Composr Tutorial: Parental Controls and Child Safety

If your site will allow users to join / create accounts, chances are that you will have to abide by regional laws and regulations surrounding child safety online. This may mean different things depending on the region (e.g. getting parental consent, restricting site access, restricting data collection, or imposing curfews). Furthermore, since laws dictate that compliance must be based on the region of the user and not the site, it is not merely enough to satisfy the requirements in your own jurisdiction.

Fortunately, Composr has an advanced parental controls system where you can configure different limitations depending on the user's age and/or region. This tutorial will cover the features currently available; additional features are planned for future implementation.

Introduction to the XML Configuration

The parental_controls tag

The XML configuration is composed of a single parental_controls tag which can contain as many control tags as you like.

The parental_controls tag supports the following attributes:

• require_dob
  If set (to any value), then the date of birth field will be required on registration of a new account.
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
• lock_dob
  If set (to any value), then the date of birth field cannot be edited on a member's profile once set except by another member (e.g. a staff member).
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
  If birthday points are defined in points configuration, then the field will be locked regardless whether or not this attribute is specified.
• require_timezone
  If set (to any value), then the time zone field will be required on registration of a new account.
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
• lock_timezone
  If set (to any value), then the time zone field cannot be edited on a member's profile once set except by another member (e.g. a staff member).
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
  Not recommended unless laws require that you lock this down; members may move locations and need to change their time zone.
• require_region
  If set (to any value), then the region field will be required on registration of a new account.
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
• lock_region
  If set (to any value), then the region field cannot be edited on a member's profile once set except by another member (e.g. a staff member).
  This is ignored if the field is disabled in site configuration (and you will get a notice about that when saving the XML configuration).
  Not recommended unless laws require that you lock this down; members may move locations and need to change their region.
• enforce_region
  If set (to any value), then members will be required to update their region field in their member settings if the geo-location country of their IP address does not match their specified region.
  Enforcement will be ignored when a member's region is not set, so you may also want to use require_region with this.
  Not recommended unless you are legally obligated to enforce regional content; if members use a proxy or their IP address geo-location is not accurate, they might not be able to use your site.

Example:

The control tag

The control tags within parental_controls define parental controls which should be used. You can define multiple control tags with the same name attribute that use different filters.

Note that the parental controls system operates based on order of definition using regions. It will seek the defined controls (based on name depending on what we are checking for) from top to bottom until it finds one where the user's region applies to the defined regions, or the control has no regions defined.

As such, you should group your control tags with the same name together, and order them from most specific region filters to least specific ones. Control filters without any regions should be at the bottom of the group (as they are treated "default"). There is an example of this below.

All control tags support the following attributes; additional attributes specific to a control will be mentioned in their respective section of the tutorial:

• name (required)
  The name of the control; this will determine the behaviour as explained in this tutorial.
• age_threshold (required)
  The age at which this control no-longer applies. For example, "16" means this applies to those under the age of 16.
• regions
  A comma-delimited list of country, or country-region ISO codes, for which this control should apply. Where a country code is defined without a specific region, it will apply to all regions in that country.
  If this is not defined, the control will apply everywhere (unless a previous control by the same name had a defined region that matched the member).

Example:

The parental_consent control

The lockout control

The lockout control defines when members will be locked out of your site (unable to log in, but still can view it as a guest) until they reach a certain age. Some places may completely prohibit people under certain ages from using social media even with parental consent. Or, you might be running an adult-oriented site and want to restrict everyone under, e.g., 18 or 21. Use this control in those instances.

Note that this does not respect the parental consent member setting; even if a member has parental consent marked on their account, if they are not old enough to use your site as defined by a lockout, then they cannot log in.

The system is intelligent enough to handle lockout controls versus parental consent controls; the lockout ones will always take priority regardless of order in the XML file.

If you use any lockout controls, it is highly recommended to restrict all content on your site you do not want underage people seeing from the Guests usergroup.

Additional tags can be provided within this control as follows:

• message
  If defined, this message (Comcode supported) will show on the error screen when someone tries to log in who is locked out by this control. You should also include an e-mail address (using the email Comcode tag) for contact in case of errors.
  If not defined, a default message including the minimum age and the staff address will be shown.
• privacy_policy
  The contents within this tag will also be included in the automatic Privacy Policy generated by Composr. This supports Comcode. You do not need to include the age threshold or regions; those are supplied automatically. But you may want to specify the governing law behind this control.

In this example, members under the age of 13 in the U.S. states of Utah and Indiana cannot use your site:

See also

• Legal and social responsibilities
• Children's Online Privacy Protection Act (wikipedia)

Feedback

Have a suggestion? Report an issue on the tracker.