Firefly Games agreed to take corrective action in response to the Children’s Advertising Review Unit’s allegations that the company had violated COPPA by inaccurately (and confusingly) explaining its privacy practices. The app in question, LOL Surprise! Room Makeover, featured dolls and characters intended for children and animated characters. It also included content directed to adult users. CARU concluded as part of its routine reviews that, inter alia, the app was “mixed audience.” As such, the app needed to comply with not only CARU’s guidelines, but the Children’s Online Privacy Protection Act as well.

CARU reviewed both the company’s main privacy policy, as well as an app-specific privacy policy. CARU found that the two were inconsistent. For example, the main privacy policy did not describe collection and use of children’s information, while the app’s privacy policy did. The two policies were also inconsistent in their description of cookies, geo-location data, and other items. Moreover, CARU alleged, the policies did not accurately reflect the company’s actual practices. CARU found these inconsistencies a violation of COPPA insofar as parents were not given information about how children’s information would be used. CARU also found that there was no age verification process, and as such, no ability to obtain parental consent before collecting information from children under 13. Such age verification was needed under COPPA, CARU stated, as the site was found to be a mixed audience site.

In response to CARU’s concerns, Firefly Games noted that the app had passed Google’s review process for family advertising. CARU found this unpersuasive, stating “that an app developer cannot rely on a platform’s guidelines or requirements as a substitute for complying with the CARU Ad Guidelines.” Firefly Games agreed to take corrective action to address CARU’s concerns.

Putting It Into Practice: This case is a reminder that mixed audience sites are expected to have a process for obtaining verifiable parental consent if collecting personal information from children. Additionally, it serves as a caution to child-directed and general audience websites alike to ensure that privacy statements are consistent, and are an accurate reflection of actual practices.