In the United States, commercial Web sites must provide clear notice of their information gathering practices and obtain prior parental consent when eliciting personal information from children under 13. This is not a voluntary code -- it's the law.

According to COPPA, Web site operators must:  

Post their privacy policy.

Web sites directed to children or that knowingly collect information from kids under 13 must post a notice of their information collection practices that includes:

• types of personal information they collect from kids - for example, name, home address, email address or hobbies.
  
  
• how the site will use the information - for example, to market to the child who supplied the information, to notify contest winners or to make the information available through a child's participation in a chat room.
  
  
• whether personal information is forwarded to advertisers or other third parties.
  
  
• a contact at the site.

Get parental consent.

In many cases, a site must obtain parental consent before collecting, using or disclosing personal information about a child.

Consent is not required when a site is collecting an email address to:

• respond to a one-time request from the child.
  
  
• provide notice to the parent.
  
  
• ensure the safety of the child or the site.
  
  
• send a newsletter or other information on a regular basis as long as the site notifies a parent and gives them a chance to say no to the arrangement.

Get new consent when information practices change in a "material" way. 

Web site operators need to notify parents and get consent again if they plan to change the kinds of information they collect, change how they use the information or offer the information to new and different third parties. 

Allow parents to review personal information collected from their children. 

To do this, Web site operators must verify the identity of the requesting parent.

Allow parents to revoke their consent, and delete information collected from their children at the parents' request. 

Parents can revoke their consent and ask that information about their children be deleted from the site's database. When a parent revokes consent, the web site must stop collecting, using or disclosing information from that child. The site may end a child's participation in an activity if the information it collected was necessary for participation in the Web site's activity.