4

This is a long reading, but it is a challenging concept so I have to explain the process.

My company builds apps and sites specialised for kids under 13. According the COPPA legislation every kid under 13 need their parent's permission in order to communicate sensible informations. (Some of our apps have physical prizes and welcome packs that requires mailing addresses )

Every kid under 13 year have to communicate their parent's mail address in order to finish the registration process.

Parents receives a mail about their kids signup on our platform and invited to monitor their kid's activity on our parent portal, where they can see and modify or deny the kid's personal information.

Obviously parents have to identify them self as adults/ guardians by using our ID verification which is a Credit Card verification at the moment.

The issue is the friction is huge as they have to pay bank fee of 0.50 cents (we give this fee to the charities) and also have to communicate their banking information to a new website they just got mail from.

We know there are other verification options like, live id verification but I dont know this will cause more or less friction to the user.

Another option is verify by calling them, which cost us 0.50cents per successful identification and this solution wont scale very well.

What do you think is the best option(s) here ?

Happy to hear all ideas

PS 1 : %50 of parents signed up using mobile phone

PS 2 : adding an infographics that explain the whole flow enter image description here

  • I assume this only has to work in the US? If I understand the question correctly, there are two verifications necessary: 1. Is the alleged parent an adult? (Ignoring teenage parents for now.) 2. Is the kid signing up actually in their custody? – Crissov Feb 17 '16 at 13:01
  • Indeed, it works in the US but the laws will be adopted in europe in late 2016. 1) Yes we have to verify if the person is adult 2) No we dont need the proof that user is in their custody – Deniz Erdal Feb 17 '16 at 14:13
  • Couldn't you, instead of charging $0.50, reserve (i don't know exact term) some amount and then release it? – el.pescado Feb 17 '16 at 20:37
  • @el.pescado This is a demand from COPPA legislation, as 0,50cent is the minimum amount that force the banks send a paper statement or mail to the user – Deniz Erdal Feb 18 '16 at 12:10
  • What about using a third party for the verification? For example an App with an In-App purchase of 50Cent via Google Play Store or Apple AppStore? - So the parents don't have to trust you and only need to pay 50Cent with one click... – Falco Feb 29 '16 at 15:55
7

This is a fun problem (:

It might be worth offering multiple approaches, or split testing multiple approaches to see which process users tend to prefer. If you've got the resources, it might be worth looking into:

  • Upload a picture of your ID (70% mobile signup? Use the phone's camera as part of the submission process)
  • Have the child "request" parent authorization, send a text (Teliphony APIs are easy and cheap) to the parent with either:
    • A link to the request form
    • Asking directly for a picture message of the parent's ID
  • Give the user the option to donate their 50 cents to a charity of their choice (adds transparency)
  • Request a mailer [snail mail form] (use a print-on-demand service)
  • Facebook verification using address or linked family accounts?
  • One-time bank account integration used to verify user is adult

I think you'll find that, in general, people don't like to hand out bank account or credit card information. Regardless, different users are going to want different things. It would likely be a good idea to build a framework that allows you to test, measure, and learn which implementations work best.

I hope this idea list helps you out!

  • Are you serious? Kid can easily gain access to mom or dads phone or payment info for a few minutes to do this. And who do you know would give a site like this 50 cents over a credit card or bank account? – blankip Feb 17 '16 at 18:38
  • Woah. I'm sorry if I offended you. Also, I don't believe the issue is "guaranteed proof" that the parent is aware of the sign-up. There will always be ways to cheat the system. As you've pointed out: using the parent's phone, grabbing their ID or CC out of their wallet. What we REALLY care about is making it as easy as possible to get "good enough" proof that the child has the parent's consent. – Daniel Brown Feb 17 '16 at 19:00
  • 1
    @blankip If you threw out every idea because there's some edge case loophole, you'd never have any ideas. – Nathan K Feb 17 '16 at 20:55
  • @NathanK - these are not loopholes. These are "no duh" things. I would not build a premise of trust around my site when trust was actually authenticated so poorly - and this has nothing to do with the OP but everything to do with his success. This would be the equivalent to storing passwords in plain text. Yes you passworded the user account but you knew it was half ass. – blankip Feb 17 '16 at 22:14
  • 1
    @blankip This is nothing like plaintext passwords. The COPPA regulations are quite explicit about what constitutes "verifiable parental consent," and are also explicit that further verification that the parent is initiating the action is not required. They are--intentionally--designed around a concept of "reasonably calculated," not "proof beyond a reasonable doubt," or whatever higher standard you are imagining. You continuing to make comments advising against the guidelines explicitly recommended in the COPPA regulations is not helpful. – GrandOpener Feb 17 '16 at 22:20
3

I would imagine most of the friction is unavoidable due to the legislation.

However there are aspects of the process you will be able to smooth out, Google have a similar process for verifying business listings on their places database, albeit without the impatient child waiting in the wings. You might be able to find out how they refined the process.

As you are printing and dispatching stuff to the whole of the EU, you might benefit from finding print on demand partners in almost each country, who can print in the recipients country and send direct, this should reduce the time delay some what.

You can also add an address lookup or validation tool on the sign up forms, which will help speed up sign ups and ensure that the address data you are using is good, to reduce the risk of them getting lost in the mail.

As far as the payment and post item through the post process goes, the typical shopping cart UX refinements should help slim that process too.

Disclosure I work for a company that offers address validation APIs called Allies, however there are plenty other providers out there and some EU countries that provide address data as open data

0

If the parent logs in with a commonly used social media, you can check their age. I guess this can be faked, but will be correct for most users. Are you liable in the few cases this is abused?

There is of course always the LSL method, though the effectiveness of this has been weakened with the advent of the Internet. Then maybe you just need to be creative with your questions :)

-4

This isn't a UX problem, it is a business problem. There is no F'ing way I am handing over my info for a 50 cent fee to some unknown website (shit I wouldn't give that to google for this purpose). Worrying about the process of this is like worrying about the tires on a car that has no engine.

If your website is going to have a good UX it is going to have to take a 50 cent hit on every user and figure out how to do the verification without credit cards and bank accounts being mentioned - because just mentioning those... poof I am gone.

Also note that credit card data and bank account data is often available to an intelligent 11 year old. At 11 I would have made an email address for my parent, got their credit card info, they would have been charged and you would have my account verified. The whole process is a sham.

And as far as calling parent... same thing. First I don't want to be called by a website. Second when I was 12 I could easily pass for an adult over the phone. Why couldn't I sneak mom's cell phone for 15 minutes and answer a couple questions? If you are paying a service 50 cents to do this I highly doubt they care about someone faking it. And then again if I am a parent I would never tell you info about me or my kid over the phone.

My advice - seriously - solve the business issue then move on to UX.

  • 2
    Note that the OP clearly indicated that this is being done for compliance with COPPA, and COPPA has very specific regulations for what constitutes "verifiable parental consent," one of which is using a credit card to make a monetary transaction. Claiming that credit cards are too much of a barrier is relevant, but complaining that they are unreliable because kids can access them is not relevant to the question as asked. – GrandOpener Feb 17 '16 at 18:58
  • @GrandOpener - I am not saying that you should bypass COPPA. I am saying that you need a business model that doesn't need that requirement unless your plan is to have high costs and no return. The goal of all business sites are to make money right? – blankip Feb 17 '16 at 19:17
  • To be clear, I agree that the 50 cent charge is a barrier, and I agree that figuring out how to take the hit sounds like the best of the available options. It's the parts of your answer about how credit card charges and phone calls can be faked that are not relevant. Your answer could be substantially improved by just removing the third and fourth paragraphs. – GrandOpener Feb 17 '16 at 19:22
  • @GrandOpener - I think it is important to mention them because if this does happen all the UX work in the world will not fix the backlash on FB and other sites about how kids are hacking a ghetto verification method - which other than the mailer, they were really bad. On the 50 cent thing - well yea I said take the hit - but you also get what you pay for. Do you really think that a 3rd party service charging 50 cents per head (probably sent overseas with minimum language skills) can decipher a 12 year old or adult? The reason I posted is the solutions defy logic. – blankip Feb 17 '16 at 19:29
  • 1
    In your answer you give a specific edge case where the current process will fail, but then go on to anecdotally shoot down any other processes that would patch up that edge case. You don't seem to be providing an answer other than some vague suggestion to solve the "business problem." Your suggestion seems to be that there is no way to offer services to kids in a manner that is COPPA compliant. Which is absurd. – Nathan K Feb 18 '16 at 14:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.