CARU Reviews Advertising For Website Operated By Flow Play

New York, NY – Dec. 5,  2008 – The Children’s Advertising Review Unit (CARU) of the Council of Better Business Bureaus, Inc., has recommended that Flow Play, Inc., operator of the Website www.ourWorld.com, modify the site to assure it is in compliance with CARU’s self-regulatory guidelines for children’s advertising and the federal Children’s Online Privacy Protection Act (COPPA.) The company has taken steps to do so.

CARU, the children’s advertising industry’s self-regulatory forum, reviewed the Website pursuant to CARU’s ongoing monitoring program.

The Website offered free and paid online memberships to play games and participate in a virtual world. To register, a visitor was required to enter a username, email address and a password.  The Website collected a date of birth using a drop down menu.  A registered user could enter, play games, and visit virtual worlds.  

If a member identified herself as under the age of 13 during the registration process and attempted to send an internal email, enter live open chat or post information on her personal profile, a message box appeared stating:  “Enter a parent’s email.  Let us know you are legit!  Get a parent to respond to the email confirmation to enable open chat and messages.” 

If a child entered a parent’s email address to “enable open chat and messages,” an email was sent to the parent stating, “If you want to allow your child to use regular chat or send and receive messages with their friends online, you can change their settings by clicking on the URL below which contains the parental management code.”  When a CARU staff member clicked on the link it was not operational.

When CARU surveyed the Website it observed that players could disclose personally identifiable information (PII) in the virtual world areas and on the internal message system.

CARU was concerned that the Website collected online contact information from children under 13 without providing proper notice to a parent and concerned that the Website allowed children to post information in chat rooms and through the internal messaging system without first obtaining proper verifiable parental consent.

At the outset of CARU’s inquiry, the operator contended that it was not required to obtain verifiable parental consent for users under the age of 13 because it utilized a filtering system for all the areas on the Website where users could disclose PII. The operator noted that the filtering system was in place for all its members regardless of age and that the parental verification process was an added safety measure. 

Further, the operator noted that the site has two chat levels: Easy Chat and Open Chat.  It stated that children under 13 who register are allowed to use the Easy Chat feature (which allows players to select from a limited selection of phrases), until a parent approves use of Open Chat and other features. The operator said that both chat levels had a filtering system to prevent improper language and PII. 

CARU, in its decision, noted that under the terms of COPPA, an operator is required to obtain verifiable parental consent before any collection and/or disclosure of personal information from children.

The collection of a child’s email address for the purpose of responding more than once to a specific request, such as a request for service, may fall within COPPA’s exceptions to the requirement for verifiable parental consent if the Website notifies a parent of the request and provides the opportunity to opt-out of the collection.  

In the alternative, COPPA allows an operator to collect online contact information and immediately alter it so that it can no longer be reconstructed in its original form, providing that the process is explained in the site’s privacy policy.  

Following its review, CARU determined the operator collected a child’s email address at registration without providing parents with proper notice at the time of its collection. Further, the operator did not alter the child’s email address so that it could not be reconstructed in its original form and explain this process clearly in its privacy policy.  Accordingly, CARU determined that the Website’s collection practice did not comply with COPPA or its guidelines.

To comply with CARU’s guidelines and COPPA, FlowPlay modified its filtering system to prevent users under the age of 13 from disclosing PII including street addresses and telephone numbers in the chat rooms, profiles and on the internal messaging system.

Further, the operator confirmed that it now collects and alters the child’s email address upon registration so that the address cannot be re-constructed in its original form.  The operator also agreed to amend its privacy policy to clearly and conspicuously explain this process.

The company, in its operator’s statement, said it appreciates “the work of CARU and BBB and [has] taken CARU’s recommendations to heart in revising both our user experience and policies.”