 2014, 11:03pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/2 "2014-02-17T23:03:42Z")
Firstly, IANAL. This is solely based on what I’ve heard and what I could find in the last n minutes.
If you’re doing anything with children under the age of 13, you need to read up on and comply with COPPA.
[http://www.coppa.org/](http://www.coppa.org/)
> **[Children's Online Privacy Protection Act](https://en.wikipedia.org/wiki/Children's_Online_Privacy_Protection_Act)**
>
> The Children's Online Privacy Protection Act of 1998 (COPPA) is a United States federal law. The act, effective April 21, 2000, applies to the online collection of personal information by persons or entities under U.S. jurisdiction about children under 13 years of age, including children outside the U.S. if the website or service is U.S.-based. It details what a website operator must include in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what respon...
From reading this page, here are some first steps: [Data And Online Security Trends - What's Hot In 2026](http://www.coppa.org/comply.htm)
- Make a custom Privacy Policy page at `/admin/site_contents/privacy_policy`
- Place it somewhere prominent with `/admin/site_contents/top` and CSS
- You also need to obtain ‘parental consent’. Consider making that part of your membership approval process. 
- Consider forgoing advertising and GA, as that will make compliance easier
I would also consult with a lawyer, as this stuff may be hard to get right.
* * *
> [@josiastobias](#):
>
> the absence of private messages all-around.
This is not feasible, the flagging dialogue automatically creates PMs.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [February 17, 2014, 11:22pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/3 "2014-02-17T23:22:44Z")
We did add a “agreed to the terms and conditions” checkbox to new signups for a customer. You would definitely want that here – @neil how can they turn it on?
---
### Author:  [@riking](https://meta.discourse.org/u/riking)
#### Post date: [February 17, 2014, 11:31pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/4 "2014-02-17T23:31:27Z")
> [@codinghorror](#):
>
> @neil how can they turn it on?
[http://forum.example.com/admin/site\_settings/category/legal](http://forum.example.com/admin/site_settings/category/legal)
---
### Author:  [@neil](https://meta.discourse.org/u/neil)
#### Post date: [February 19, 2014, 3:18pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/5 "2014-02-19T15:18:34Z")
What @riking said. `tos_accept_required` is one thing you’ll want to turn on.
Having some parents as moderators, or at least trusted members of the forum, could help too (unless it would stifle conversation to know that parents are reading everything). Education about flagging and how to spot suspicious activity can go a long way.
---
### Author:  [@quixoth22](https://meta.discourse.org/u/quixoth22)
#### Post date: [August 17, 2015, 10:34am UTC](https://meta.discourse.org/t/security-for-underage-users/12783/6 "2015-08-17T10:34:13Z")
Are there any updates on this issue?
Any new features?
Is it possible to block all private messaging among a certain class of users?
---
### Author:  [@geoff777](https://meta.discourse.org/u/geoff777)
#### Post date: [August 19, 2015, 12:35pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/7 "2015-08-19T12:35:03Z")
This would be really good.
Just messages to and from Admins and Mods.
One less thing to worry about if your forum’s a little wild and free to sign up.
I’m also very uncomfortable about the messages being read by admins. The topic was closed I wish it could be reopened.
A Boolean to salt and obfuscate?
---
### Author:  [@sdaugherty](https://meta.discourse.org/u/sdaugherty)
#### Post date: [August 19, 2015, 1:12pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/8 "2015-08-19T13:12:15Z")
As I understand it, mods, and definitely administrators have the means to view private messages between other users. Coupled with some sort of homegrown reporting tool using the API, it should at least be easy to monitor for suspicious activity, particularly if PMs are expected to be a rarity.
Making it clear that you are doing this, or have the ability to do this may very well be enough to make troublemakers reconsider.
---
### Author:  [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [August 20, 2015, 12:15am UTC](https://meta.discourse.org/t/security-for-underage-users/12783/9 "2015-08-20T00:15:13Z")
Mods can view flagged PMs only. Admins can view all PMs.
---
### Author:  [@b4oshany](https://meta.discourse.org/u/b4oshany)
#### Post date: [March 14, 2021, 4:53pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/10 "2021-03-14T16:53:01Z")
> [@neil](#):
>
> tos\_accept\_required
I’m not seeing this in my setup. I’m on version 2.7.0.beta5. How do I enable this?
---
### Author:  [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [March 14, 2021, 5:01pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/11 "2021-03-14T17:01:12Z")
Hi,
This isn’t a setting anymore AFAIK
You can create a user field for this by going to admin \> Customise \> User Fields
Result:
There is also a notice at the bottom reminding users about ToS and privacy etc.
---
### Author:  [@b4oshany](https://meta.discourse.org/u/b4oshany)
#### Post date: [March 14, 2021, 5:42pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/12 "2021-03-14T17:42:48Z")
> [@neil](#):
>
> tos\_accept\_required
Noted with many thanks.
---
### Author:  [@Lize\_Gibson](https://meta.discourse.org/u/Lize_Gibson)
#### Post date: [June 9, 2023, 9:14am UTC](https://meta.discourse.org/t/security-for-underage-users/12783/13 "2023-06-09T09:14:45Z")
Hello did you find an answer to this? We are looking at disabling private messages between our under 18s but still allowing our over 18s to privately message
---
### Author:  [@ondrej](https://meta.discourse.org/u/ondrej)
#### Post date: [June 9, 2023, 8:53pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/14 "2023-06-09T20:53:17Z")
At the moment unless anyone corrects me is to set U18 at TL1 for example. Set it so that TL1 cannot send messages and TL2 (over 18) will be able to send messages. However, people could lie. In [my example](https://meta.discourse.org/t/security-for-underage-users/12783/11), what’s stopping someone from just ticking a box?
I like tihe idea of allowing / disallowing PMs on an individual user level.
---
### Author:  [@nat](https://meta.discourse.org/u/nat)
#### Post date: [June 10, 2023, 2:38am UTC](https://meta.discourse.org/t/security-for-underage-users/12783/15 "2023-06-10T02:38:34Z")
Thanks to @martin a while back we introduced `personal message enabled groups` and `direct message enabled groups`. This should serve your purpose! You can create a “above-18” group and use it here.
---
### Author:  [@Kartoon](https://meta.discourse.org/u/Kartoon)
#### Post date: [June 12, 2023, 4:34pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/16 "2023-06-12T16:34:45Z")
> [@ondrej](#):
>
> However, people could lie. In [my example](https://meta.discourse.org/t/security-for-underage-users/12783/11), what’s stopping someone from just ticking a box?
The same thing that prevents them from literally any check at any level you’re doing from just saying “yea I’m 18”.
There’s literally nothing you can do to prove someone is a child that wouldn’t require an extraordinary amount of effort and be required to be utilized on every single person. Even that is simplistic to get around unless you utilize such a level of intrusiveness that no one is going to bother doing it for your webforum anyway.
Your only real options are be incredibly intrusive to the entire community (eg. we randomly check all private messages and block any references to outside communication) or trust people won’t lie and follow your environments in the ideal way
---
### Author:  [@chapoi](https://meta.discourse.org/u/chapoi)
#### Post date: [December 4, 2025, 11:09am UTC](https://meta.discourse.org/t/security-for-underage-users/12783/17 "2025-12-04T11:09:22Z")