CARU Determines Depesche Sites Collected PII from Children Under 13; Company Disables Features in Response to Inquiry

New York, NY – July 19,  2016  – The European operator of two fashion and style websites has disabled access to features that allowed the collection of personally identifiable information (PII) from children in the U.S., following a CARU inquiry.

CARU is an investigative unit of the advertising industry’s system of self-regulation. It is administered by the Council of Better Business Bureaus.

CARU monitors advertising directed to children and online services for compliance with CARU’s Self-Regulatory Program for Children’s Advertising, including guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA).

TOPModel.biz and StyleModel.com, administered by Depesche UK Ltd, came to the attention of CARU through CARU’s routine monitoring practices.

Upon initial review, CARU determined that the websites collected PII in two ways.

First, StyleModel.com collected email addresses from visitors to send updates on the website.  The StyleModel website did not request a parent’s email address to provide notice and opt-out for this collection. The  TOPModel website allowed children to register for an account.  To register, a visitor had to provide an email address and could at the same time sign-up to receive an e-newsletter.  The TOPModel website did not request a parent’s email address to provide notice and obtain parental consent.

Once registered, TOPModel members under the age of 13 could post photos of themselves with captions, make comments on the fashions of other members, provide PII in a personal profile, comment freely in public forums and a chat room.  The TOPModel website did not request a parent’s email address to provide notice and obtain parental consent for this collection.

CARU’s Guidelines and COPPA provide that an operator is required to obtain parental consent before any collection and/or disclosure of personal information from children.   Collection is defined in the COPPA Rule as the gathering of any personal information from a child by any means and includes enabling a child to make personal information publicly available in identifiable form.   When the disclosure of information is permitted, COPPA prescribes that websites and other online services must use a reliable method to obtain verifiable parental consent.

Although its privacy policy stated that it was not its aim to gather personal information about children under 14 years of age without their parents’ or guardians’ consent, the operator, nonetheless, did so.  As CARU noted in its decision, requesting that children ask their parents for permission in a privacy policy  is not a reliable method of obtaining parental consent.

In response to CARU’s inquiry, Depesche explained that it has disabled buttons on its sites to eliminate the ability of children in the U.S. to access features that collected PII.

The company noted that its “US-homepage has now only information about the characteristics our … models. There´s no advertising on this page, no community, no personally identifiable information from a child under 13 years of age and the page is free of charge