In considering a toy website’s online promotion, the Children’s Advertising Review Unit recommended that the company improve its privacy practices in order to comply with the Children’s Online Privacy Protection Act (COPPA) and CARU guidelines.

A toy-centered YouTube channel featured an advertisement for miniature monsters called Zomlings that stated: “Kids, did you know that for a limited time the first 1,000 people can sign up to receive a free Zomlings Blind Bag. Just go to whatnottoys.com/ryan.”

The WhatNot Toys website featured information about the company and its products. To receive the free toy package, visitors had to fill out an online form that requested first and last names as well as email and street addresses. The form included a message that read, “Sign up today, but if you are under 13, please be sure to ask your parents for permission!”

At the bottom of the page appeared, in very small print, the following: “By submitting this form you are granting WhatNot Toys … permission to email you. You may unsubscribe via the link found at the bottom of every email.”

In reviewing the promotion, CARU expressed concern that the website did not effectively age-screen and obtain parental consent before allowing children to provide personally identifiable information (PII) for the toy giveaway signup.

The advertiser responded that it believed the promotion was in compliance with both COPPA—which requires notice and parental consent before collection of PII from those under the age of 13—and the CARU guidelines because of the disclaimer telling visitors to ask their parents for permission.

But the self-regulatory body explained that the disclaimer was insufficient.

“CARU does not consider a statement telling children they must be 13 or over to submit information to be a sufficient method of determining age for the purposes of complying with its age-screening provisions,” according to the decision. “Websites and online services must specifically ask for the age or birthdate of the visitor in order to determine his or her age. It must also use a neutral method to determine age and not include any tip-off language that might encourage a child to falsify his or her answer.”

The advertiser’s website was not in compliance with either COPPA or the CARU guidelines because it did not give proper notice and failed to obtain parental consent before collecting PII from children in exchange for a complimentary toy and their agreement to receive future promotional communications from the company, CARU concluded.

“Requesting that children ask their parents for permission is not a defined method of providing notices to parents to obtain parental consent,” the self-regulatory body wrote.

In response to the inquiry, WhatNot Toys removed the noncompliant form and agreed to follow CARU’s recommendations to use an effective age-screen, provide notice and obtain parental consent before collecting PII for promotional purposes. CARU added that any parental notice needs to “explicitly and prominently” disclose the fact that the promotion includes retaining the information for future promotional communications—the “tiny” written disclosure the advertiser used at the bottom of the page was not sufficient.

To read CARU’s press release about the decision, click here.

Why it matters: The lesson for advertisers is clear: Both COPPA and the CARU guidelines require notice and parental consent prior to the collection of personal information of those under the age of 13, and a suggestion to ask a parent for permission will not suffice. Instead, websites must specifically ask for the age or birth date of visitors and use a neutral method that will not tip off children to falsify their answers, CARU explained.