The Children’s Online Advertising Review Unit (CARU) recommended that Magic Box International modify its Web site,, to better protect children’s online privacy and come into compliance with the Children’s Online Privacy Protection Act (COPPA).

A television commercial for Go Go Crazy Bones toy figures directed users to visit the company’s site, which was geared toward children aged 4 to 13.

The site included a feature, Club Go Go’s, that required users to register in order to create their own characters, play games, and upload photos. Registration required the user to provide an e-mail address, user name, password, country and state, and users could also opt-in to receive an e-mail newsletter from the site.

There was no request for a parent’s e-mail address, and the site itself contained hyperlinks to follow Go Go Crazy Bones on Twitter.

CARU expressed concern that the site collected personally identifiable information without first obtaining verifiable parental consent, and that the Twitter link could lead to inappropriate content for children under 13.

Because the Twitter Web site “is not intended for use by children under 13 years of age and the site does not age screen to determine the age of its visitors before allowing them to register and provide personally identifiable information,” CARU determined that the hyperlinking was not in compliance with its guidelines.

Magic Box agreed to remove the link to Twitter from its site, the panel said.

CARU also said the collection practice violated both its guidelines and COPPA even though the site said the registration information was only used internally and was not publicly disclosed or shared with third parties.

Going forward, Magic Box will only collect a parent’s e-mail address during the registration process and will not allow children to sign up to receive the Club Go Go’s e-mail newsletter.

Why it matters: “Operators of Web sites for children or children’s portions of general audience sites should not knowingly link to pages of other sites that do not comply with CARU’s guidelines,” the panel noted. In addition, sites “collecting personally identifiable information from visitors under the age of 13 must obtain consent from parents prior to collecting such information.”