CARU Recommends SandyLion Modify Website To better Protect Children’s Privacy; Company Agrees To Do So

New York, NY – August 18, 2009 – The Children’s Advertising Review Unit of the Council of Better Business Bureaus has recommended that Sandylion Sticker Designs modify the Website www.kids.sandylion.com, to better protect the privacy of children. The company has agreed to do so.

The Website came to the attention of the Children’s Advertising Review Unit of the Council of Better Business Bureaus (CARU) through its routine monitoring practices.  CARU monitors Websites for compliance with CARU’s Self-Regulatory Program for Children’s Advertising, including guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA).

The Website is designed for children who collect Sandylion stickers.  The homepage features colorful sticker characters and, from the homepage, visitors can choose to play games, and participate in activities such as puzzles and coloring pages. 

When CARU first reviewed the Website, the registration page required users to enter a first name, last name, and date of birth.  In addition to entering a date of birth, those who wanted to become a member had to click on one of two circles.  The first stated, “I am 13 or older,” and the second stated, “I am under 13 (Requires Parent or Guardian).”

If a child marked that his age was under 13, he was presented with a “parent registration form” that asked for the parent’s first name, last name, country, screen name, email, and password.  The operator then sent an email to the parent, requiring the parent to click on a link to activate the account. 

The child could circumvent the need to fill out the parent registration form by clicking the back button, entering a date of birth that made him over 13, and clicking the circle that stated, “I am 13 or older.” 

Upon its initial review of the site, CARU was concerned at the inclusion of “tip-off” language in the age-screening process, lack of a session cookie in accordance with the age-screening process and the collection of personally identifiable information (PII) from children under 13 without obtaining verifiable parental consent.

After receipt of CARU’s inquiry letter, the operator eliminated the entire registration process and has revised its Website policies. The operator stated that it no longer asks for any information from its Website visitors; visitors to the Website are unable to post information, and there is no information shared with third parties.  The operator removed the language stating that it shared PII with third parties from its privacy policy. 

The company, in its operator’s statement, said it accepts the CARU decision in its entirety.  “Sandylion shares CARU’s goals for ensuring children’s safety and privacy on the Internet and appreciates the opportunity to work with CARU to ensure its web site is compliant,” the company said.