New York,  NY – Oct. 28,  2015 – Kiloo, Inc., maker of the “Subway Surfer” mobile application, has agreed to modify the game’s privacy policy following an inquiry from the Children’s Advertising Review Unit (CARU).

CARU is an investigative unit of the advertising industry system of self-regulation. It is administered by the Council of Better Business Bureaus. CARU monitors websites and apps for compliance with CARU’s Self-Regulatory Program for Children’s Advertising, including guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA). “Subway Surfers” came to the attention of CARU through CARU’s ongoing monitoring practice.

The game itself, an endless running game, features a cartoon boy named Jake, described as a “youthful hooligan.”  Jake sprays graffiti on subway cars and seeks to elude the Inspector and his dog.

The game is basic in its play pattern, with two objectives: first, players must avoid trains and other obstacles, including the Inspector, by performing well-timed jumps, rolls, and sideways moves. Second, players attempt to grab coins that can be used to purchase alternate game characters, outfits for the characters, and various other game objects.
Upon CARU’s initial review of the app, the “Subway Surfers” privacy policy stated: “We collect information you provide directly to us such as when you participate in a contest and promotion … . The types of information we may collect about you include your name, social networking, screen names or IDS, email address and any information you choose to provide …” .

CARU was concerned that the Kiloo was not screening for age or obtaining verifiable parental consent before collecting or allowing users under 13 years of age to disclose personal information on the site,  in violation of COPPA and CARU’s guidelines.

In response to CARU’s inquiry, Kiloo argued that Subway Surfers was not directed to children, but was a “general” audience” game.

CARU, however, found otherwise. In reaching its determination that the game was directed to children, CARU considered the following:

The protagonist is a brightly colored cartoon character and is himself a “kid” and the game is basic in its play pattern. The game is featured as one of the “Games for Children” in the Android Store. It is rated for players age nine years and up in the Apple Store, players 10 years and up in the Google Play Store and for “All Ages” by Amazon. Parents posting to the website of Common Sense Media rated the game as appropriate for children age nine and older, while children rated it appropriate for children age six or older. The Australian Council on Children and the Media reviewed Subway Surfer and provided special advice for parents relating to the game.

CARU noted in its decision that the last two factors were particularly significant, as they established that children under the age of 13 were playing Subway Surfer.

Kiloo submitted user data that indicated that 56.5 percent of those accessing Subway Surfer on iOS were 13-17 years of age.  Although CARU requested data related to children 12 years of age and younger, Kiloo stated that it did not have data relating to a younger audience.

Although Kiloo asserted that Subway Surfers was not directed to children within the meaning of COPPA, and noted that its data showed that 43.8% of the app’s Android users are between the ages of 43-54, the company agreed to issue a new privacy policy, specific to Subway Surfers, that clarified its data collection and use practices. As a result, given that Subway Surfer does not currently collect personal information that would require Kiloo to obtain verifiable parental consent under COPPA, CARU has closed the matter.

In the event that Kiloo does elect to collect information from children, CARU would recommend that the company implement neutral age screening and either obtain verifiable parental consent from parents of children under 13 years of age or direct those children to an area of the app that does not collect personal information from children.

Kiloo, in its operator’s statement, said the company appreciated “CARU’s efforts to protect the privacy of children and welcomes this opportunity to provide a privacy policy specific to Subway Surfers that will provide more specific information about the limited data collection and use that occurs through the Subway Surfers mobile app.”