Protecting Children Online: Risks, Laws, and Safety Strategies

Introduction and Background

Throughout history, children have always been at risk of exploitation by adults, varying only in degree. An unfortunate but natural consequence of the increase in children's use of online resources has been a corresponding increase in the targeting of young people by commercial enterprises that exploit their innocence and lack of guile — soliciting personal information that is then used for targeted marketing purposes. More alarming, however, has been the use of online forums such as MySpace to lure young people into online and offline encounters that may endanger their safety and lives. Federal and state governments have been trying to achieve a careful balance of laws to protect underage consumers from exploitation by online businesses while recognizing the fundamental constitutional rights of commercial enterprises and consumers, but this balance has proven especially difficult to achieve. Moreover, the increasing popularity and sophistication of Internet-accessible devices — such as laptops and, especially, cellular phones — has provided entirely new avenues for young people to access online resources, and for adults seeking to attract underage victims to access them in turn. The availability of ring tones that adults cannot hear but teenagers can is reflective of the "us versus them" mentality emerging in technological applications today. The purpose of this study is to identify what can be done to help policymakers and educators address these concerns in the classroom and in the home.

This study proposes to use a five-chapter format to answer the central research question: to what extent are educational leaders, teachers, and parents aware of potential risks to children during unprotected and unsupervised access to the Internet? A heightened awareness of potential predator risks to children while accessing the Internet unsupervised and unprotected is a vulnerability that will become a measurable reality through further investigation of the issue. The study employs a phenomenological approach to identify the potential risks and their consequences, providing substantial significance and heightened sensitivity to the issues addressed. These goals will be accomplished by emphasizing a focus on the subjective experiences and understanding of administrators, educators, librarians, and parents, using a modified Delphi technique that allows respondents to participate in an iterative, online questionnaire-completion process.

As more and more young people become expert with computers and online interfaces, their vulnerability to exploitation by adult predators also increases. In this regard, Campbell, Calvert, and Boswell (2003) stated that "as personal and business-critical applications become more prevalent on the Internet, network-based applications and services can pose security risks to all attention resources." According to Festinger (1997), one danger of the Internet is that people can be disguised: "People avoid information that is likely to increase dissonance. Not only do we tend to select reading material and television programs that are consistent with our existing beliefs — we usually choose to be with people who are like us." Unfortunately, the Internet can disguise people with a different set of opinions or moral values. As Festinger asserted, there is no assurance about the identity of individuals that family members are communicating with while online. Therefore, it is imperative that responsible adults implement security features — such as properly installed hardware and software — into every home computer environment, ensuring the safest computing environment possible. According to Elder and Paul, "skilled critical thinking is to be able to take one's thinking apart systematically, to analyze each part, assess it for quality and then improve it" (2002). Developing a strategy for Internet use will require such skilled critical thinking in order to conduct the kind of analysis that leads to necessary safety measures (Campbell et al., 2003).

During the 1980s and 1990s, in the early days of Internet use, only government officials and scientists had to worry about securing data from intrusion, modification, or destruction. Now, with desktops or laptops in virtually every home, and with the increased reliance on the Internet for information and communication, not only is personal information at risk, but the safety of families has come into play due to online predators. Because of this dangerous trend, the average administrator, teacher, and parent trying to provide the latest technology in a secure mode needs a guide on how to manage Internet access.

Children fall prey to online predators at an increasing rate. In a 1998 survey, Parry surveyed 10,800 teenage girls, of whom 12% admitted to meeting strangers offline. Additionally, in 2000, Family PC reported that 24% of girls surveyed and 14% of boys polled had met strangers on the Internet — and had also met these individuals offline. During a recent visit to a small Midwest community, three children admitted involvement with Internet predators, leading to the torture and rape of one of the children (Wire Safety, n.d.). According to Shields (2003), "In this porous and mixed material/virtual world of the home, parents worry that children and teens will be targets for online predators, paedophiles and online marketing scams at home. Columnists and how-to authors warn parents to limit their children's online time, double-check their email for pornography and debate whether or not face-to-face meetings with others met online should be allowed" (pp. 98–99).

Furthermore, the initiatives to date have failed to measure up to the need. For example, the well-meaning but misguided Deleting Online Predators Act of 2006 (DOPA), introduced by Rep. Michael G. Fitzpatrick, would have required any school or library receiving government funding to block access to any website that "allows users to create web pages or profiles that provide information about themselves and are available to other users, and offers a mechanism for communication with other users, such as a forum, chat room, e-mail, or instant messenger" (quoted in Fletcher, 2006, p. 24). The bill would also have made these sites available only to people aged 18 years and older (Fletcher, 2006). Although the legislation's intent — to keep online predators from contacting children through social networking sites such as MySpace — is admirable, attempting to prohibit the use of these phenomenally popular sites is like using a $200,000 smart bomb to destroy a $10 tent (Fletcher, 2006).

In reality, the core problem is that no widely accepted safety recommendations and guidelines, developed by experts in the field and applicable across home, school, and office environments, are available to ensure the safety of children and adolescents. Consequently, the safety of children continues to be at risk as more people gain daily access to the Internet. There is a need to develop a qualitative study that will explore the perceptions of experts on how to protect children and adolescents from online predators. This qualitative study will use a modified Delphi approach to explore the perceptions of area school district educators, administrators, librarians, and sample parents through interviews and surveys, with the aim of developing a set of unified and consistent recommendations for online safety for children and adolescents.

The purpose of this dissertation is to provide recommendations from experienced practitioners — detailed, hands-on guides that even the computer-illiterate parent or senior caregiver can use to set up a home computer in the most secure mode available. Research areas will include various information systems security sites and discussions with technical personnel proficient in the security of hardware, software, and network technology. These sources will support a Delphi study designed to develop safety recommendations for using computers in home environments where minors are present.

The results of the study will contain a systematic instructional guide — a tool one can use to establish a computer system in as secure a mode as possible. The dissertation will also include a detailed listing of available security hardware and application software with installation details. A Delphi study engaging administrators, educators, librarians, and parents who are expert in computer use and safety measures will provide an enhanced understanding of a growing problem that has developed into a potential threat to the safety of the nation's youth. Findings resulting from the Delphi study will provide a framework and heighten awareness, equipping responsible adults with the tools required to minimize potential Internet predator risks.

According to Linstone and Turoff (2002), "Delphi may be characterized as a method for structuring a group communication process so that the process is effective in allowing a group of individuals, as a whole, to deal with a complex problem" (p. 5). Given this explanation, the goal of the research results is to provide valuable information that educators and parents can utilize while providing Internet access for students. Technology is a way of life that students today must continue to understand and use as a research tool to learn more about our world.

To grasp a better understanding of the technological knowledge of students, educators, and parents, it is essential to implement a process through which one can obtain insight into the technological skills of students. According to Lang (n.d.):

The Conventional Delphi has two main functions — forecasting and estimating unknown parameters — and is typical of Delphi as it was originally conceived. It is used to determine consensus on forecasting dates and developments in many areas, particularly in the area of long-term change in the fields of science and technology. The Policy Delphi, on the other hand, does not aim for consensus but seeks to generate the strongest possible opposing views on the resolution of an issue and to present as many opinions as possible. The objective is for it to act as a forum for ideas and to expose the range of positions advocated and the pros and cons of each position (Bjil, 1992). Finally, the Decision Delphi is utilized to reach decisions among a diverse group of people with different investments in the solution. (p. 3)

The conceptual framework used for this study is an exploratory approach. According to Atkinson (1995), an "exploratory methodology is designed to uncover aspects of data that should generate questions" (p. 77). Furthermore, Thomas (1998) emphasizes that an exploratory research methodology may yield serendipitous findings: "Some studies qualify as exploratory investigations because the researchers are guided only by very general questions rather than by specific hypotheses to test or precise questions to answer. As a consequence, interpretations of exploratory studies often include unanticipated conclusions" (p. 268).

The research questions guiding this study are as follows: What concerns do computer-aware parents and teachers have about child safety on the Internet? Do computer-aware parents and teachers currently apply strategies and make adaptations to improve safety for children online? What suggestions can computer-aware teachers and parents make about improving child safety online? Do computer-aware parents and teachers recommend any changes in the way children use the Internet in schools and at home? How do computer-aware parents and teachers envision the future use of the Internet by children in the home and at school?

For the purposes of this study, it will be assumed that all children of eligible age will be enrolled in a school appropriate for their age and learning level; it will also be assumed that these students have some level of access to the Internet, and that some of this access will not be entirely supervised by adults. Although the general scope of this study extends to predation of children online in the United States and other countries, the primary focus remains on the U.S.

Historical Overview of Children's Internet Privacy

As a major carrier of information, the Internet has become an important part of many lives. Growth of the Internet is driven by cheaper and faster computers, lower access fees, increasingly easy-to-use interfaces, and — perhaps most importantly — significant growth in the amount of information and entertainment provided (Barker & Gronnes, 1996).

Citing research by Coyne (1998), who maintained that the emergence of the Internet as a distribution channel has intrigued marketers who see potential marketing benefits, Cai and Gantz (2000) report that an overwhelming majority (87%) of members of the Direct Marketing Association (DMA) have websites, with 83% of those marketers using their sites for marketing or sales applications; furthermore, about 25% of those using their websites for real-time electronic sales transactions are doing so successfully (Cai & Gantz, 2000). As companies market their wares on the Internet, a number of issues have emerged, including factors affecting consumer privacy. The results of a 1997 survey of Internet users found that privacy outdistanced censorship as the most important issue facing the Internet, and in 1998 it remained a major concern (Cai & Gantz, 2000).

By 1998, more than 6 million American children no older than 12 were reported to be online, up from 3.5 million in 1997. These figures represent a fundamental shift in how marketers approach target marketing, and the increasingly sophisticated, user-specific interfaces can induce even the most skeptical child to reveal more personal information than was intended or allowed by parental oversight. Not surprisingly, in view of increasing privacy concerns for children, the online collection of personal information from children by marketers has attracted considerable attention. Privacy was not as salient an issue with traditional media such as television, since with those media marketers could not contact children directly. With direct contact possible on the Internet, privacy concerns became more pronounced (Cai & Gantz, 2000).

In May 1996, the non-profit advocacy group Center for Media Education (CME) filed a formal complaint with the Federal Trade Commission (FTC) about online marketing practices toward children, arguing that such practices were "misleading, deceptive, and invasive" (CME, 1996b, p. 1). The CME also published the first set of guidelines specifically addressing the issue of online data collection from children (CME, 1996c), calling on marketers to "fully and effectively" (CME, 1996c, p. 7) disclose their data collection practices. For the CME, this included a description of the information being collected, the ways in which it would be collected, the intended uses of the information, the corporation collecting it, and the extent to which such information would be accessible to third parties. CME also wanted marketers to obtain valid parental permission when collecting personal information from children, and sought correction procedures for previously collected information as well as processes to prevent further use of that information.

In 1997, the FTC set up a series of workshops addressing ways to protect the online privacy rights of consumers. Later that year, the FTC announced the results of their "Kids Privacy Surf Day," a snapshot of privacy practices observed on websites designed for children. Most (86%) of the sites assessed collected personally identifiable information from children; only a handful (4%) asked for parental permission. The FTC emphasized the importance of protecting children's online privacy and declared it would conduct a systematic assessment of online information collection practices the following year, with results sent to Congress (FTC, 1997).

In response, the FTC conducted a content analysis of 1,402 commercial websites in March 1998, including 212 sites directed to children (FTC, 1998). The study assessed the effectiveness of self-regulation as a means of protecting consumer privacy on the Web. The FTC found that 89% of the sites collected personal information from children. Fifty-four percent of sites provided some form of disclosure about their information practices. Only 23% of the sites asked for parental permission before collecting information from children. Seven percent noted they would inform parents of their information collection afterward; fewer than 10% offered options for parents to control the future use of information collected (Cai & Gantz, 2000).

A study conducted by the Electronic Privacy Information Center (EPIC) revealed that among 40 new DMA members with websites, only eight had any form of privacy policy, and none of these sites allowed individuals to access their own information (EPIC, 1998).

Concerns about children's privacy on the Internet are not restricted to surfing the World Wide Web. Junk email from marketers and chat room opportunities also raise privacy issues. With this in mind, the study by Cai and Gantz focused on websites and examined the nature and extent to which such websites for children made an effort to gather information from young visitors. Rather than tracking information only through privacy statement analysis — as the FTC did — Cai and Gantz (2000) focused on the content within the main body of each site itself. The rationale was that few children would willingly click on a privacy statement link to read it. Children would be more likely to encounter privacy information if it appeared directly on the sites' main content pages.

Eleven lists of sites for children were used as the population of sites for this study. The lists were selected on the basis of peer recommendation and reported popularity, with two additional selection criteria: the list had to be recommended specifically for children (not a general audience); and the list could not be designed for a specific interest group, person, or narrow topic. The 11 lists ultimately included were: (a) Berit's Best Sites for Children; (b) Virtual Sites References; (c) Site Sentral List; (d) Links-4-Kids; (e) Surfing the Net with Kids; (f) Ace Kids–Cool Sites; (g) the Kids on the Web; (h) ALA (American Library Association) Great Sites for Kids (two lists); (i) Hotlist for Kids; and (j) Hot Weekly Lists for Kids. Together, these lists contained 3,130 links to children's sites, though a subset appeared in multiple lists (Cai & Gantz, 2000).

The authors initially sought to analyze about 10% of the sites from the selected lists. Systematic sampling following a random start generated 391 sites. Sites were excluded if they were not designed for children (defined as anyone no older than 12), were search engines or link sites without content, had inaccurate URLs, or had already been coded. In order to qualify as a site for children, a site had to either use language or graphics directed to children or feature content directed to children. More than half of the initially selected sites were excluded, leaving 166 sites. The initial data (Wave 1) was collected from May 26 to June 4, 1998; 166 sites were coded, and a majority (65%) were commercial in nature. The second set of data (Wave 2) was collected approximately six weeks later, from July 15 to July 17, 1998, after the FTC's report was released; at that time, 163 sites were successfully recoded (Cai & Gantz, 2000).

The results of this FTC study were highly revealing. Ninety-five sites (57%) collected personal information from children during Wave 1; during Wave 2, ninety sites (55%) did so — approximately the same proportion. Among the 95 sites in Wave 1 which collected personal information: 27% asked for parental permission (with 19% simply reminding children to ask parents, without confirmation); 14% disclosed their intent to collect personal information; 29% described the information they would collect; 24% described how they would collect it; and 25% described their policy on sharing with third parties. The average site sought 4.0 personal information items — most commonly children's names (93%) and email addresses (83%). Fewer than half requested postal addresses (43%) or the child's age (37%). One in eight sites (12%) asked for the parents' email address; one in ten asked the child for information about other children (Cai & Gantz, 2000).

In Wave 2, compliance showed modest improvement. Thirty-three percent of sites that gathered personal information asked for parental permission, a statistically significant increase from Wave 1 (t = 1.97, p < .05). A sizeable majority of permission requests (70%) appeared on the same page where data were collected, before the child was asked for any personal information — a considerable increase from Wave 1 (t = 2.58, p < .01). The average number of disclosures per site increased from 3.7 in Wave 1 to 4.1 in Wave 2 (t = 4.23, p < .01). More sites disclosed their policy on information use (39%, up significantly from Wave 1; t = 3.36, p < .01), and more than half (57%) offered ways to change information before submitting it (t = 2.95, p < .01). A larger proportion of sites also encouraged children to use fake names (t = 2.21, p < .05) (Cai & Gantz, 2000).

The study by Cai and Gantz (2000) found that a majority of children's websites (57% in Wave 1 and 55% in Wave 2) did collect personal information from children; nevertheless, these rates were much lower than the 89% rate identified by the FTC. The authors suggest three factors may account for this difference: the FTC study focused solely on commercial sites, whereas the Cai and Gantz study covered a broader array; the sites coded in the Cai and Gantz study had been recommended by consumer groups for children and were thus less likely to seek personal information; and it is possible that some sites abandoned data-gathering practices in the interval between the FTC's data collection in March and this study's effort in May (Cai & Gantz, 2000).

Collection of personal information was not restricted to profit-driven sites. Sites maintained by non-profit organizations also sought personal information from children — and indeed, non-profit sites that did collect information were less likely than their for-profit counterparts to comply with basic elements of industry self-regulatory codes. This suggests that collection of personal information is a phenomenon that cuts across website types; parents and educators should therefore remain alert to data collection practices regardless of the nature of the sites young people visit (Cai & Gantz, 2000).

The benefits that sites offer in exchange for personal information also warrant attention. The results of the Cai and Gantz study found that direct promotion of products accounted for only a small portion of the benefits offered to children. Rather than directly promoting products, sites encouraged children to join various clubs. Even before the Internet, the use of children's clubs represented an effective marketing channel; online, it became even simpler for young people to join by typing and clicking. Given all of the benefits associated with club membership, it may be particularly difficult for children to resist the temptation to join. Cai and Gantz (2000) report that 27% of the sites in their study that collected personal information did so using clubs.

The authors identified another important trend. According to Cai and Gantz (2000): "Some sites included ads which led to different — and not always children's — websites. It has been reported that sites other than children's websites frequently collect personal information. In ClickZ's latest survey, 76% of online marketers and publishers were found collecting user information (Pieper, 1998). This fact indicates that once children enter such sites, their rights to privacy face a higher risk. Related to this phenomenon is the fact that links may also lead children to other sites which are not appropriate for them to visit (e.g., sites promoting products, even sites dealing with sex)" (p. 201). These findings highlight the need for increased parental oversight of young people's computer usage, particularly online.

Parental Involvement and Government Response

According to Fletcher (2006), "We need to pay attention to technology's impact on people. We need to figure out how to use technology effectively and responsibly rather than ban it, and put the onus of responsible technology use on the users: teachers, students, and parents. I think that works for cell phones, MySpace, and the like" (p. 25). Indeed, the self-regulatory codes published by the DMA and the Children's Advertising Review Unit (CARU) highlight the need for parental involvement. CARU's (1997) guidelines specify that "before obtaining any personally identifiable information, the company must obtain prior parental consent, regardless of the intent of the use of the data" (p. 5). Similarly, the FTC (1998) argued that "it is parents who should receive the notice and have the means to control the collection and use of personal information from their children" (p. 4). Nonetheless, in the Cai and Gantz study, no more than one in three of the sites that asked for personal information sought parental permission; even this figure may overstate compliance, since most of these sites simply reminded children to ask for parental permission without confirming it (Cai & Gantz, 2000).

By all accounts, children are not adequately protected online. Approximately 66% of the sites that collected personal information from children in the Cai and Gantz study failed to disclose that the site was gathering personal information, note the purpose of their information-gathering activities, or request that the child obtain parents' permission before submitting personal data (Cai & Gantz, 2000). Because the sites included in the Cai and Gantz study were specifically recommended for children, these data may actually represent a conservative estimate of online data collection activity. As the authors note, "Marketers running more broad-based sites (e.g., those for general audiences) may be unaware of — or feel less constrained by — FTC and industry guidelines aimed at protecting children" (Cai & Gantz, 2000, p. 201).

The authors further suggest that it is only possible to speculate about the actual impact of disclosures: "It is quite possible that their impact is nearly negligible... Disclosures may not even register among children who quickly attend to more salient and interesting features on websites, features deliberately designed to attract attention" (Cai & Gantz, 2000, p. 201). Nevertheless, the presence of disclosures may alert some children, particularly those whose parents have taught them to remain aware of online data collection practices.

Following publication of the FTC study, some corporations modified their websites in line with industry self-regulatory codes. In Wave 2, a larger proportion of sites requested parental permission, disclosed they would keep children's information to themselves, and encouraged children to use fake names when playing online games, participating in chat rooms, or joining online clubs. Even so, more information was requested from children in Wave 2 than in Wave 1, and a majority of sites that collected personal information still failed to comply with industry guidelines (Cai & Gantz, 2000).

Increased compliance with self-regulatory guidelines is likely to depend on a confluence of four factors: heightened parental awareness of online data collection efforts directed at children; more widespread awareness within the marketing community of self-regulatory guidelines; the development of meaningful self-regulatory enforcement measures; and sustained FTC interest in the area, coupled as needed with threats of regulatory activity (Cai & Gantz, 2000).

A recent report by Williamson (2004) noted that "parents are still ignorant of the dangers their children face daily on the internet, a major survey has found. Research by a team based at the London School of Economics found that 57% of young people aged 9–19 have come into contact with pornography online. However, only 16% of parents said that their children had seen such material" (p. 3). About 33% of young people who used the Internet or text messages also received unwanted or nasty comments; however, just one in 20 parents was aware of this, and almost 50% of respondents reported having given out personal information online, while only 5% of parents knew this had occurred (Williamson, 2004). Salient findings of this study included:

Most of the pornography witnessed by young people was seen unintentionally. Pornographic pop-up advertisements had been seen by 38% of respondents who used the Internet at least once a week; 36% had found themselves accidentally on an adult website; and a quarter had received pornographic junk email. One in 10 said they had visited a pornographic site on purpose; 9% had been sent adult material by someone they knew; and 2% were given pornography by a person they met online. A quarter of those aged 9–15 said they were "disgusted" by the pornography (Williamson, 2004).

The report was based on 1,511 in-home and face-to-face interviews with children and a written questionnaire to 906 parents. It also determined that 30% of children had no guidance from school on using the Internet (Williamson, 2004). Unlike television and newspapers, the Internet remains largely unregulated, and some degree of increased vigilance is needed today to protect children.

Conclusion and Recommendations

A consistent theme throughout this literature review is the need to incorporate emerging technologies into curricula rather than simply banning them outright, but these measures alone will not address the underlying problems associated with those who are intent on preying on underage people in online forums. What is required today is a more informed approach to what actually takes place when children go online and the extent to which these activities are being monitored by parents or other caregivers.

Allowed unfettered access to online resources, it is reasonable to assume that some children will become inextricably involved in some type of inappropriate relationship with an adult predator, or will otherwise become a victim of target marketing efforts that unfairly use personal information elicited through deceptive means. By surveying parents, teachers, administrators, and librarians, a snapshot of what is currently known will help identify educational opportunities for these individuals and provide a framework in which these initiatives can be monitored and assessed for effectiveness.

Research will assist administrators, educators, librarians, and parents in gaining a better understanding of the potential risks children face when accessing the Internet unprotected and unsupervised. Heightened awareness of the potential jeopardy to children while accessing the Internet unsupervised and unprotected will allow administrators and parents to design safer computer environments. The Delphi study proposed herein is intended to serve as a critical next step toward developing unified, evidence-based safety recommendations that can be implemented across home, school, and community settings — equipping responsible adults with the tools required to minimize potential Internet predator risks and protect the nation's youth.