CARU Recommends WS Publishing Group Modify Privacy Practices for ‘Friendzy’ Apps; Company Agrees to Do So

New York, NY –  April 6, 2016  – The Children’s Advertising Review Unit (CARU) has recommended that WS Publishing Group, Inc., owner of the educational “Friendzy” mobile applications, modify certain practices to better protect children’s privacy. The company has agreed to do so.

CARU is an investigative unit of the advertising industry’s system of self-regulation. It is administered by the Council of Better Business Bureaus.

CARU monitors websites and online services for compliance with CARU’s Self-Regulatory Program for Children’s Advertising (the guidelines) including guidelines on Online Privacy Protection, as well as with the federal Children’s Online Privacy Protection Act (COPPA).

Following its initial review, CARU was concerned that the apps collected personally identifiable information (PII) from children under 13 without prior parental consent during registration, allowed children under 13 to disclose PII through its find/invite friends feature without prior parental consent and that the apps’ privacy policy appeared to be inconsistent with its privacy practices.

For online services that are intended for use by children and adults, age-gating mechanisms are used to ascertain whether parental notice and consent requirements are necessary for a particular user.

In this case, the app did not request a parent’s email to send notice and acquire consent.  Instead, it required the visitor to answer a math question (e.g. 2 x 8 =?) choosing from six possible answers.  CARU determined that a skill-testing math question was not a sufficient method for ascertaining age.

CARU’s Guidelines and COPPA require that operators must obtain verifiable parental consent before they collect or allow disclosure of PII from children under 13 years of age.  PII includes, but is not limited to, first and last name, online contact information, such as email addresses, and a phone number.

To register for an account with Friendzly, users had to enter a full name, username, password and email address followed by country, city, zip code and grade. Once registered, children could invite friends via a text message or email and those friends would be allowed to register once they had answered a math question. CARU noted that it did not consider that practice a reliable method for obtaining parental consent. CARU determined that the app did not effectively obtain verifiable parental consent prior to collecting or allowing the disclosure of PII.

Finally, CARU determined that the app’s privacy policy did not comply with COPPA because it contained inaccurate and contradictory information.

In response to CARU’s inquiry, the operator agreed to:

• Modify its registration process so that the default tab is set to “Student” and remove the fields that collected last name and email address.
• Remove its invite-a-friend feature.
• Update its privacy policy to accurately reflect its privacy practices.

In its operator’s statement, the company said that it is “committed to ensuring a safe online experience for children specifically in connection with Friendzy apps.”

The company added that it “accepts CARU’s decision and has agreed to change its Friendzy apps according to CARU’s recommendations in order to make the apps fully compliant with the guidelines of both CARU and COPPA.”