The American Licorice company was recently asked to modify its “Sour Extinguisher” web site to ensure the web site's data collection mechanisms were compliant with federal rules and guidelines. The decision, by the Children’s Advertising Review Unit (CARU), enforces the Online Privacy Protection guidelines contained in CARU’s Self Regulatory Program for Children’s Advertising, as well as the rules maintained in the Children’s Online Privacy Protection Act (COPPA).

CARU monitors web sites to ensure compliance with its guidelines, as well as for the compliance with COPPA. In its review, it found problems with the web site, www.sourextinguisher.com, operated by American Licorice, which essentially functions as an advertisement for the company’s “Sour Extinguisher” candies. The web site is a playful experience, arguably tailored to children and teens. The home page of the site contains colorful, animated depictions of “Sour Extinguisher” candies, as well as humorous music and sounds. The troubling aspect of the web site was a game that allowed users to extinguish floating candies with an object that appears to be a fire extinguisher. When the game ended, the player was asked to register on the site in order to submit his score.

CARU reviewed the web site and found that the registration process required visitors to provide their birth month, birth day and birth year, which is in line with the requirements of COPPA. The problem, however, was with the next step of the registration process: If a visitor entered a date of birth that demonstrated he was below the age of thirteen, he received a message stating that “We are sorry, you have to be 13 years of age or older to enter.” Then, the site allowed the visitor to try to register again by submitting a date of birth that was older than thirteen. The visitor could then complete the registration process by submitting “significant” personally identifiable information, such as their first and last name, city, state, zip code, email address, pin and username.

CARU was concerned with the web site’s lack of tracking mechanism in connection with the age-screening process, as well as the inclusion of the tip-off language that essentially told users that they must be thirteen to sign up. These steps contradict the Online Privacy Protection guidelines provided by CARU in its Self Regulatory Program for Children’s Advertising, which require advertisers to ask age screening questions in a “neutral manner so as to discourage inaccurate answers” from children who do not want to obtain parental consent. These guidelines also require age-screening mechanisms to be used in conjunction with technology, such as a session cookie, to prevent underage children from going back and changing their age to circumvent the age-screening mechanism.

American Licorice has since disabled the registration portion of the game, so that all users may play without providing personally identifiable information to the company.

This case demonstrates CARU’s diligence in monitoring compliance by web sites targeted to children, as well as a reminder of the requirements maintained in its Online Privacy Protection guidelines.