CARU Recommends Build-a-Bear Workshop Modify Child-Directed Site To Better Protect Children’s Privacy

New York, NY – Jan. 13, 2009 – The Children’s Advertising Review Unit of the Council of Better Business Bureaus (CARU) has recommended that Build-A-Bear Workshop modify its Website, www.buildabear.com, to better protect the privacy of child visitors. The company has agreed to do so.

CARU, the children’s advertising industry’s self-regulatory forum, monitors Websites for compliance with CARU’s Self-Regulatory Program for Children’s Advertising, including guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA).

The Website came to the attention of CARU through broadcast advertising, aired during children’s programming, which directed viewers to the Website.

Upon its initial review, CARU was concerned that the Website allowed a visitor under the age of 13 to submit an email address to sign up for an e-newsletter without first sending a notice to a parent. CARU also found that visitors seeking to register for the site’s Stuff Fur Stuff Club could click the browser’s back button and change their dates of birth to reflect an age over 13 and then continue and enter personally identifiable information.  Finally, CARU found that the site, as part of its e-card feature, collected personally identifiable information (PII) from children under 13 and allowed them to disclose PII in an e-card without first obtaining prior parental consent.

In response to CARU’s inquiry, the operator implemented neutral age-screening which included a session cookie to prevent users under 13 from going back and changing their ages and modified the e-card feature so that it no longer retains a visitor’s email address to send an e-card at a future date, no longer collects the e-card sender’s email address and no longer allows visitors to disclose PII in a message area.

Build-A-Bear Workshop, in its operator’s statement, said it “shares CARU’s goals for ensuring children’s safety and privacy on the Internet. The Company welcomed the opportunity to work with CARU through the self-regulatory process to ensure its web site is compliant with the Guidelines and COPPA and is pleased with the satisfactory conclusion of CARU’s inquiry.”