Children’s Advertising Review Unit Finds KidGeni in Violation of COPPA and CARU’s Privacy Guidelines; Issues Compliance Recommendations

New York, NY – August 6, 2024 - The Children’s Advertising Review Unit (CARU) of BBB National Programs launched an investigation into the KidGeni website, a generative AI art creator designed for children. The investigation, prompted by CARU’s routine monitoring activities, sought to determine if KidGeni’s platform complies with the Children’s Online Privacy Protection Act (COPPA) and CARU’s Privacy Guidelines.  

KidGeni markets its website, which is based on generative AI technology, as “the best place for kids to turn inspirations into art, stories, and more.” KidGeni creates these art, stories, and images based on the text description provided by the child and the training data from the four open-source AI technologies KidGeni relies upon to operate: Open AI, Stability.ai, Replicate, and ElevenLabs.io.

During CARU's investigation into KidGeni, CARU identified that extensive personal information is collected through account sign-up, subscription to the KidGeni newsletter, and website inputs without first obtaining verifiable parental consent (VPC) and it was unclear to CARU if KidGeni shares this personal information with the AI platforms it relies upon. 

CARU also identified tracking technologies from third-party companies engaged in data collection for advertising purposes hosted on the KidGeni website with no prompt to provide VPC.

COPPA requires sufficient, direct notice to parents or guardians regarding what information a website collects from children, how it uses such information, and its disclosure practices for such information, and to use reasonable efforts using available technology to provide such direct notice. Privacy notices must be clearly and understandably written, complete, and must contain no unrelated, confusing, or contradictory materials. 

When CARU opened this inquiry, the KidGeni website did not have a Privacy Policy posted on its website. Since then, KidGeni has posted a privacy policy that is incomplete, insufficient, and obscurely embedded in the copyright footer on the website.

As a result of these findings, CARU concluded that KidGeni violated multiple provisions of COPPA and CARU’s Privacy Guidelines by:

• Failing to provide clear notice of its information collection and use practices. 
• Not making reasonable efforts to ensure parents/guardians receive direct notice of its practices regarding the collection, use, or disclosure of children's personal information.
• Omitting a clearly labeled link to its online notice of children's information collection on its website and at each point where personal information is collected from children.
• Failing to obtain parental consent before collecting children's personal information.
• Not providing a reasonable means for parents to review and request the deletion of personal information collected from their children.

Due to these violations, CARU recommends KidGeni take the following corrective actions: 

• Revise the website to provide clear, conspicuous notice to parents about data collection practices, including the use of AI technologies. 
• Update the Privacy Policy to accurately reflect all data collection practices, including details on third-party data sharing and retention policies.
• Implement clear mechanisms for obtaining verifiable parental consent before any data collection from children.
• Ensure that user inputs, including from children, are not used to train AI models and that no personally identifiable information is collected or used for algorithm development.

In its advertiser’s statement, KidGeni stated it will comply with CARU’s recommendations and that it “appreciates the opportunity to address the concerns raised” and is “committed to ensuring our platform provides a safe and secure environment for our users.”  

All BBB National Programs case decision summaries can be found in the case decision library. For the full text of NAD, NARB, and CARU decisions, subscribe to the online archive.