What access to online accounts does your bank provide to minors? We are about to rollout Online banking and are unsure how to handle this. Our online system will give any enrolled user access to all accounts containing the user's TIN. I am thinking that relatives or guardians may have established deposit accounts for the benefit of children that they do not wish the child to see/access. Also, COPPA may limit or prevent online enrollment for minors.

We dont allow minors to have access to their accounts on-line. I dont know the reason, but I would guess that part of it is the potential for re-disclosure that a minor might make, either negligently or because s/he didnt understand the significance of keeping this information confidential.

Some states have specific laws that say, in effect, if you open a bank account for a minor, you are allowed to treat the mninor the way you can treat an adult. Because these laws were passed long before the Internet became accessible to children, you should examine the law in your state (if any) to see if the law makes sense when applied to a child's access to this type of information.

If you decide to allow such access for minors, you may want to draw a distinction for certain ages (eg under 7-no; 7-12 w/adult permission only; 13 and over-no parent consented reqrd, etc.). I woudl also consider an informational brochure for the minor and his/her parent that talks about the harm that can result from re-disclosure, identity theft and how something simple like leaving your computer on and leaving the room could expose confidential financial information to 3rd parties.

As you noted, COPPA is an issue if your Web site will be deemed to be directed to children or if you knowingly collect information from kids under 13.

On accounts set up under the Uniform Transfers to Minors Act ("UTMA"), only the adult custodian can transact business on the account, so your online access would need to be configured in such a way that the minor could not conduct transactions.

On non-UTMA accounts, you may also have issues relating to the ability of a minor to enter into a legally binding contract.

Even with guardianship accounts, where the minor is the "owner" of the funds, once again it is the guardian who is entitled to transact business -- not the minor owner.

On the other hand, if you have the ability to set up your system so that the minor could view the account without conducting transactions, you give the minor a powerful tool to monitor the activity of the custodian/guardian, which might help ensure the guardian or custodian is doing things the way they are supposed to.

I would think that the bank would always be construed as knowingly collecting information from children since we have the birthdate of account owners in oour CIF database. thus, we would be subject to COPPA by default.

Not quite so. Almost always the minor's DOB or other vital stats are provided by an adult -- presumably a guardian. In any event, COPPA is designed to protect kids from predators on the Internet. If you get the data from another source and not from the kid, you don't have a COPPA problem.

Generally, COPPA rears its protective head when a Web site has material directed to kids, or when it's likely a kid would be providing personal data on the 'Net. Some sites include child-oriented material, but don't collect personal data. Others have attempted to insulated themselves from COPPA by staying away from kid-oriented material, and including exclusionary language, such as "If you're a kid, don't give us any information," or something more politically correct along those lines.

I agree with you rexinaudit. If you have signed up a child for e-banking you have the vital stats, including age, and must assume that it's the same person when someone logs in using the assigned user code and password. ANY information collected during such a session would be subject to COPPA. The time for COPPA compliance is when you're signing the child up, not when you're ready to collect the information.

If I understand your point, John, I disagree that providing child-oriented content triggers COPPA. Instead, (a) the page must collect information, (b) you must know the user is a child, and (c) you must know the actual identity of the user.

Richard, as usual, has his facts correct. What I should have said is that attracting kids to your Web site with kid-oriented material could bring you under added COPPA scrutiny.

The time to prevent problems is, indeed, before getting that kid on the Web site. So make sure you know when you're dealing with kids, get appropriate parental permission before soliciting any personal info from kids on the 'Net, and generally make sure your KYC program extends to the Web site so you can make sure you're NOT in COPPA trouble.

Just to be clear, like many other regulations, COPPA has an intent and the capability to reach much further.

COPPA applies to:
1) Operators of commercial websites directed to children (under 13) who collect personal information.

2) Operators of general audience websites who have actual knowledge that they collect personal information from children.

We'll generally come under 2, above, as few banks market to kids over the Net, but this can happen. Someone wanting to play "dot the i and cross the t" could argue that your community links to the Teen Center attract kids, your "homework helper" links do too, as does your student checking and savings account product. If you have an application on your site or a feedback form, you may then be collecting protected information. And that puts you in hot water.

Hopefully nobody will get burned by this, but it can be a sleeper requirement for sure.

Although it's unlikely that a 12-year old will log on and apply for a loan, it's still a good idea to indicate age limits on all forms that gather individually identifyable information. Not only is it a good COPPA precaution, but who wants to waste the time generating adverse action notices for children?

I did a search on COPPA and found this thread. I would like to have clarification on a scenario.

Grandchild (owner) has an account at our bank. Grandma is an authorized signer on the account. Grandma is not the legal guardian. Grandma wants to sign up for online banking for the Grandchild. Is she able to do that with her access codes with the information on the account being the child's name and SS#? We would use Grandma's email address. No new information would be collected online that we had not previously collected when the account was opened in the bank. Do we have a COPPA problem with such a situation?

If you are gathering no new information, and are only making another means of accessing one's accounts available. I'd say that you are out of any COPPA requirements because of this.

If I am reading everything correctly about COPPA, if we have an enrollment form for Internet Banking, but we disclose that no one under the age of 13 can sign up for Internet Banking, then we should be covered considering COPPA?

Yes because you wouldn't be gathering info on those protected under COPPA.