Schneier on Security
A blog covering security and security technology.
« DARPA Cyber Colloquium |
| Journal Article on Cyberwar »
November 3, 2011
Underage Children on Facebook
Interesting research on how parents help their children lie about their age to get onto Facebook.
One reaction to our data might be that companies should not be allowed to restrict access to children on their sites. Unfortunately, getting the parental permission required by COPPA is technologically difficult, financially costly, and ethically problematic. Sites that target children take on this challenge, but often by excluding children whose parents lack resources to pay for the service, those who lack credit cards, and those who refuse to provide extra data about their children in order to offer permission. The situation is even more complicated for children who are in abusive households, have absentee parents, or regularly experience shifts in guardianship. General-purpose sites, including communication platforms like Gmail and Skype and social media services like Facebook and Twitter, generally prefer to avoid the social, technical, economic, and free speech complications involved.
While there is merit to thinking about how to strengthen parent permission structures, focusing on this obscures the issues that COPPA is intended to address: data privacy and online safety. COPPA predates the rise of social media. Its architects never imagined a world where people would share massive quantities of data as a central part of participation. It no longer makes sense to focus on how data are collected; we must instead question how those data are used. Furthermore, while children may be an especially vulnerable population, they are not the only vulnerable population. Most adults have little sense of how their data are being stored, shared, and sold.
COPPA is a well-intentioned piece of legislation with unintended consequences for parents, educators, and the public writ large. It has stifled innovation for sites focused on children and its implementations have made parenting more challenging. Our data clearly show that parents are concerned about privacy and online safety. Many want the government to help, but they don’t want solutions that unintentionally restrict their children’s access. Instead, they want guidance and recommendations to help them make informed decisions. Parents often want their children to learn how to be responsible digital citizens. Allowing them access is often the first step.
Here's the journal article. And some media coverage.
Posted on November 3, 2011 at 7:03 AM
• 29 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
There's one potential positive side effect: Children are directly being teached, from their first login on, that you can't trust the profile data of other users. Since even their own is fake...
I never saw the need to restrict my daughters when they were young - they had full Internet access with the warning that they might see "things which are not particularly nice". There was no Facebook then, but I would not have stopped them joining it. Now they are grown women, they seem still level-headed to me. One is a primary school teacher and the other works as a counsellor for a charity.
Why do 'other people' know what is best for our kids? Only parents know what they are ready for.
I love the title - are there any children not underage? Although, now that I think of it... ;-)
Sometimes I'm not sure parents know best.
In the US, yes. "Underage" in the context of this law just means less than 13.
Are we talking about changing the age restrictions for COPPA, or instituting some kind of free-for-all? There are a lot of 5 and 6-year-olds out there on the current kids' sites, and simply leaving everything to "parental supervision" isn't going to cut it.
(The passage in the article apparently pitying parents who don't have the money to get their kids online at COPPA-compliant social sites is also a bit disingenuous -- rather more parents might simply not see the value proposition in paying anywhere from $80-240 a year to send their kids to a virtual mall.)
This may be a difficult subject for some of us in the tech crowd to be unbiased about since social media is such a common part of many of our own lives and we tend to understand privacy and data aggregation better than the typical person. My own stepdaughter was given access to social media around age 11 or 12 and we did have all the (repeated) conversations about being cautious, only "friending" people she already knew from school, etc. She definitely understood the point, but children need responsible adults in their lives precisely because they are not yet fully responsible themselves. To make a long story short, there is a sexual predator currently serving a 10-year sentence for what I caught him doing online--and trying to do in person--with my stepdaughter (and other minors).
Looking back from the point you don't want to find yourself in (albeit a better place than it could have been), one thing I wish we had done differently is respect the general rule and push to get the message across that rules exist for a variety of reasons and apply to him or her equally. When dealing with your own child, it's easy to see that he or she is listening and believe he or she understands because you feel your child is ahead of the curve (and very well may be in many aspects). The fact remains that your child is still a child and will make mistakes. Whether we agree with them or not, the people setting these boundaries are trying to do so based on objective research as opposed to a subjective bias. Even though "only the parent can know what's best for a child," you are almost certainly biased toward your own. If you truly aren't, then you're probably satisfied with adhering to the age restriction.
Don't let one easily preventable mistake cause your child a lifetime of pain. Instead, respect the rules and leverage the opportunity to get the point across that rules exist for a reason and should either be respected or changed through peaceful reason; your responsibility to your child is to lead by example in that regard. That lesson could prove useful in later years when he or she wants to break other age restrictions (such as 18 or 21) before the time has come and your position may be more rigid on those rules.
Many people try to make the point that their child never ended up in a similar position but have never asked how many times he/she was carefully coerced into that type of situation. I've seen how amazingly high the numbers are for childhood sexual abuse, but I'd bet half of those children's parents still have no idea it happened. If it never was attempted, then you can't make the argument that your approach was the formula for success. Even if it was attempted and your child made the right responses at the time, could it have gone differently if your child was in a different mood or if the predator had more "experience?" Fortunately, there are millions more children than predators. That doesn't mean one won't target your child--it only reduces the odds.
Before any bashing begins on my stance or my child, my stepdaughter was and is still a great kid as well as responsible for her age level. She makes good grades in school (even her honors classes) and will be starting college in the fall. It was a simple mistake that was fueled by entrapment from a mind that had literally decades more experience than herself and possibly a decade or more of experience grooming and blackmailing minors. That man is off the Internet (and the streets) for now, but that's not true of all of them.
Parents know best? Please, that's the role of the government.
coppa got overturned a while ago.
Considering that I've actually met people who set up social network accounts for their infants/toddlers/dogs/cats/imaginary-friends, this doesn't surprise me. Although I suppose that's a non-issue, since in such cases the infants/toddlers/etc. aren't the ones maintaining the accounts.
Still, I wonder how many parents help their children access social media so they have a context for discussions about privacy and online presence, and how many just do it so their kids will stop whining about how Billy's mom let him have a Facebook account and got him an XBOX too and you're a lousy parent. It would have been interesting if the national survey had questioned parents about regularly having meaningful discussions with their kids regarding their online activities, as this seems to be the only value in violating the age restriction.
The main issue is treating children as state-owned property (not that adults are treated much differently) and regulating to the tiny bits what a child can, must not or have to do. (Google up recent EU regulation making balloons and party whistles restricted below specific age for a royal example of such attitude.) Parents have less and less to say.
@Chris: "the people setting these boundaries are trying to do so based on objective research"
Even if they did some valid research, even if they had set the legal limit at the exact middle of the bell curve (or the 98th percentile or whatever else they think applies statistically in particular case), it is still unscientific, unfair and violating the freedom of both parents and children. People (children even more than adults) do differ a lot. No legislator, official or "social worker" knows the child better than its parents. I am a father of three (and a godfather of another two) an I see how much children may differ in their various physical and mental abilities, in some cases about 40% age-wise.
There is a need for a few fixed age limits plainly to simplify things in the most general cases (like the ability to enter into legal contracts etc.), but this is going down and down to the absurdity. The more such absurd regulations the more people would ignore them - and effectively teach themselves and their children that ignoring the law is the way to go in everyday life, possibly making them ignore the really important limits just out of habit.
One example of what I personally had ignored - for a good reason - many many times: "this toy is unsuitable for children under 3 years". Most of the time, this appeared on a perfectly suitable toys like a very nice plush stuffed animal or a cardboard book. Heck, I am able to ascertain what's safe for this particular child by observing both the toy's structure and the child's behaviour while playing. On the other hand pretty many toys that did not bear this warning were visibly unsuitable (rough edges, for example) or appeared unsuitable when beeing actually used - in the latter case I had to take the toy from the kid and either throw it out completely or keep it until later. Yes, I had broken the "rules". Blame me.
If your kids did not grow up in the age of Facebook, then it is uncharted territory to you. You dont know the dangers, the addiciton, the toll it takes on a family as they drop all activities and everything, for Facebook activity.
I challenge you to set up your google alerts to read about the stories unfolding around Facebook, teens, tweens, parenting, hackers, predators, etc. Perhaps, only then, when you are well-informed, will you be able to understand what parenting in the world of Facebook might be like.
Due to the fact that facebook is nothing more than prostituting your social life in exchange for some IT service it makes sense that Facebook should be rated XXX and that Facebook should be prosecuted for boosting child prostitution if they do not take care that no child gets a Facbook account.
My daughters grew up with chatrooms of various kinds, and with street corners, public parks, cemetaries and all sorts of other 'dangerous' places. I trusted them to do the sensible things and spoke of dangers they might meet. They grew up taking some risks but I was always available to help when asked.
Facebook is no more dangerous than anything in the past.
If kids spend all their time on Facebook, hanging around on street corners, playing video games at all hours or whatever, then it is the parents who should do something about it.
I always refuse to be frightened, but I was always aware of the risks.
One key point that you seem to be missing is that no one is stopping you from teaching your child that it's OK to lie in order to get what he or she wants. You have every right to do so and others have every right to disagree with that approach. Such is the level of freedom you seek, and such is the freedom available to you. If Facebook discovers that your child lied about his or her age, the account will be disabled/deleted for breaking their rules/terms and they, in turn, also have every right to do so.
Considering the majority of adult Facebook users are not very privacy conscious, I have to question their ability to transfer that skill to their children. What's being regulated in this case is the age at which the government says it's OK for Facebook to openly start aggregating and mining users' personal data--not the age at which it's OK for you to allow it as a parent. They're saying "we know people reveal too much and you profit immensely from it, so don't take advantage of anyone until they are at least 13 years old." Breaking the rule on your end will not result in a prison sentence, having your rights as a parent revoked, or even a monetary fine. The same is true of a label on a toy stating that it's not intended for use by children under a certain age.
The fact that you "broke the rules" by allowing your child to play with unsafe toys and then took the toy away after you realized the label was correct only proves what you're missing: it's easy as a parent to be biased or to "rebel" and end up making a bad decision. Hopefully, you're able to recognize when it happens and change course before too much damage is done. In the toy scenario, it worked out for you and your child. In the Facebook scenario, it worked out for me and my child. That's not true for every case and, as Nicki stated, there are many unfortunate examples to back that up.
I don't believe saying "congratulations on getting lucky" would make for a good speech at either of our "father of the year" ceremonies. My situation made me realize just how easy it is for a person to take advantage of a child when they are thinking and behaving like a predator. My child's well being is more important to me than my own opportunity to learn from my mistakes--or even her opportunity to learn from her mistakes--so here I am standing by "the man's" decision and encouraging others to do the same in this case. I don't want anyone's rights as a parent to be overruled, but I do want their responsibilities as a parent to be overachieved. To err on the side of safety is not an error at all.
I tell people that if it's in the news, don't worry about it. The very definition of "news" is "something that hardly ever happens." It's when something isn't in the news, when it's so common that it's no longer news -- car crashes, domestic violence -- that you should start worrying.
Source: https://www.schneier.com/essay-171.html (Bruce Schneier, May 17, 2007)
My children are growing up in the age of Facebook. I'd rather teach them how to mitigate or reduce risks than have them do pretty much the same things behind my back, and be unable to do so.
A consequence (and I contend privacy-related advantage) of signing up for FaceBook before (or after) a person’s 13th birthday is obfuscating the date when they actually turn 13, hence their actual age and date of birth.
So here's the key question: why does anyone (facebook included) deserve the truth?
One of the reasons I'm interested in Bruce's book on trust is too see how he handles this question. Because there many people who would argue that the truth/honesty is overrated as a commodity.
People have been lying about their ages long before FB came along. When I grew up asking a woman her age was an invitation to get slapped. So my response to people who whine and say that lying on FB teaches kids to lie is, so what; why is that a "bad thing". There certainly is an argument that teaching kids to lie is a good thing.
Wouldn't it be safer for the children and better for society if nobody OVER 18 was allowed on facebook?
I have to argue with "To err on the side of safety is not an error at all." It is much more complicated than that.
We don't want our children wrapped in cotton wool for all of their young lives - they must be allowed to take some risks or they will be totally unsuitable for life. If, for example, they want to climb mountains, you ultimately have to allow that, starting on the gentler climbs, of course. And you must offer proper encouragement and support or you will lose them for life.
Children need to be set free, to explore the dangerous paths of life in their own time. They must find their own limits and lines drawn by age are always wrong for some kids - wrong in both directions.
If children approaching teen age have no reasonable idea of life's dangers then something is wrong, and it is usually the parenting which is wrong.
@Chris: you wrote @Andrew but from the text its evident you've commented my post - no problem, but still another comment to your comment.
You wrote: "allowing your child to play with unsafe toys and then took the toy away after you realized the label was correct"
Please read my post carefully again. The labels were NOT correct in both cases described. There's a difference between unsafe toys and toys marked as such - those two sets are much disjoint. I know well why the toys very often get marked unsafe despite beeing perfectly safe - it's either the maker's CYA tactic (often resulting form an absurd legal regulations) or just avoidance of time and cost needed to legally certify the product as safe. Makers know most people quite reasonably would ignore the marking when seeing the toy is obviously safe (like my previous examples of a very nicely manufactured plush animal or a cardboard children's book) and buy it anyway, so why care?
On the other hand some makers mark their products as safe even if they are not-so-safe - sometimes by design, sometimes because of systematic (not accidential, but missed by quality control) manufacturing defects resulting from costs cutting. Also, safety often depends on the way the object is used. One real life example: a typical "plug a hole" toy was marked safe for children under three years old - but seeing that my then less-than-three girl prefers to plug her own mouthhole instead and is near-succesful in the task - I had to take it from her until she took more interest in the proper play. Apparently the maker of this toy underestimated the size of a 3-yo child's mouth. If I had blindly believed the safety markings who are you would be going to blame?
This is why I keep saying: parents know better, and have a better incentive for keeping their offspring safe and healthy than a random business or lawmaker.
The effect of the current business practices desribed above is that "unsafe for less than 3" toy mark is completely unreliable. Sticking to it because "that's the rule" or because "wiser people said so" (they aren't wiser really just lazy or greedy) is absurd.
@Chris: "to err on the side of safety is not an error at all."
It may well be - depending on the magnitude of the error. Are you going to wear a helmet and body armor every time you go out for a walk in the street? You're erring on the safe side, aren't you?
@Andrew Gumbrell: "Children need to be set free, to explore the dangerous paths of life in their own time. They must find their own limits and lines drawn by age are always wrong for some kids - wrong in both directions."
Well said. You did express in just a few words what I was trying to imply in so many. Thanks. I would only substitute one word: "most" not "some".
"Children need to be set free, to explore the dangerous paths of life in their own time. They must find their own limits and lines drawn by age are always wrong for some kids - wrong in both directions."
I'm not sure "free" is quite the right word here.
And one of the problems of modern life (in some ways at least) is that "gentler climbs" are not always available, or perhaps that our savannah-honed intuitions are not good for recognizing when a climb is gentle and when that bend in the gentle path leads to a cliff overhung by loose rocks. (Or, on the other hand, for recognizing when that ostensible cliff is only a few meters high and has a pile of hay at the bottom.)
@Peter: Yes, I was mostly replying to you. I skimmed up for your name after writing and grabbed the wrong one.
This is the part that was confusing about the toys: "Yes, I had broken the "rules". Blame me." What's to blame you for if there were no instances of being wrong? It's a moot point, really, because it's a poor comparison to the topic at hand. I don't believe a rebellion against suggested ages on toddler toys is even a remotely good analogy for this discussion. Your toddler is not learning by example as you pick and choose what toy labels to adhere to from a variety of manufacturers all around the globe while the toys are exclusively used in your home and frequently if not mostly under your supervision. A better analogy would be securing a fake ID so you can take your 16-year-old to bars and clubs with you and then letting her keep it so she can go on her own after you've "shown her the right way to behave among drunk 20-somethings."
I can't look at the stance you're taking and say "you're completely wrong" because we seem to be on much the same page when we don't go into the details or get off track. The point you seem to be heavily emphasizing is this: "parents know better, and have a better incentive for keeping their offspring safe and healthy than a random business or lawmaker." We've established that no one is trying to legislate away your right to be the decider in your role as parent, so I'll reiterate the portions I agree with and focus on the parts I do not.
I never disputed that a parent knows what's best for their child and should be able to choose how to parent. In fact, I directly and explicitly stated that to be the case. It's a foolish person that does not listen to the experiences and insights of others, though. If your toddler was regularly pitching temper tantrums and your mother said "you did that as a kid and I found that ignoring you made it stop," would you say "I know what's best for my kid, so you need to stay out of it"? If a close friend saw the same tantrums and said "I read that kids low on were fussy and irritable," would you consider that your child's health may be at risk or would you say "my kids aren't like other kids--this one just needs discipline"? If you saw on the news that teenage girls did not develop good depth perception until after age 18 and it was the likely cause of most 16- and 17-year-olds' fatal car accidents, would you say "my daughter is better than those kids--she's clearly 'mature' for her age"? How many degrees of separation are required before facts and recommendations stop applying to you and your children?
I'm not saying that any "general rule" should always overrule your instincts, but I am saying that a responsible parent will take expert guidance as well as input from others into consideration. The more risk is involved, the more data is available, or the more expert the source (in this sense, close to subjects such as childhood development, social networking, or sexual predators), the more weight should be given to their conclusions even if (especially if?) it conflicts with your instincts. That does not mean it should overrule you, but that you need to be wise enough to recognize when you could be overlooking something critical. Being "the parent" does not make you an expert on any specific topic other than the portion of your child's history that he or she allowed you to know about.
I also never disputed that children will grow up or that they need to learn to face dangers in their lives. I'm not a Facebook user and never have been, so maybe I'm not biased enough on how important it is to help a child become a "me too" at an age younger than the site itself explicitly requires. The initial decision to allow it in our case was not mine; I was overruled by her mother, stepmother, and father. Is helping preteens get on Facebook against their rules really so important as to teach them that it's OK to lie to get what they want? Is that really the example you want to set for your children just so you have the opportunity to teach them an unrelated lesson that can easily wait until they're older?
Your child is not outside your care, guidance, or mentoring once he or she reaches the ripe old age of 13. There's still plenty of time to teach your children how to be responsible sharers of their personal data, how to mitigate or reduce risks, etc. between the ages of 13 and 18 (and beyond since parenting doesn't end when "experts" or "the government" says your child is an adult, either). As I stated before, the majority of adult Facebook users are not very privacy conscious and, as a result, are unlikely to be well suited for teaching that skill to their own children. It's a prime example of a parent's instinct leaving something to yearn for. If you are privacy conscious and well suited for training your teenager to be the same, that's great. Is it a critical skill for your preteen? Only if you're already allowing/encouraging him or her to share their personal data.
I realize you might make the decision that it's OK in your child's case, but I would ask that you not publicize the idea that it's a good decision for the general public. It simply isn't, and trying to change the subject to "you should have the right" (when you already do) leads many people to lose sight of the fact that the dangers are real or that it could very well happen to their kids. If you don't believe the dangers are there, you're mistaken. If you believe it happens to other children but not yours because you're a better parent, then take the high road and continue to encourage "the sheeple" to do the right thing by waiting.
The fact is that bad things still happen to kids that were given the best of parenting, and by definition everyone cannot be the best of parents. We do have to look out for one another as part of the village, and my message to the other villagers is that "privacy and data management lessons" really can wait until the teenage years. Look at the types of parents around us and realize that many of those people are statistically speaking part of the majority of parents that admit to helping their children lie to get into the danger zone. If you recognize that many if not most of those parents should probably respect Facebook's rules, then man up and say it while keeping quiet that you break the rules because you're better than them.
For anyone that wants to teach their children that they do not have to reveal their true personal data, that's a completely different subject and does not apply to the "it's against the rules, so let's lie about you being 13 so you can do it anyway" topic. Lying to say you're 14 when you're really 13 or saying you were born in July instead of May because you feel Facebook collects too much personal information and abuses your trust is a different topic.
Have you considered the possibility that your exceptionally strong belief regarding this subject is the result of the vividness of your step-daughter's experience?
Do my observations and experiences influence my beliefs and opinions? Of course. Logic and reason also influence my beliefs and opinions. I've yet to see anyone produce a logical argument against respecting a company's plainly stated agreement for "doing business" with them OR for teaching their children that it's acceptable to lie about their age (or anything else) to get what they want. To answer your specific question, though, my stepdaughter's experience did not alter my belief about this subject:
"The initial decision to allow it in our case was not mine; I was overruled by her mother, stepmother, and father."
I have not disputed any of the reasonable points anyone has made here including parental rights (though I focus more on parental responsibilities), the necessity to teach children about privacy and data management, and the fact that dangers should and will be faced as part of children growing up and throughout their adult lives. I realize some have twisted my words by applying them to unrelated extreme situations such as wearing "a helmet and body armor" to walk outdoors, but I have tried to stay on topic and my statements apply directly to what's being discussed here. It seems I've spent more effort showing that I recognize, acknowledge, respect, and agree with other people's unrelated points than showing that they have yet to address my point at all.
If it was not clear, my point is that leading by example is a critical part of every parent's responsibility and showing them that you believe it's acceptable to lie to get what they want with the result of placing them in a potentially dangerous situation is irresponsible in addition to counterproductive. I thought that was logical even before our own experience and I could have made the point without referencing our experience at all, but I tossed it in as yet another example that "it really does happen and could even happen to your child." I apologize if that reference served as a distraction from the point.
I don't believe there's some magical age at which all children become adults or "ready" for swimming with sharks in the social networking pool, but I do believe that a parent's bias toward their own child's "readiness" as well as their desire to make their child happy frequently influence their decisions in a subjective manner. I'm also not biased by our circumstances to believe a predator will target every preteen that uses Facebook (again, directly stated in a prior post). I do believe that saying "there are dangers there and Facebook says you have to be 13, but we're going to lie so that you can do it anyway" does not send the message that one fully appreciates those dangers or that rules and honesty are respected in your home.
I do appreciate the discussion, but I think I've invested too much time beating this horse to death without getting a reason-based rebuttal on what I'm actually trying to convey. Again, that could be my fault for being so verbose, not being specific enough, or letting irrelevant topics distract from the point. I'll step out of it, let others have "the last word" (as long as no one specifically requests a reply from me), and consider their opinions as I always do. However, I would also like to hear from others that agree with what I'm saying if they're out there. Yes, I saw the stats from the referenced study and was shown that I was in the minority years beforehand. How much of a minority am I really in here?
Schneier.com is a personal website. Opinions expressed are not necessarily those of Co3 Systems, Inc..