Permission for bypassing validation and usage of COPPA

I say we should expand on this patch to support COPPA rather than committing as is.

From my experiences the site should simply send out an email to the specified email address requesting that they get their parents to "fill out this form" and mail/scan-email it back in. The administrator receives the signed doc and enables their account manually.

That is a very basic implementation, so really all that I would say is missing is a COPPA email/template to send out and the option to leave non-verified accounts as inactive until verified via COPPA.

As far as the existing COPPA module is concerned, yes I agree it seems a bit overkill and difficult to manage IMO. I like the subuser module, it is kind of like 'U Create' module provided with Open Atrium, however I think maybe it is not necessary for this. Wouldn't really want to make it a requirement truthfully.

However, I think as a submodule of this module (validateage_coppa, maybe) we could enable very basic coppa support and really dive into some of the more in depth ideas there. Perhaps extend our submodule a bit if, and only if, the subuser module is installed too. Same for other modules that could aid in coppa support, but minimally provide basic coppa support (email) without requirements of any other modules.

Some interesting ideas. I don't have much time to write about my opinion on it now, but will come back and discuss tomorrow. I do want to mention that we should look over the coppa compliance info:
http://www.coppa.org/comply.htm

I reviewed some of our ideas, the coppa module and the details in the compliance link above. After really thinking about it, I think our own solution is best overall.

The main issue bridging to the coppa module is that It already provides a way of collecting date of birth, which we are doing in this module and it would most likely conflict within the UI of collection. There are also other issues I see with the ways it does it's verification, things that I don't see as exactly complying with the guidelines of coppa.

Things a compliant coppa module would need to consider:

1. A public notice on the site that would show the following:
   • Listing the contact information (address, telephone number and email address) for all administrators who will be handling the child's information.
   • Additionally listing all admins who cooperate on the site but don't handle the privacy policy or child's information.
   • Information about the child collected by the site (ex: name, address, email address, hobbies, etc.) and how the information is collected -- directly from the child or passively, say, through cookies.
   • How the site will use the child's personal information.
   • Whether information is disclosed to third parties or not. If so, list the kinds of businesses in which the third parties are engaged and whether the parties have agreed to confidentiality of the info.
   • Telling the parent they are not required to allow disclosure to third parties.
   • The operator(s) will not require more info than is reasonably necessary to participate on the site.
   • The parent can review the info provided to the site and request deletion at any time. Provide instructions to do so.
2. An official notice sent to the parent by email explaining that the site wishes to collect information from the child. It should be clear, concise and include no unrelated information. This notice would provide instructions on verifying the parents consent to use the site. One of the following options would need to be enabled by the site:
   • Email (or upload to the site) of a scanned copy of a printed/filled out/signed copy of the consent
   • Postal or Facsimile of the above
   • Phone call to toll free number manned by trained reps
3. IMPORTANT, The site must not collect personal information before verifying the user's age. Current implementation will do so by placing the date of birth field on the registration page which may require other personal information. We would need to move date of birth to an interstitial page before the registration page to accomplish this. Requested registration information would then need to be altered based on a user's age.
4. Option to notify Parents of changes to the use of information or the information required and send a new notice of consent.
5. Create a system for parents to login and review their child's shared information and request deletion of the info or delete the account entirely.
6. Lastly, consideration of better handling of the date of birth and calculation of age. Removing children from coppa users once they reach the age of 13. The current implementation does not necessarily handle this well. I have written a hook_cron() in another module on my site that updates all users' age once a day. Perhaps some patches to the birthday module to offer cck support and other fixes then making it a requirement would fix this.

I know this is a lot to think about, but I personally think that good COPPA support is currently missing from Drupal. The aforementioned COPPA module does make a valid attempt, but the usage and implementation leaves something to be desired.

Validateage module seems like an very appropriate place to add COPPA support. Once we can come together and decide on a good system we can start coding, but the plan needs to be there first.

I am not completely sure what direction we should take in implementing this. We should decide on a path to taken before going further since this will require considerable work.

Added the above patch to the module: http://drupal.org/cvs?commit=471598

Lets keep this open for discussion of coppa in the future.