Microsoft introduces new EU GDPR parental consent validations for children's accounts

[Arthur]

I don't think this has been posted?

 

Source: Microsoft (via Neowin)

 

Microsoft continues on its steady path toward compliance with the European Union (EU) General Data Protection Regulation (GDPR). Today we are announcing new parental consent requirements for accounts held by children in the EU. We are instituting these requirements across our product platforms to meet GDPR requirements, well in advance of the 25 May deadline, to afford our customers the time needed to verify their accounts and authorize any necessary consent.

 

Where a controller is relying on consent to process personal data, the GDPR requires parents to provide their consent to process personal data of children younger than 16 years old. EU member states may choose to set a lower age – which some have done – provided it isn’t lower than age 13. To implement parental consent requirement in the GDPR, Microsoft is relying on the high standards afforded under the U.S. Children’s Online Privacy Protection Act (COPPA) to verify parental consent for children’s accounts across our product platforms. We have already started to roll out the necessary notifications to our users in many EU member states. We will complete the rollout by the end of April.

 

Using COPPA processes, we will prompt existing users to provide their country and date of birth. Users who are younger than the age of consent for their country will then be prompted for parental consent when they sign into their account during a short grace period. To verify their child’s account, parents will need to use a credit card for a 50-cent charge which will be credited toward an existing Microsoft account. This nominal charge also offers parents an extra step of protection to be aware of any misuse when reviewing their card statement. Parents who cannot, or choose not, to go through this process can also contact Microsoft Customer Service and Support to verify age and identity based on appropriate government documents.

 

After the grace period, the child’s account will be blocked until the parent completes the consent and verification process. Microsoft will continue to support data subject rights for children whose accounts are blocked pending parental consent. For new users, Microsoft will block final creation of the account until the parent provides consent within two weeks, after which the account will be deleted.

 

While we appreciate these new GDPR requirements may cause some temporary inconveniences, verifying that an adult is giving their child permission to use an account is an important component of Microsoft’s effort to help children explore technology safely. We also encourage parents to use this as an opportunity to review their child’s account content, screen time and monitoring settings by visiting account.microsoft.com/family.

[FN-GM]

Does this apply to Office 365?

[Bionic]

With O365 being a Microsoft service I would be very surprised if it didn't apply.

[StevieM]

Does this apply to Office 365?

 

I would certainly hope not! To me, it seems aimed more at personal Microsoft accounts as opposed to organisational ones.

[Bionic]

I would certainly hope not! To me, it seems aimed more at personal Microsoft accounts as opposed to organisational ones.

 

I'm not so sure. Even organisational provided accounts are likely to have personal data relating to the child. It may fall to the school or LA to seek consent from parents/guardians for the child, but I'd be very surprised if that isn't made a requirement.

[DJ-1701]

Seeing as though they would have no idea the age of the person using an account set up in 365, it has to be aimed at personal Microsoft accounts.

[Oaktech]

I've had a load of staff come to me asking if these messages - which mainly seem to come from X-Box Live - are legit or not.

[StevieM]

I'm not so sure. Even organisational provided accounts are likely to have personal data relating to the child. It may fall to the school or LA to seek consent from parents/guardians for the child, but I'd be very surprised if that isn't made a requirement.

 

As has been discussed in other threads, it is up to the school to determine which software/third parties it uses to process personal data. While it is considered by many to be good practice to advise parents of software/online provision used by the school, we do not need their consent.

[enjay]

Maybe I'm missing something, but what stops people lying about their date of birth when asked?

[Oaktech]

Maybe I'm missing something, but what stops people lying about their date of birth when asked?

 

Nothing - but they'd have to steal someone's credit card to do it...

[FN-GM]

Got an email this morning from Microsoft. Looks like it only applies to Yammer.

 

Subject: Introducing age gating in Yammer for non-Office 365 accounts

 

On May 14, 2018, users without an Office 365 identity will need to verify that they are over the age of 16 or they will lose access without administrator intervention.

 

[How does this affect me?]

Yammer users who are under the age of 16 and are not logged on with an Office 365 identity could be impacted by this change.

 

Starting May 14, users who log in to Yammer without an Office 365 identity will receive a prompt to indicate their age. If the user is under the age of 16, they will have their account suspended in Yammer. As an administrator, you will be notified via a message in Yammer and can reactivate the user's account within 14 days. After 14 days, the user account will be deleted.

 

[What do I need to do to prepare for this change?]

If your organization does not include users under the age of 16, then there's nothing you need to do to prepare for this change.

 

If any of your users are below the age of 16:

1. Ensure they have an Office 365 identity; or

2. If a user gets suspended, reactivate the account within 14 days to prevent account deletion.

[enjay]

Nothing - but they'd have to steal someone's credit card to do it...

 

"Using COPPA processes, we will prompt existing users to provide their country and date of birth. Users who are younger than the age of consent for their country will then be prompted for parental consent when they sign into their account during a short grace period. To verify their child’s account, parents will need to use a credit card for a 50-cent charge which will be credited toward an existing Microsoft account."

 

As I read it, that says only users who are under age will be prompted for the payment, so if the child enters a DOB which makes them 23, they won't be prompted for a credit card.

[StevieM]

"Using COPPA processes, we will prompt existing users to provide their country and date of birth. Users who are younger than the age of consent for their country will then be prompted for parental consent when they sign into their account during a short grace period. To verify their child’s account, parents will need to use a credit card for a 50-cent charge which will be credited toward an existing Microsoft account."

 

As I read it, that says only users who are under age will be prompted for the payment, so if the child enters a DOB which makes them 23, they won't be prompted for a credit card.

 

That was what I thought, to be honest. It bears all the hallmarks of box-ticking, backside-covering, passing-the-buck, 'We're complying with the law based on the information provided' exercise to me.

 

It's also encouraging parents to say, 'I'm not giving them my credit card details. Just say your over 18.'

[steve_forbes]

As @FN-GM says, this is only for consumer accounts that don't have an Office 365 identity, Microsoft assume that if you have an Office 365 identity then they have enough information about you to verify your age.

 

They are focussing on Yammer as that is seen as social media or "Information Society Service" to use the GDPR terms, where the providers now need to prove that they have an age verification process.

I have verified with Microsoft that this is not applicable to Office 365 users.

[Bionic]

...I have verified with Microsoft that this is not applicable to Office 365 users.

 

That's good to know, thanks for this.

[chrisjako]

this is such a PIA when using xbox, when my kids sign in everytime it asks me as a parent to sign in and enter CC info - when i do this it just loops back and asks me again - have to switch the game off and log them in from the home screen where again it prompts however you can select "skip for now" which actually works from this screen

[enjay]

this is such a PIA when using xbox, when my kids sign in everytime it asks me as a parent to sign in and enter CC info - when i do this it just loops back and asks me again - have to switch the game off and log them in from the home screen where again it prompts however you can select "skip for now" which actually works from this screen

 

Can they sign in to something from a PC as a one-off to validate the account? Maybe it is something in the X Box which doesn't like the new process...

[free780]

So give MS your credit card info and get charged 50p. Or send a scan of a birth certificate or passport to verify your age. I thought GDPR was supposed to encourage organisations to not hold unnecessary data on you. Age verification seems to have the opposite effect.