Key findings in investigation of popular children’s website
GATINEAU, QC, March 25, 2015 – The Office of the Privacy Commissioner of Canada’s first-ever investigation of a website aimed at young children highlighted the need for extra caution in protecting children’s privacy rights.
The investigation looked at the privacy practices of Ontario-based Ganz in operating Webkinz.com, a website aimed at children aged 6 to 13.
A pioneer in web-enabled plush toys called “Webkinz,” Ganz promotes the toys and the accompanying “Webkinz World” through the Webkinz.com website. The website allows users to open a free account by creating a virtual pet and then add other pets through the purchase of Webkinz. Children can care for their pets online, play games, complete tasks, earn virtual money and chat online.
The investigation was conducted under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.
The OPC opened a complaint against Ganz having reasonable grounds to believe the company was collecting, using and retaining the personal information of children through its user registration process, without fully explaining its purposes for doing so, or obtaining appropriate knowledge and consent. The scope of the complaint was expanded as the OPC had reasonable grounds to believe that Ganz was allowing third-party advertisers to track and profile children for the purposes of serving online behavioural advertising.
The investigation found that, although Ganz had undertaken a number of important steps to try to protect the privacy of its young users, there was still room for improvement. Ganz fully cooperated with the investigation and agreed to implement measures to address the OPC’s recommendations.
The OPC made a total of 11 recommendations and Ganz committed to implement measures to address all of those recommendations within nine months.
A few of the key issues identified in the investigation included the need to:
- Avoid the collection of children’s personal information wherever possible;
- Be careful about the “inadvertent” collection of personal information;
- Consider the target audience of the website service and use age-appropriate language, and interactive and innovative techniques to communicate with them;
- Ensure that children understand the importance of involving a parent or guardian in certain processes, e.g., in accepting a website’s terms and conditions;
- Monitor the practices of third-parties communicating and interacting with users;
- Provide privacy information in the language(s) in which the website is offered.
The investigation highlighted concerns about the need for greater clarity during the account registration process.
During registration on the Webkinz website, a child-friendly avatar called ‘Miss Birdy’ guides users through the process, using a combination of simple verbal instructions and text.
In response to OPC recommendations, Ganz agreed to add clearer language to the registration process and use its avatar to prompt children to have their parents or guardians review and ‘accept’ the terms of the documents.
Collection of personal information
During the course of the investigation, Ganz took steps to reduce the amount of personal information it collected from children opening accounts, by ceasing to collect certain information (such as the province of residence) and making other information optional (such as a user’s gender).
However, the OPC continued to have concerns that the remaining elements of personal information being collected could, when combined together, result in Ganz being able to identify children opening and operating Webkinz accounts.
One particular concern was the creation of user names. When a child registers for an account, the avatar warns the child not to incorporate their real name within the new user name.
An analysis of a sample of user names conducted by the OPC found that approximately 16 percent contained combinations of letters and numbers which appeared to include first names, initials and last names, or last names. Even if a relatively small percentage of the millions of user accounts contained users’ real names, the personal information of a significant number of children would be collected.
Ganz agreed to implement changes so that it would stop collecting personal information from new users opening accounts.
Monitoring of third-parties present on the site
The investigation raised concerns with respect to the activities of advertising networks and other third-parties on the website.
Ganz prohibits advertising networks and advertisers from tracking children on the Webkinz website for the purposes of building online profiles and serving online behavioural advertising. While the OPC found no evidence of online behavioural advertising on the website, testing showed that – unbeknownst to Ganz – advertisers appeared to be tracking and potentially profiling children visiting the website.
Ganz’s lack of awareness of the cookie and advertising practices of third parties on the website suggested a need for the company to improve its monitoring of such activities.
Ganz agreed to adopt appropriate, systematic, and regular due diligence procedures to ensure that advertising networks and other third parties are not setting tracking cookies on the computers of website users for the purposes of building profiles for advertising purposes, or otherwise conducting online behavioural advertising.
French language information
Subsequently, however, the company decided it would offer the website in English only, and posted a message indicating that new content would only be in English. A French registration tab directed users to an English language account sign-in page – raising concerns that existing francophone users may not have access to accurate and up to date information about Ganz’s privacy practices.
While Ganz introduced an account deletion option during the investigation, the OPC also made recommendations that it improve and better communicate the website’s data retention and destruction policies and procedures, particularly with respect to archived, inactive, user accounts. Ganz agreed to address the recommendations.
- Date modified: