# Security for underage users

**URL:** <https://meta.discourse.org/t/security-for-underage-users/12783>\
**Category:** Feature\
**Created:** [February 17, 2014, 10:48pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783 "2014-02-17T22:48:43Z")\
**Posts on this page:** 1\
**Showing post:** 2

<div class="post-metadata">

**Author:** ![riking](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/riking/32/170938_2.png) [@riking](https://meta.discourse.org/u/riking)\
**Post date:** [February 17, 2014, 11:03pm UTC](https://meta.discourse.org/t/security-for-underage-users/12783/2 "2014-02-17T23:03:42Z")

</div>

Firstly, IANAL. This is solely based on what I’ve heard and what I could find in the last n minutes.

If you’re doing anything with children under the age of 13, you need to read up on and comply with COPPA.

[http://www.coppa.org/](http://www.coppa.org/)

> **[Children's Online Privacy Protection Act](https://en.wikipedia.org/wiki/Children's_Online_Privacy_Protection_Act)**
>
> The Children's Online Privacy Protection Act of 1998 (COPPA) is a United States federal law. The act, effective April 21, 2000, applies to the online collection of personal information by persons or entities under U.S. jurisdiction about children under 13 years of age, including children outside the U.S. if the website or service is U.S.-based. It details what a website operator must include in a privacy policy, when and how to seek verifiable consent from a parent or guardian, and what respon...

From reading this page, here are some first steps: [Data And Online Security Trends - What's Hot In 2026](http://www.coppa.org/comply.htm)

- Make a custom Privacy Policy page at `/admin/site_contents/privacy_policy`
- Place it somewhere prominent with `/admin/site_contents/top` and CSS
- You also need to obtain ‘parental consent’. Consider making that part of your membership approval process. ![](https://global.discourse-cdn.com/meta/original/2X/c/c30ec4e4fd929233eda87ac2c629d570826264b0.png)
- Consider forgoing advertising and GA, as that will make compliance easier

I would also consult with a lawyer, as this stuff may be hard to get right.

* * *

> [@josiastobias](#):
>
> the absence of private messages all-around.

This is not feasible, the flagging dialogue automatically creates PMs.

---

_[View the full topic](https://meta.discourse.org/t/security-for-underage-users/12783)._