Researchers developing technology to protect children's online privacy

Parents concerned about safeguarding their children's online privacy can look forward to better and user-friendlier technology for doing this. The technology is being developed by a Virginia Tech team of business and engineering researchers who won a $450,000 award for their work from the National Science Foundation's Cyber Trust program.

Millions of children use the Internet every day, said Janine Hiller, professor of business law and spokesperson for the research team, which includes Michael Hsiao, an associate professor of electrical and computer engineering and the project's principal investigator; France Belanger, associate professor of accounting and information systems; and Jung-Min Park, assistant professor of electrical and computer engineering.

Children use the Internet for casual web surfing, Hiller said, as well as for games, interactive learning, and other applications that often ask them to submit personal information about themselves. "While kids today are adept at using computer technology, most are still very naпve about privacy protection. The promise of a small prize can easily convince them to share personal information."

Because children aren't sophisticated enough to protect themselves, she said, the key to protecting their privacy lies in parental consent to solicitation of information from a child. The Children's Online Privacy Protection Act prohibits web sites from collecting, using, or disclosing information from children under 13 without first obtaining "verifiable parental consent."

Though the law has been in effect since 2000, and though many different privacy-enhancing technologies have been developed, a widely acceptable technical solution to the problem of obtaining and ensuring parental consent has yet to emerge, she said. "How do we know that parents have really given their consent?"

The team has developed a concept for technology to obtain verifiable parental consent that is reliable, easy to use, and cost effective and would serve the needs of children, parents, and website operators, Hiller said. The concept is called POCKET -- Parental Online Consent for Kids' Electronic Transactions. POCKET is designed to enable the parent to protect the child's personal information during an online transaction without the parent's direct supervision. In addition to the parent and the web operator or merchant, POCKET uses the services of a trusted third party server.

The concept offers three major advantages over current technologies. For starters, a parent can establish a customized, "fine-grained" disclosure policy to protect the child's information -- "flexibility that exceeds what is currently available in other technologies," Hiller said. The system also enforces the accountability of the merchant in handling the child's information through the contract and log files that are generated during the transaction. "While the law requiring parental consent applies whether or not there is a contract," she said, "a contract is an additional reassurance."

Lastly, the system is user friendly, which enhances its potential for wide adoption. "After the parent has created the privacy preferences, only minimal participation from him or her is required, while no involvement of the child is needed."

The NSF grant, Hiller said, will enable the researchers to build a prototype and test and verify its effectiveness. The team's work will include an investigation of adoption barriers to privacy enhancing technologies and a further study of what parents know and how they feel about online information sharing by children. In addition to parents, the researchers will seek input from website owners through surveys and focus groups.

The Virginia Tech team's multidisciplinary expertise in computer engineering, law, and information systems, she added, underscores the multifaceted nature of the challenge of protecting children's online privacy. "For a solution to be truly successful, all its elements -- including social, legal, and technological -- must be addressed."

Source: Virginia Tech