Hiller helped organize and run a small focus group of parents more than a year ago to get preliminary feedback on new technology that she and other Virginia Tech researchers are developing to safeguard children’s online privacy.
Parental Online Consent for Kids' Electronic Transactions (POCKET): After parents set the privacy preferences, only their minimal involvement is needed.
The team of business and engineering faculty members won a $450,000 award in fall 2005 from the National Science Foundation’s Cyber Trust program to help fund their work.
Hiller, the team’s spokesperson, said the focus group discussions revealed that none of the parents were aware of any laws protecting children’s personal information online.
“None had ever been asked for permission by a website to obtain their children’s information or knew if merchants do anything to protect this information," Hiller said. "And no one knew exactly where to report fraudulent activity on the Web.”
Furthermore, while these parents said they have warned their children not to give out information online, she said, “they’re not sure the kids respect that.” Parents sought to control what their children viewed online, she said, by such means as “placing monitors in common rooms where they were in plain view and telling their kids that whatever sites they visited could be tracked — but some parents admitted to us they didn’t know how to do this.”
Hiller, who has a law degree, does research on legal and policy issues concerning the Internet and e-commerce, including privacy, security, and trust, and is co-author of Internet Law and Privacy, one of the first text books in this field. She grew more interested in children’s online privacy when she discovered that the subject had received scant scholarly attention.
Studies have shown that Internet use is widespread among children and adolescents. According to one report, 24 percent of 3-5-year-olds use the Internet when available at home, and 77 percent of children between 10 and 14 do so. The number of children who are Internet users is projected to have increased to 77 million in 2005, compared with 45 million in 2002.
Children use the Internet for casual Web surfing, Hiller said, as well as for games, schoolwork, e-mail, interactive learning, and other applications that often ask them to submit personal information such as name, street and e-mail address, and phone number.
“While kids today are adept at using computer technology, most are still very naïve about privacy protection,” Hiller said. “The promise of a small prize can easily convince them to share personal information.”
Because children aren’t sophisticated enough to protect themselves, she said, the key to protecting their privacy lies in parental consent to solicitation of information from a child. The Children’s Online Privacy Protection Act prohibits websites from collecting, using, or disclosing information from children under 13 without first obtaining “verifiable parental consent.”
Though the law has been in effect since 2000, and though many different privacy-enhancing technologies have been developed, a widely acceptable technical solution to the problem of obtaining and ensuring parental consent has yet to emerge, she said. “How do we know that parents have really given their consent?”
Hiller began discussing ideas for a research project to address the shortcomings of current technologies with various colleagues on campus. The conversations led to the formation of a team with expertise in technical, legal, social, and behavioral aspects of the issue. Besides Hiller, the other faculty members are Michael Hsiao, an associate professor of electrical and computer engineering who serves as the project’s principal investigator; France Belanger, associate professor of accounting and information systems; and Jung-Min Park, assistant professor of electrical and computer engineering.
The team, Hiller said, has developed a concept for technology to obtain verifiable parental consent that is reliable, easy to use, and cost effective and would serve the needs of children, parents, and website operators. The concept is is called POCKET — Parental Online Consent for Kids’ Electronic Transactions.
For more, read the full story in the Spring 2006 issue of Pamplin Magazine (PDF format), produced by the Pamplin College of Business.
Anonymizers are Web-based services that offer anonymous Web surfing by acting as an intermediary between the user and the website. Most anonymizers prevent the website from tracing the viewer’s IP address or placing cookies in the viewer’s computer.
Seals of Approval
Self-regulatory “seals of approval” have been designed to impart trustworthiness to sites. They generally comprise a standard agreement by a website to protect children’s privacy, the payment of a fee, routine audits, and an online dispute resolution
process. The website is allowed to post a children’s privacy seal to indicate that the site is compliant and certified.
P3P allows users to set privacy preferences for automatic implementation. It uses a machine readable, common vocabulary to identify privacy practices. Though P3P has some good attributes, it has been criticized for its failure to address many privacy problems. A recent study for the Federal Trade Commission that found an “unacceptably high” error rate for P3P implementation and out-of-date policies.
Look through previous Spotlight stories