New York, NY – January, 26, 2009 – The Children’s Advertising Review Unit (CARU) of the Council of Better Business Bureaus, Inc., has recommended that AOL, LLC modify the Websites www.aol.com and www.kids.aol.com to assure they are in compliance with CARU’s self-regulatory guidelines for children’s advertising or the federal Children’s Online Privacy Protection Act (COPPA.) The company has taken steps to do so.

The Websites came to the attention of CARU through CARU’s routine monitoring practices. 

CARU monitors Websites for compliance with CARU’s Self-Regulatory Program for Children’s Advertising, including CARU’s guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA).

The AOL Website offers free Internet services, including e-mail, instant messaging, search engine functions and an online community. 

When registering for an AOL e-mail address, potential registrants are asked to provide various forms of personally identifiable information (PII), including their first and last name and desired e-mail address. They are also asked for their date of birth. If a prospective member enters a birthday corresponding to an age below 13, a message appears stating, “You must be over 13 years of age to register for this service.”  The registrant is then able to change the previously entered birthday to one indicating an age above 13 in the same window and complete the registration.   There is no session cookie in place to prevent users from circumventing the age screening. 

The www.kids.aol.com Website, which is linked to the main AOL.com site under the label “Kids,” is specifically designed for children seeking to use the AOL services, including e-mail and instant messenger.  When signing up for a KOL (Kids AOL) account, all potential members must obtain verifiable parental consent before their accounts can be validated. A credit card transaction is needed to complete the registration as part of the parental consent process.

A child with a KOL account will have access to all content and features of AOL sites other than adult chat rooms or social networks.  Parents can limit their child’s access on AOL’s general audience sites by signing up for their own account and utilizing the parental control options.

On the homepage of the kids.aol.com Website there is also a link for the “Mail” feature.   Upon clicking on this link, visitors can either sign in with their e-mail or screen name or select “get an [AOL] account.”  The registration page for the mail account asks potential registrants to input their desired screen name, display name, alternate e-mail address, birth date, country and zip code.   If a birth date indicating an age below 13 is entered, the following message appears:  “You have identified yourself as a child under the age of 13.   You must be 13 years of age or older to register for this service.”   Once this message is shown, a visitor can change her year of birth to reflect an age over 13, reenter the other requested information, and obtain an account.

The kids.aol.com Website also features free e-cards for visitors to send. When signing up to send an e-card, the sender is asked to enter her e-mail address along with the friend’s name and e-mail address.   The sender is also able to type her own message into the subject line and text portion of the e-card.  When received, the e-mail appears to be sent directly from the sender’s e-mail address.

Following its review, CARU noted the lack of a session cookie in accordance with a neutral age screening process for both the AOL Website and the “Mail” section of the KOL Website; the inclusion of “tip-off” language in the age screening process on the AOL Website and the “Mail” section of the KOL Website, and the collection and display of the sender’s PII in the KOL e-card feature, without first obtaining verifiable parental consent.

Upon receipt of CARU’s inquiry, AOL responded that it had reviewed the issues raised and had revised its Websites to ensure compliance with CARU’s Guidelines and COPPA.  

With respect to the age screening process on the AOL Website, AOL said it had removed tip-off language and was working to reinstate the session cookie, which had always been a part of the registration process.  According to AOL, the session cookie should be operational at the time of this decision.

AOL agreed to modify the registration such that visitors will be automatically routed to the KOL sign up, which requires verifiable parental consent, but said the change to the “get an account” feature could not be done immediately without affecting nearly all of the AOL registration portals.  In the interim, before that change is completed, AOL has implemented a neutral age screening with a tracking mechanism to ensure the protection of children’s privacy.

Finally, AOL stated that the link to the e-card feature has been removed until such time that the content can be brought into complete compliance with CARU’s Guidelines and COPPA.