[Forum] Problems with COPPA user field - why is it there?

[slinky]

Unfortunately I lost several days of time dealing with a registration problem using synchronized software that I've had for years. Users were being registered properly in the "registered" user group but couldn't access the site. After painfully going through the process of bug squashing, I discovered a separate "COPPA User" field that exists in every profile. This button was being turned on for reasons I can't explain (default may be set to "yes", not sure.) What I wondered is the purpose of this button. If a user is a COPPA usergroup member, those should be the permissions set for that group - period. If I want to find all the children under 12 on my site, I can search by age. Done. If I want a group to be identified as COPPA users, they are in the user group. Seems fine. Now if I want to manually put them in another user group as in "approved COPPA users" I can create such a group too. Wonderful.

Now if I have a dedicated manual button is enabled, I don't see any way it's disabled automatically if that person reaches the right age. So what exactly is the purpose of this button? I see this being more of a potential major problem (as it was for several days) than it is having any utility. If there isn't any explanation for it, I recommend removing it entirely.

[josiah]

Turn off the coppa option in admin cp

[slinky]

Turn off the coppa option in admin cp

The COPPA option only refers to REGISTRATION - it does not disable COPPA enforcement across the site. I discovered this after having a rash of users not being able to use our forums despite being able to use the rest of the site. Hence COPPA is always enforced even though it might not be enforced during the registration process.

[slinky]

Here is a good example of the problems. If you sync vBulletin with other software, it may not work properly because of this:

https://www.vbulletin.com/forum/show...ht=coppa+field

I can see no way to turn this off and don't see why it should ever have been there. I'm guessing there may have been a good reason at some point but as implemented it's a hindrance, not a help.

[josiah]

Call me thick but if no one registers as a junior then how can the "coppa" rules be enforced ? and by whom.

[Zachery]

Its just a marker in the software, I would imagine if you ever had to deal with legal issues regarding it, knowing that the user was coppa would have been helpful at some point. It may be a carry over from older versions of the software.

I would suggest in the future to check vBulletin.org for more information with your customizations. The only reason you had a problem was your third party script.

[slinky]

Its just a marker in the software, I would imagine if you ever had to deal with legal issues regarding it, knowing that the user was coppa would have been helpful at some point. It may be a carry over from older versions of the software.

That's my guess - one that was put in there quickly to deal with legislature but really didn't need to be there if you had a usergroup. Easily lost in the shuffle since the law itself made virtually every website turn children away because the process was far too costly to enforce.

I would suggest in the future to check vBulletin.org for more information with your customizations. The only reason you had a problem was your third party script.

I understand that but this snafu even surprised developers well experienced in vBulletin synchronization by surprise. I was the one who reported it to them after suddenly something happened (we're still not sure what) that triggered this behavior. I'm not saying this is a vbulletin problem itself. It's not and vBulletin technically works as is by itself. My comment is merely pointing out an extra hurdle built in and bringing to light whether there is a potential desire to acknowledge compatibility with other software, as some companies do.

Regardless of all of this, I wish there was just some way to turn it all of globally.

[slinky]

Call me thick but if no one registers as a junior then how can the "coppa" rules be enforced ? and by whom.

The problem occurs if you're not using vBulletin for your user registration, which you're assuming as is vBulletin. If you're synchronizing other software that runs your site with vBulletin forum and import what you think are all the right variables, e.g. user name, password, email and user group, you should be done. This isn't the case with vbulletin. There is another setting that has to be changed as well which, if not set, it makes no difference what user group you set a user too - they won't be able to access the site. Unfortunately there isn't one setting that shuts off COPPA entirely from silently affecting your registered users.

[Ace]

Stab in the dark - were the affected users' DOB set to under 13, or not set at all?

Maybe impex, at one point or another, added the flag based on that?

[slinky]

Stab in the dark - were the affected users' DOB set to under 13, or not set at all?
Maybe impex, at one point or another, added the flag based on that?

Ace - thanks. User DOB not set at all - but here's the weird bit. In the past they weren't set either. Can't figure out yet what triggered this obscure user field to being "on" instead of "off" despite the user registration being properly set as "registered." Adding an additional flag should make it work in theory but I'd rather just turn it off altogether so you don't have to worry about remembering this if it hits you again.

[Zachery]

Change the mysql database schema to default it to no instead of yes

[slinky]

Change the mysql database schema to default it to no instead of yes

- Great idea and thanks. Problem is I can't find this field in the user table! to me!!! The post I referenced says it's the solution but even browsing at the fields doesn't give me an indication. The names don't suggest it nor the data. I'm wondering whether it's in another table despite that post.

Here's some nostalgia for you - I did find a stray field called "zoints" in it (if that means something.)

[slinky]

- Great idea and thanks. Problem is I can't find this field in the user table! to me!!! The post I referenced says it's the solution but even browsing at the fields doesn't give me an indication. The names don't suggest it nor the data. I'm wondering whether it's in another table despite that post.

Here's some nostalgia for you - I did find a stray field called "zoints" in it (if that means something.)

oh l-rd... i was guessing serialized data. Now I get it. The options field uses digits to set the default for various items. My guess is it may be read sequentially for settings? Not sure if the number value means something.... Hmmm... this may not be as easy as that great suggestion.

Backup.... OK - I can actually set this as a default as weird as unusual as this is. Thanks..

[Wayne Luke]

The field is there to easily find users that fall under COPPA's rules. That is all individuals under 13 living in the United States that were allowed to register with their parents written permission. This is a requirement under the law and any website using COPPA has to surrender the records and account information to the parents or law enforcement upon demand.

Even if you set it to deny users under the Age of 13, you then fall under COPPA's reporting requirements. If someone enters the wrong birthday while trying to register, a cookie is written to their system. If they come back later, that cookie is supposed to deny registration but if they block some of the javascript, then it could allow registration and mark them as COPPA anyway. Easiest way to fix it is to simply unmark the box. If your site isn't required to follow COPPA's rules and doesn't contain adult oriented content, then you might investigate disabling it altogether.

[slinky]

The field is there to easily find users that fall under COPPA's rules. That is all individuals under 13 living in the United States that were allowed to register with their parents written permission. This is a requirement under the law and any website using COPPA has to surrender the records and account information to the parents or law enforcement upon demand.

Thanks for the explanation Wayne. My point was that finding these users is simple - they are already contained in a usergroup called "COPPA" that is in the default vb install hence this separate field is redundant and another place not to remember to look. My second point is that having a manually set field means that users who do NOT fall under COPPA (e.g. they pass their 13th birthday) are still identified as COPPA users during the passage of time. This is because the button is dependent on a manual entry, not the age entered into the system as it should be to account for the passage of time, e.g. as opposed to setting an groups entry to move all users from COPPA group to registered if their birthday age is greater than 13.

Even if you set it to deny users under the Age of 13, you then fall under COPPA's reporting requirements. If someone enters the wrong birthday while trying to register, a cookie is written to their system. If they come back later, that cookie is supposed to deny registration but if they block some of the javascript, then it could allow registration and mark them as COPPA anyway. Easiest way to fix it is to simply unmark the box. If your site isn't required to follow COPPA's rules and doesn't contain adult oriented content, then you might investigate disabling it altogether.

Understood but the button isn't doing any of the above protection measures. Problem is that "simply unmark the box" doesn't work for an integrated registration system. Right now I'm working on a way to enter the correct option field from the integration script. As I mentioned, the problem is that there isn't a way to globally disable this feature - only from the registration process. This might be an item you may want to implement or remove this field, something international users might like to have as well.

Thanks.