Subject: Responses to questions about the new IETF privacy statement

From: "John R Levine" <[email-masked]>
Date: 19 Oct 2017 18:08:28 -0400

The IAOC published a new privacy statement last month, which is now available at
https://iaoc.ietf.org/documents/IETFPrivacyStatement2017-07-12.pdf

We got a few questions on the draft version.

Some questions were about criminal subpoenas.  In the entire history of 
the IETF, we have received only one criminal subpoena, as opposed to the 
many civil subpoenas and requests we get for document authentication. 
The policy has language saying that we will respond if required, in the 
unlikely event that we get another criminal subpoena.

There were also questions about the section about children.  We do not 
want to be subject to COPPA, a US law which has detailed rules for sites 
intended for children. The COPPA record keeping requirements are so 
onerous that it would not be practical for us to try to implement them. 
COPPA is only about personally identifiable information, hence anyone of 
any age can look at anything, but we won't knowingly let children under 13 
do things that provide PII, such as sign up to mailing lists or a 
datatracker account. Our COPPA language is similar to that on most other 
interactive web sites not targeted at children.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 20 Oct 2017 17:00:45 +0100

Hi John,

> We got a few questions on the draft version.

You mean the draft from a year and a half ago I guess? The
process of responding to comments on that was far from ideal
IMO. I guess we ought consider that kind of process issue
in the iasa2 discussions, so don't need to revisit that now.

I still have comments on this version FWIW.

A diff would have been good. Apologies if I'm commenting
on text that didn't change.

- "These mailing lists are clearly indicated as non-public
in their registration materials." I'm not sure that's true.

- "The parties may also share some Personal Data with the
Internet Society so that it can fulfill its role of ensuring
financial support for the Parties by exploring sponsorship
or hosting possibilities." Huh? What information is "shared"
like that?

- Cloudflare: I couldn't see any privacy link at the URL
given (https://www.cloudflare.com/). (Note: I use noscript
so it could be in some JS stuff I didn't run.)

- Cloudflare: what in fact do Cloudflare record/track about
IETF web site visitors?

- "Our websites are not intended for use by children under
13 years old." That's still wrong. If it said "not specifically
designed for" or "not targeted at" that'd be ok. Yes, you
might come back to me and say "COPPA" but IMO that's not a
good answer to a comment that the quoted sentence is untrue.
It is untrue because we do not take any action to prevent
under-13's from using the web site which is how I'd interpret
"not intended for" - that's perhaps a US-English issue, not
sure.

S.

---

From: Randy Bush <[email-masked]>
Date: Fri, 20 Oct 2017 09:44:33 -0700

> "not intended for" - that's perhaps a US-English issue, not

i think it would be wonderful if we had constructive participation from
the real under 13 set.

randy

---

From: Brian E Carpenter <[email-masked]>
Date: Sat, 21 Oct 2017 08:16:03 +1300

On 21/10/2017 05:00, Stephen Farrell wrote:
...
> "not intended for" - that's perhaps a US-English issue, not

I disagree. To me, "intended" describes a state of mind. The site
is not intended for dogs either, and we do not take any action to
prevent dogs using the site. 

Some stylists would object to the passive tense. I don't know if
there would be any legal issues in writing "The IETF does not
intend..." but that would make it even clearer IMHO.

(Also, what would we do if we discovered that a particularly 
bright new contributor turned out to be a 12 year-old child
genius? Nothing, I hope.)

    Brian

---

From: Randy Bush <[email-masked]>
Date: Fri, 20 Oct 2017 12:29:48 -0700

> genius? Nothing, I hope.)

i might ask if there was anything i/we could do to help

---

From: "Scott O. Bradner" <[email-masked]>
Date: Fri, 20 Oct 2017 16:00:02 -0400

as has been noted - the US has a rather strict law concerning collecting personal info (e.g. email addresses) (COPPA)
from persons under 13 - by law a parent’s specific permission is required before collecting such info

it would be great if people could figure out how enable such 12 year olds (or younger) to participate while  complying with the law 

maybe its as simple as adding a “parent’s permission required for people under 13 - click here for more info” 
but it would be good if one or more lawyers who understand US law to bless an approach

violations can get harsh - see
https://www.ftc.gov/news-events/press-releases/2011/05/operators-online-virtual-worlds-pay-3-million-settle-ftc-charges

Scott

> On Oct 20, 2017, at 3:29 PM, Randy Bush <[email-masked]> wrote:
>

---

From: [email-masked] (Martin Rex)
Date: Fri, 20 Oct 2017 22:55:03 +0200 (CEST)

> "not intended for" - that's perhaps a US-English issue, not

There might be another aspect for "under-age" (under 18 in Germany):

The Note Well does not apply to (contributions of) folks under 18
in Germany without the consent of their parents.

-Martin