Acting on a request from the Children's Advertising Review Unit, Build-A-Bear Inc. removed links on its home page to Pinterest and Twitter and updated what it called a "glitch" that allowed children under 13 to enter personal information without parental consent.
CARU viewed a commercial for the teddy bear retailer which directed viewers to its Web site, http://www.buildabear.com/. The company said the site is intended for adults who can learn more about Build-A-Bear workshops, and where they can select a stuffed animal, assemble it, fill it with stuffing, and add clothing and accessories. CARU noted that visitors can play bear-themed games on a brightly colored Web site that contains various images of different stuffed animals.
To create an account on the site, users must enter a name, e-mail address, password, and date of birth. Those under 13 must also enter a parent's e-mail address. But when CARU visited the site, the self-regulatory group discovered that a registrant could simply click the "back" button and change the birth date to avoid having to enter a parental e-mail.
In addition, CARU noted that the center of the home page features a yellow blimp reading "Follow Us!" with hyperlinks to Facebook, Pinterest, Twitter, and YouTube.
CARU expressed concern with certain hyperlinks and the simplicity with which viewer could evade age-screening on the site, which violated CARU's Guidelines and the Children's Online Privacy Protection Act. Both prohibit the operators of Web sites from collecting personal information from children under the age of 13 absent parental consent.
Responding to the inquiry letter, Build-A-Bear informed CARU that the age-gate cookie was accidentally overwritten when the site ran an update. Build-A-Bear assured CARU that the session cookie had been restored and was working again.
As for the hyperlinks, CARU noted that the links were on the front page of the Web site. Therefore, users could take advantage of the links before being age-screened. While Facebook and YouTube conduct their own age-gating, neither "Pinterest nor Twitter does age-screening and children are able to input personally identifiable information," the decision noted. Accordingly, CARU determined that Build-A-Bear violated its Guidelines by posting hyperlinks to "inappropriate websites" like Pinterest and Twitter that do not include an age-screen.
Build-A-Bear said that it was "not aware" that Twitter and Pinterest did not use an age gate on the site and agreed to remove the links unless they were placed behind an age-screening mechanism in compliance with CARU's Guidelines.
To read the press release from CARU about the decision, click here.
Why it matters: "Where a Website has a reasonable expectation that a significant number of children under the age of 13 will be visiting the site, neutral age-screening mechanisms should be employed, including a tracking device to prevent underage visitors from circumventing the age screening," CARU recommended. In addition, operators should consider whether links to other sites – including social media networks – are available to users prior to age-screening and if so, whether those sites conduct their own age check. If not, such links should be removed or moved behind the age screen to avoid running afoul of CARU.