A federal law designed to protect children's privacy may unwittingly lead them to reveal too much on Facebook, a provocative new academic study shows, in the latest example of how difficult it is to regulate the digital lives of minors.
Facebook prohibits children under 13 from signing up for a Facebook account, because of the Children's Online Privacy Protection Act, or COPPA, which requires Web companies to obtain parental consent before collecting personal data on children under 13. To get around the ban, children often lie about their age. Parents sometimes help them lie - and in order to keep an eye on what they post, become their Facebook friends. Consumer Reports earlier this year estimated that Facebook has more than 5 million children under age 13.
That relatively innocuous family secret that allows a preteen to get on Facebook can have potentially serious consequences, including for their peers who do not lie. The study, conducted by computer scienti sts at the Polytechnic Institute of New York University, finds that in a given high school, a small share of students who lie about their age in order to get a Facebook account can help a complete stranger collect sensitive information about a majority of their fellow students.
In other words, children who deceive can endanger the privacy of those who don't.
The latest research is part of a growing body of work that highlights the paradox of enforcing children's privacy by law. For instance, a study jointly authored by academics at three separate universities and Microsoft Research earlier this year found that even though parents were concerned about their children's digital footprints, they had helped them circumvent Facebook's terms of service by entering a false date of birth. Many parents seemed to be unaware of Facebook's minimum age requirement; they thought it was a recommendation, akin to a PG-13 movie rating.
“Our findings show that parents are i ndeed concerned about privacy and online safety issues, but they also show that they may not understand the risks that children face or how their data are used,†that paper concluded.
Facebook, for its part, has long said that it is difficult to ferret out every deceptive teenager and pointed to its extra precautions for minors. For children between ages 13 and 18, only their Facebook friends can see their posts, including photos.
That system, though, is compromised if a child lies about her age when she signs up for Facebook â€" and thus becomes an adult much sooner on the social network than in real life, according to the experiment by N.Y.U. researchers.
The key to the experiment, explained Keith W. Ross, a computer science professor at N.Y.U. and one of the co-authors of the study, was to first find known current students at a particular high school. A child could be found, for instance, if she was 10 years old and said she was 13 in order to sign up for Facebook. Five years later, that same child would show up as 18 years old â€" an adult, in the eyes of Facebook - when in fact she was only 15. At that point, a stranger could also see a list of her friends.
The researchers conducted their experiment at three separate high schools. They were able to construct the Facebook identities of most of the schools' current students, including their names, gender, profile pictures and other data.
The researchers identified neither the schools nor any of the students. Their paper is awaiting publication.
Using a publicly available database of registered voters, someone could also match the children's last names with their parents' - and potentially, their home addresses, Prof. Ross pointed out.
The COPPA law, he argued, seemed to serve as an incentive for children to lie, but made it no less difficult to verify their real age.
“In a COPPA-less world, most kids would be honest about their age when cr eating accounts. They would then be treated as minors until they're actually 18,†he said. “We show that in a COPPA-less world, the attacker finds far fewer students, and for the students he finds, the profiles have very little information.â€
How children behave online is one of the most vexing issues for parents, to say nothing of regulators and lawmakers who say they wish to protect children from the data they scatter online.
Independent surveys suggest that parents are worried about how their children's social network posts can harm them in the future. A Pew Internet Center study earlier this month showed that most parents are not just concerned, but many are actively trying to help their kids manage the privacy of their digital data; over half of all parents said they talked to their children about something they posted.
Teenagers seem to be vigilant, in their own way, about controlling who sees what on the Facebook pages.
A separate study b y the Family Online Safety Institute and released in November found that four out of five teenagers have adjusted privacy settings on their social networking accounts, including Facebook, while two-thirds place restrictions on who can see which of their posts.
