CARU Reviews Advertising For Website Operated by Candlewick Press, Inc.

New York, NY – Dec. 29,  2008 – The Children’s Advertising Review Unit (CARU) of the Council of Better Business Bureaus, Inc., has recommended that Candlewick Press, Inc., the operator of the Website modify the site to assure it is in compliance with CARU’s self-regulatory program for children’s advertising and the federal Children’s Online Privacy Protection Act (COPPA.) The company has taken steps to do so.

CARU, the children’s advertising industry’s self-regulatory forum, reviewed the Website pursuant to CARU’s ongoing monitoring program. CARU monitors Websites for compliance with CARU’s Guidelines and COPPA.

Upon its initial review, a CARU staff member attempted to register as a child under 13 years of age and was unable to continue with the registration process without entering a parent’s e-mail address.  However, the staff member was able to re-register successfully seconds later by clicking the “Back” option and submitting a date of birth that made her over 13.  The site did not employ a tracking mechanism to prevent underage children from going back and changing their age to circumvent age-screening as required by CARU’s Guidelines. Additionally, in the field marked, “Please confirm your age,” users could choose either, “Yes, I am 13 or over,” or “No, I am under 13.” 

Further, when registering as a child under 13 and providing a parent’s e-mail address, a visitor could enter other forms of Personally Identifiable Information (PII) on the registration page, including an address and a mobile phone number.   The e-mail sent to the parent requests that the recipient click on a link to verify the child’s membership.   There was no additional information collected from the parent or follow up procedures performed to establish consent.

In response to CARU’s initial inquiry, Candlewick stated its intention to bring the Website into compliance with CARU’s Guidelines.  The operator agreed to revise its registration and data collection processes to address each of CARU’s concerns. 

The operator designed a registration process that removes any possible tip-off information for the potential registrant.  The operator asserted that the new process also contains a tracking mechanism to prevent the registrant from going back and changing his or her age to circumvent the age screening.

With respect to the collection of registrants’ phone numbers and addresses, Candlewick decided to remove those fields.   Candlewick noted that the data collected had never been used and that they did not have plans to use it in the future.  Under the new registration, the only PII collected will be the potential member’s birth date, full name, e-mail address and parent’s e-mail address for those under 13 seeking to register.  A user name, password and country will also be collected at the point of registration.  According to the operator, if the date of birth entered corresponds to an age below 13, potential members cannot proceed without entering a parent’s e-mail address.

Candlewick stated that, through the revised procedure, a parent will be sent an e-mail about the child’s membership and collection of PII.  The parent will be asked to verify the child’s membership by clicking on a link included in the e-mail.  A follow up e-mail will be sent to confirm the approval and to offer information about revoking the consent.

CARU noted that it appreciated Candlewick’s immediate modifications.

The company, in its advertiser’s statement, said it “accepts CARU’s decision in its entirety” and “values CARU’s role in safeguarding the online experience of children.”