New York, NY – May 1, 2019 – The Children’s Advertising Review Unit (CARU) recommended that Facebook, Inc. modify its mobile app to improve its mechanism to prevent underage users from circumventing the age screen. Facebook immediately implemented CARU’s recommendations.

“We are pleased that Facebook now becomes the first company working with CARU to implement this requirement in the mobile environment,” said CARU Director, Dona J. Fraser. “CARU works with companies to ensure advertising and data collection practices comply with all relevant laws and our self-regulatory guidelines. We seek change through voluntary cooperation to protect a uniquely impressionable and vulnerable audience and we look forward to working with Facebook on this requirement.”

CARU is an investigative unit of the advertising industry’s system of self-regulation, administered by the Council of Better Business Bureaus, initiating and receiving complaints about companies’ advertising and privacy practices. CARU determines whether such practices are in compliance with its guidelines. The organization also monitors websites and mobile applications for compliance with its guidelines, including those addressing online privacy protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA.)

The Facebook app is a social networking and messaging platform directed to a general audience, not intended for children. With that understanding, Facebook is permitted under the Guidelines and COPPA to age screen and block children under 13 from using the app, which it does.

Prior to CARU’s examination of the app, when a registrant entered a birthday corresponding to an age younger than 13, a message denied registration. However, the registrant was immediately able to change the originally-entered date of birth and continue attempts until a valid age was chosen that allowed registration.

In this case, CARU determined that Facebook’s age screen was not compliant with its Guidelines because it did not employ technology sufficient to prevent underage children from circumventing the age-screening process. Historically, websites have used session cookies to prevent children from going back and changing their age. While cookie usage is more limited in the mobile environment, CARU held that the same requirement is still necessary.

“CARU believes that better age-gating mechanisms in the mobile space are crucial in order to comply with the Guidelines and maintain the spirit of COPPA in a mobile environment. As technology develops, children become even savvier, and age-screening techniques must also evolve,” said Fraser. “We think it is now time for the Federal Trade Commission to reexamine this issue and update guidance. The technological landscape is morphing and CARU understands the challenges developers are confronted with in creating engaging mobile apps. As CARU undertakes an update to its Guidelines, we are ready to lead the discussion and work with regulators and industry to create updated guidance and standards to the ecosystem to ensure children’s safety in the online environment.”

CARU recognizes that mobile technology is still developing and that companies are working hard to adapt traditional privacy principles to this new environment. In fact, when CARU opened this investigation, most apps did not employ a technical mechanism for this purpose.

CARU is pleased that Facebook has taken the lead, raising the bar to ensure children’s online privacy. In Facebook’s advertiser’s statement, it noted that it strongly believes in protecting minors and is always working to improve its tools and protections. Facebook stated that it appreciates CARU’s work in the online privacy space and was happy to make changes despite disagreeing with aspects of CARU’s original determination.

CARU’s inquiry was conducted under NAD/CARU/NARB Procedures for the Voluntary Self-Regulation of National Advertising. Details of the initial inquiry, CARU’s decision, and the advertiser’s response will be included in the next NAD/CARU Case Report.