Parental consent and verification

KWS is a parental consent management tool. It enables parents and legal guardians to manage their consent for apps or websites to process their child’s personal data. This ensures that publishers fulfill their obligation to obtain consent from a child user’s parent or legal guardian (henceforth ‘parent’) whenever their app or website requires personal information from the child.

Types of parental consent

With KWS, there are various ways for your app to obtain parental consent, dependent on the nature of your app’s permissions and the risk inherent in those permissions. For example, a parent can toggle permission for push notifications using ‘opt-out’ consent, whereas permission to access a kid’s GPS information generally requires parent verification.

The different types of parental consent are described below. To decide which type is appropriate for your app, contact your Implementation Manager.

Opt-out consent

This is the least stringent form of parental consent supported by the KWS platform. The app can process a child’s information without the explicit consent of the parent; however, it must notify the parent of its intent to process such information. The parent then has the right to opt their child out, stopping any further processing.

The steps in this flow are as follows:

1. Parent receives email notification – When the app wants to collect personal information from a child, KWS triggers an email notification to the child’s parent, informing them of the app’s intent to collect that information.
2. App processes data – If the parent does not opt their child out, the app continues to process the child’s data.
3. Parent manages permission – Processing stops only when the parent explicitly revokes permission. The parent can revoke permission at any time.

Opt-in consent (email plus)

Opt-in consent (sometimes referred to as ’email plus’ under COPPA) is the ‘intermediate’ form of parental consent in terms of stringency. It is very similar to opt-out consent; the main difference is that the parent must give their explicit consent before the app can process their child’s data.

The steps in this flow are as follows:

1. Parent receives email notification – When the app wants to collect personal information from a child, KWS triggers an email notification to the child’s parent, informing them of the app’s intent to collect that information.
2. Parent grants permission – The parent can give consent by following the call to action (CTA) within the email. By ticking a checkbox, the parent signifies that they grant the requested permission to their child. No further verification steps are required.
3. App processes data – The app may now process the child’s personal information.
4. Parent manages permission – Processing stops when the parent revokes permission. The parent can revoke permission at any time.

Verified parental consent (VPC)

This is the most stringent form of parental consent on the KWS platform. This consent flow is similar to opt-in consent; the main difference is that the parent has to verify that they are an adult before they can grant the requested permission.

The step in this flow are as follows:

1. Parent receives email notification – When the app wants to collect personal information from a child, KWS triggers an email notification to the child’s parent, informing them of the app’s intent to collect that information.
2. Parent grants permission – The parent can give consent by following the CTA within the email. By ticking a checkbox, the parent signifies that they grant the requested permission to their child.
3. Parent verifies identity – The parent is then asked to complete a one-time verification process to demonstrate that they are an adult. The method of verification varies, depending on the parent’s country of residence. See Parent verification methods below.
4. App processes data – When verification is successfully completed, the app can process the child’s personal information.
5. Parent manages permission – Processing stops when the parent revokes permission. The parent can revoke permission at any time.

Parent verification methods

KWS uses the following three COPPA/GDPR-approved methods of verifying a parent’s identity:

Verification using a personal ID number

Parents who are resident in the USA, Brazil or Mexico can use their country’s personal ID register to verify their identity. They are required to provide the following details:

• Brazil: CPF (Cadastro de Pessoas Físicas or Natural Persons Register) number and date of birth.
• USA: Full name, last four digits of social security number, date of birth, and mailing address.
• Mexico: Full name, mailing address and CURP (Clave Unica de Registro de Poblacion or Unique Population Registry Code) number.

Verification using a payment card

This method of verification is used for parents worldwide. Payment card verification is a one-time process in which the parent carries out a nominal transaction on their credit or debit card to prove that they are at least 18 years of age (the minimum age one can hold a payment card in most countries).

The steps in this flow are as follows:

1. When prompted by KWS, the parent provides their payment (credit or debit) card number, CVV, and expiry date.
2. The parent’s card is used for verification as follows:
   • If the parent resides in the US, they are charged $0.50 USD. This is refunded after 8-13 business days.
   • If the parent resides outside of the US, a small amount is temporarily authorized against their card. This small amount is released within 30 business days.

Note that in the US, we withdraw funds from the parent’s account, but outside of the US, we only do temporary holds and do not withdraw any funds from the parent’s account. In both cases, the funds are shortly returned to the parent’s account.

As an extra layer of rigour, this process leaves a paper trail (bank statements) that enables an adult to see if their child used their payment card to get this verification without their permission.

Verification using ID Scan

This method of verification is used for parents outside of the US. Parents will be prompted to upload the front and back of a supported form of identification and it will be verified against a variety of trusted databases to confirm they’re an adult.

Example

1. In this example, the parent is presented with two app features that require parental consent:

2. The parent is prompted to confirm that they are indeed the parent of the child:

3. The parent is prompted to confirm that they understand the verification process:

4. The parent provides their credit/debit card information and clicks Submit payment. The payment is processed instantly. Parents in the US are charged $0.50 USD which is refunded after 8-13 business days.

5. When the transaction is successfully completed, the parent is returned to the Parent Portal’s permissions view where the permission is now enabled:

The parent can disable and re-enable this permission at any time without having to go through the CC verification process again.