News Release
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Commissioner cautions children’s websites to tread carefully when it comes to privacy
Privacy Commissioner launches tips on protecting children’s privacy after website investigation highlights lessons such as the need for better, age-appropriate information and involvement of adults in privacy decisions
GATINEAU, QC, March 25, 2015 – Children’s websites must act with extra prudence to protect the privacy rights of Canada’s youngest Internet users, says Privacy Commissioner Daniel Therrien.
“Websites targeted at young children must tread carefully,” says Commissioner Therrien. “The privacy protection bar needs to be set extremely high when it comes to collecting or using children’s personal information.”
The Office of the Privacy Commissioner of Canada (OPC) today released a list of key tips for services aimed at children.
The tips are drawn from the findings in a few OPC investigations related to young people and involving issues such as a webcam service used by a private daycare centre; Nexopia, a social networking site for youth; and the privacy practices of Ontario-based Ganz in operating its website, Webkinz.com.
The findings offer lessons for other companies that operate sites aimed at children. For example:
- Don’t collect children’s personal information unless you absolutely need it and be careful about inadvertent collection of personal information – for example, via the creation of user names.
- Make sure that younger users are able to understand the privacy information you provide – or that they understand the need to involve an adult in making decisions.
- Make clear who needs to agree to terms and conditions; children should not be expected to “agree” to legalistic language.
In addition to the tips, the OPC also posted to its website today the report of findings related to the investigation related to the Webkinz.com website.
The site promotes “Webkinz” plush toys and the accompanying “Webkinz World.” The website is ranked as the 15th most popular website for kids by eBizMBA with an estimated 800,000 unique visitors per month. It is aimed at children aged six to 13 years and allows users to create and care for a virtual pet, play games, complete tasks, earn virtual money and chat online.
Commissioner Therrien complimented Ganz for having considered its target audience and undertaken a number of important steps aimed at trying to protect users’ privacy. For example, a child-friendly avatar, ‘Miss Birdy,’ helped guide children through the registration process, using a combination of simple spoken instructions and text. The company also made efforts to try to avoid collecting the personal information of children.
However, the investigation also identified areas where the site could take further measures to protect the privacy of children.
In particular, the investigation found that Ganz did not use age-appropriate language to clearly tell children that they needed to involve their parents when registering on the site. As well, it was unclear during the registration process that a parent or guardian – not a child – was expected to agree to the website’s terms and policies.
Legislation currently before Parliament, Bill S-4, the Digital Privacy Act, includes a proposed provision that aims to enhance the concept of valid consent. The OPC believes it is a useful clarification of what constitutes meaningful consent under PIPEDA and emphasizes the need for organizations to clearly specify what personal information they are collecting and why in a manner that is suited to the target audience.
The Ganz investigation also underscored the importance of minimizing, if not eliminating the need for, the collection of personal information of children. In this case, Ganz sometimes inadvertently collected full names of children through the creation of user names. Ganz also collected other personal information, including location, date of birth, first name and parents’ email addresses. The OPC was concerned that user names, combined with other information, could lead to the identification of its young users. The company ultimately came to the conclusion that it did not need to collect certain information from children opening accounts.
Testing on the website also showed that – unbeknownst to Ganz – advertisers appeared to be tracking and potentially profiling children on the website, although there did not appear to be evidence of targeted advertising based on users’ surfing habits.
The OPC found that, while a French version of the website was available, Ganz’s privacy policy was not provided in French. Ganz advised the French privacy policy had been inadvertently removed and corrected the problem. Subsequently, the company decided to offer the website in English only. A French registration tab directed users to an English sign-in page – raising concerns that existing francophone users may not have access to accurate privacy information. The OPC recommended Ganz reinstate and update French versions of its user agreement and privacy policy and the company agreed to do so.
“We appreciated Ganz’s cooperation throughout our investigation and the fact the company has agreed to implement our recommendations,” says Commissioner Therrien. “Operators of other websites aimed at children should take note of this investigation and our new tips document and ensure that they are adequately addressing privacy issues as they relate to children.”
About the Office of the Privacy Commissioner of Canada
The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada. The Commissioner enforces two laws for the protection of personal information: the Privacy Act, which applies to the federal public sector; and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private sector privacy law.
See also:
Collecting from kids? Ten tips for services aimed at children and youth
Backgrounder – Ganz investigation
Report of Findings – Ganz investigation
Research Paper – Surveillance Technologies and Children
- 30 -
Media contact (Journalists are asked to please send requests via e-mail)
Valerie Lawton, Office of the Privacy Commissioner of Canada
E-mail: Valerie.Lawton@priv.gc.ca
- Date modified: