Self-regulatory organization CARU routinely monitors child-directed content for the purpose of protecting children (for COPPA purposes, that means anyone under 13 years old) from manipulative or deceptive content. Earlier this week, CARU issued a decision finding that Outright Games, the developer of Bratz Total Fashion Makeover (a “mixed-audience” match 3 puzzle game), violated COPPA. According to the decision, the game included social media integration, in-app purchases, and behavioral targeting, and forced users to watch and engage with ads and install additional content, all in violation of COPPA and CARU’s Advertising and Privacy Guidelines.

Determining whether a game is directed at children is based on a balancing of factors test. Considerations include visuals, subject matter, and language, among other factors. A child-directed game is a game that targets children as its primary audience. In contrast, a mixed audience game is one that does not target children as its primary audience, but one that children might play. Per COPPA, CARU, and the FTC guidelines, apps (and games) that are directed at “mixed audiences” must adopt technical safeguards and measures to prevent access to the app (or game) without obtaining verifiable parental consent. As part of that process, there must be some means to prevent children from changing their age to bypass the parent gate, such as a session cookie.

Here, the Bratz Total Fashion Makeover game asked for the user’s age, allegedly without verifiable parental consent. If the user was under 13 years of age, they were prompted to view the “parent gate,” which asked for the consent of an adult (the user’s parent or legal guardian) to agree to the terms of use and privacy policy. However, there was no additional step required to prove that parental consent was obtained. Child users could also make unlimited attempts to change their age in contravention of the above guidelines.

As part of the decision, CARU also determined that Outright Games’ privacy policy was “unclear, incomplete, and at times contradictory.” Under COPPA, a privacy policy must be clearly and conspicuously linked on the home page or menu of an app (or game). According to CARU, the game’s privacy policy did not clearly disclose at the top that it collects children’s personal information or that there is a specific section of the privacy policy dedicated to children’s personal information. Further, per CARU, when users tried to access the game settings (where the privacy policy and terms of use were linked), the users were prompted to input their age and the age prompt button was non-functional unless they input an age that was 13 or older.

CARU recommended that Outright Games take several corrective actions including (1) providing a neutral and effective age-screen and (2) providing clear and understandable notice of its children’s data collection and use practices. In response, Outright Games created and provided CARU with a detailed plan consistent with the corrective actions to remedy their noncompliance. This decision demonstrates the importance of complying with COPPA and CARU guidelines within “mixed audience” games.