The Children’s Advertising Review Unit (CARU) of BBB National Programs recently announced it completed an investigation into Kidgeni, a generative artificial intelligence (AI) art creator website designed for children. CARU’s determined that Kidgeni is directed to children under 13 and is not in compliance with the Children’s Online Privacy Protection Act (COPPA) or CARU’s Privacy Guidelines.

Kidgeni allows users to create art, stories, and images based on text descriptions provided by the user and data from four open-sourced AI technologies. Users must create an account to use the site, which enables Kidgeni to collect, retain, and disseminate children’s data. Specifically, CARU found that Kidgeni collects personal information from children through account sign-ups, subscriptions to the Kidgeni newsletter, and additional website inputs without obtaining verifiable parental consent.

Kidgeni did not initially have a Privacy Policy listed on its website at the beginning of CARU’s investigation; when a Privacy Policy was later posted, CARU found it to be incomplete, insufficient, and difficult for users to find.

CARU recommended Kidgeni take certain corrective action, including: providing clear, conspicuous notice to parents about Kidgeni’s data collection practices; updating their Privacy Policy to reflect all data collection, retention, and sharing policies; implementing better mechanisms for obtaining parental consent prior to collecting children’s data; and ensuring children’s inputs and personally identifiable information is not used to train AI models.

Kidgeni acknowledged CARU’s findings and indicated they were actively working to address the issues CARU highlighted.

We previously wrote about a new compliance warning issued by CARU on AI in Child-Directed Advertising and Data Collection here. With the rise of AI-related lawsuits and regulators’ focus on Children’s Privacy laws violations, website operators directed at children 13 years of age and younger should evaluate their policies and practices to ensure compliance with COPPA and CARU’s Privacy Guidelines.