CARU Finds Snap, Inc. Complies with COPPA. Company goes beyond minimal procedures to prevent under-age use.

New York, NY – July 18, 2019 – The Children’s Advertising Review Unit (CARU) found that Snap, Inc. (“Snap”) takes effective measures to ensure that under-age children do not use its service. After carefully reviewing Snap’s procedures, CARU held that the company goes beyond the minimum requirements and incorporates higher-level safety design features to ensure that under-age children are not able to use Snapchat. Those procedures align with CARU’s Guidelines (“Guidelines”) that companies focus on implementing procedures to ensure privacy-by-design from the ground up, which it believes Snap does.

When it comes to technology, kids are often savvier than adults and it is almost impossible to prevent them from lying online about their age. Techniques that effectively restricted access and prevented children from breaching protections are quickly becoming obsolete. CARU believes that industry must constantly examine the dynamic digital landscape, continuously assessing the best ways to protect against breaching an age-gate, which today is literally “child’s play” for tech-savvy kids. Companies, therefore, must focus on implementing procedures to ensure privacy-by-design from the start.

In this case, CARU determined that Snapchat is an app directed to a general audience, not intended for use by children. In reaching this conclusion, CARU considered that Snap’s Terms of Service clearly prohibit users under 13 years of age and makes no effort to market the app to children or provide them with an appealing user experience.

With that understanding, Snapchat is permitted under the Guidelines and Children’s Online Privacy Protection Act (“COPPA”) to age-gate and block children under 13 from using its services, which it does. CARU then examined whether Snapchat does so effectively.

CARU found that the app employs an age-gate asking date of birth in a neutral manner and does not display text that implies a user needs to be over 13 years of age to register. In the past, CARU has typically recommended the use of a tracking mechanism to prevent a child from back-buttoning. However, after much consideration, CARU determined that in certain cases, such as Snapchat, a tracking mechanism may not be required.

“Age-gates are one piece of the larger compliance scheme. The cost of doing business in the kids space is implementing privacy-by-design and having a robust plan in place. This is not to say that age-gates should not be implemented. On the contrary, what we are saying is that we can do better and we should try to do better than the minimum bar. We don’t want to eliminate the use of age-gates, we want to see them used as part of a larger system to keep children safe on the internet,” says Dona Fraser, CARU’s vice president.

CARU believes companies that go beyond the low bar of age-gating to incorporate privacy-by-design and systematic procedures of trust and safety should be given due consideration regarding their efforts toward COPPA compliance. Where companies have a comprehensive culture of privacy, good faith efforts may outweigh strict adherence to principles that may have outlived their utility in certain instances.

CARU observed that Snapchat utilizes many safeguards to ensure that if children do breach the age-gate, they will not be able to remain active on the app. In fact, all app features that touch personal data are vetted collaboratively through the legal team, product engineers, and trust and safety representatives.

In reaching its determination, CARU gave credence to the tight systems Snap has implemented, that includes an easy, in-app reporting tool permitting users to flag accounts that are believed to be underage as well as a robust trust and safety team that investigates all such reports. CARU also considered that Snap does not receive a large number of complaints of underage users, unlike in the FTC’s TikTok investigation (referred by CARU) where the FTC relied heavily on the fact that TikTok received thousands of complaints from parents whose underage children had created accounts.

CARU also considered that as part of compliance with a Maryland Attorney General settlement and an FTC order, both decided in 2014, Snapchat continues to submit to biennial assessments of its privacy practices to each, for which it has not received another complaint.

In Snap’s advertiser’s statement, it expressed that it agreed to comply with all CARU’s recommendations. “Protecting the privacy and safety of our community, particularly minors, is of utmost importance to us. We do not encourage or permit those under the age of 13 on our platform. Snap accepts CARU’s thoughtful decision and agrees to comply with the recommendations. We appreciate CARU’s thorough evaluation of our platform and practices and look forward to working together to improve our safety tools and protections for children.”

CARU is an investigative unit of the advertising industry’s system of self-regulation, administered by the BBB National Programs (“BBB NP”), initiates and receives complaints about companies’ advertising and privacy practices. CARU determines whether such practices are in compliance with its Guidelines. The organization also monitors websites and mobile applications for compliance with its guidelines, including those addressing online privacy protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA.).

CARU’s inquiry was conducted under NAD/CARU/NARB Procedures for the Voluntary Self-Regulation of National Advertising. Details of the initial inquiry, CARU’s decision, and the advertiser’s response will be included in the next NAD/CARU Case Report.