Backgrounder
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Key findings in investigation of popular children’s website
GATINEAU, QC, March 25, 2015 – The Office of the Privacy Commissioner of Canada’s first-ever investigation of a website aimed at young children highlighted the need for extra caution in protecting children’s privacy rights.
The investigation looked at the privacy practices of Ontario-based Ganz in operating Webkinz.com, a website aimed at children aged 6 to 13.
A pioneer in web-enabled plush toys called “Webkinz,” Ganz promotes the toys and the accompanying “Webkinz World” through the Webkinz.com website. The website allows users to open a free account by creating a virtual pet and then add other pets through the purchase of Webkinz. Children can care for their pets online, play games, complete tasks, earn virtual money and chat online.
The site is hugely popular with children – ranked as the 15th most popular website for kids by eBizMBA with an estimated 800,000 unique visitors per monthFootnote 1.
The investigation was conducted under the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.
The OPC opened a complaint against Ganz having reasonable grounds to believe the company was collecting, using and retaining the personal information of children through its user registration process, without fully explaining its purposes for doing so, or obtaining appropriate knowledge and consent. The scope of the complaint was expanded as the OPC had reasonable grounds to believe that Ganz was allowing third-party advertisers to track and profile children for the purposes of serving online behavioural advertising.
The investigation found that, although Ganz had undertaken a number of important steps to try to protect the privacy of its young users, there was still room for improvement. Ganz fully cooperated with the investigation and agreed to implement measures to address the OPC’s recommendations.
The OPC made a total of 11 recommendations and Ganz committed to implement measures to address all of those recommendations within nine months.
A few of the key issues identified in the investigation included the need to:
- Avoid the collection of children’s personal information wherever possible;
- Be careful about the “inadvertent” collection of personal information;
- Consider the target audience of the website service and use age-appropriate language, and interactive and innovative techniques to communicate with them;
- Ensure that children understand the importance of involving a parent or guardian in certain processes, e.g., in accepting a website’s terms and conditions;
- Monitor the practices of third-parties communicating and interacting with users;
- Inform users of the actual privacy practices of the website and explain what practices apply to which website, if more than one site is covered by a user agreement or privacy policy; and
- Provide privacy information in the language(s) in which the website is offered.
Registration process
The investigation highlighted concerns about the need for greater clarity during the account registration process.
Parental involvement
During registration on the Webkinz website, a child-friendly avatar called ‘Miss Birdy’ guides users through the process, using a combination of simple verbal instructions and text.
When users sign up for an account, written text instructs users to read and accept the terms of the Ganz user agreement, privacy policy, and ad policy. However, the avatar did not tell children to get a parent or legal guardian to review the lengthy and complex user agreement and policies.
In response to OPC recommendations, Ganz agreed to add clearer language to the registration process and use its avatar to prompt children to have their parents or guardians review and ‘accept’ the terms of the documents.
Collection of personal information
During the course of the investigation, Ganz took steps to reduce the amount of personal information it collected from children opening accounts, by ceasing to collect certain information (such as the province of residence) and making other information optional (such as a user’s gender).
However, the OPC continued to have concerns that the remaining elements of personal information being collected could, when combined together, result in Ganz being able to identify children opening and operating Webkinz accounts.
One particular concern was the creation of user names. When a child registers for an account, the avatar warns the child not to incorporate their real name within the new user name.
An analysis of a sample of user names conducted by the OPC found that approximately 16 percent contained combinations of letters and numbers which appeared to include first names, initials and last names, or last names. Even if a relatively small percentage of the millions of user accounts contained users’ real names, the personal information of a significant number of children would be collected.
Ganz agreed to implement changes so that it would stop collecting personal information from new users opening accounts.
Ganz also agreed to modify its registration process, so that when parents agree to the terms of its user agreement and the privacy policy, they will be advised of the policy against including real names and other personal information in user names. The parent would also be given the opportunity to review their child’s chosen user name.
Monitoring of third-parties present on the site
The investigation raised concerns with respect to the activities of advertising networks and other third-parties on the website.
Ganz prohibits advertising networks and advertisers from tracking children on the Webkinz website for the purposes of building online profiles and serving online behavioural advertising. While the OPC found no evidence of online behavioural advertising on the website, testing showed that – unbeknownst to Ganz – advertisers appeared to be tracking and potentially profiling children visiting the website.
Ganz’s lack of awareness of the cookie and advertising practices of third parties on the website suggested a need for the company to improve its monitoring of such activities.
Ganz agreed to adopt appropriate, systematic, and regular due diligence procedures to ensure that advertising networks and other third parties are not setting tracking cookies on the computers of website users for the purposes of building profiles for advertising purposes, or otherwise conducting online behavioural advertising.
French language information
The OPC found that, while a French version of the website was available, Ganz’s privacy policy was not provided in French. Ganz advised that the French privacy policy had been inadvertently removed and immediately corrected the problem.
Subsequently, however, the company decided it would offer the website in English only, and posted a message indicating that new content would only be in English. A French registration tab directed users to an English language account sign-in page – raising concerns that existing francophone users may not have access to accurate and up to date information about Ganz’s privacy practices.
As a result, the OPC recommended Ganz reinstate and update French versions of its user agreement and privacy policy. The company agreed to do so.
Other issues
The investigation found that Ganz’s privacy policy applied to several different websites some of which were aimed at older youth and adults. It was unclear what privacy practices applied to which website. There was also some confusion about the actual practices regarding the collection, use, and disclosure of personal information on the Webkinz.com website. Ganz agreed to revise its privacy policy to provide more clarity and transparency on these issues.
While Ganz introduced an account deletion option during the investigation, the OPC also made recommendations that it improve and better communicate the website’s data retention and destruction policies and procedures, particularly with respect to archived, inactive, user accounts. Ganz agreed to address the recommendations.
See also:
Collecting from kids? Ten tips for services aimed at children and youth
- Date modified: