COPPA requires sufficient, direct notice to parents or guardians regarding what information a website collects from children.
New York, NY – The Children’s Advertising Review Unit (CARU) of BBB National Programs launched an investigation into the KidGeni website, a generative AI art creator designed for children. The investigation, prompted by CARU’s routine monitoring activities, sought to determine if KidGeni’s platform complies with the Children’s Online Privacy Protection Act (COPPA) and CARU’s Privacy Guidelines.
KidGeni markets its website, which is based on generative AI technology, as “the best place for kids to turn inspirations into art, stories, and more.” KidGeni creates these art, stories, and images based on the text description provided by the child and the training data from the four open-source AI technologies KidGeni relies upon to operate: Open AI, Stability.ai, Replicate, and ElevenLabs.io.
During CARU’s investigation into KidGeni, CARU identified that extensive personal information is collected through account sign-up, subscription to the KidGeni newsletter, and website inputs without first obtaining verifiable parental consent (VPC) and it was unclear to CARU if KidGeni shares this personal information with the AI platforms it relies upon.
CARU also identified tracking technologies from third-party companies engaged in data collection for advertising purposes hosted on the KidGeni website with no prompt to provide VPC.
COPPA requires sufficient, direct notice to parents or guardians regarding what information a website collects from children, how it uses such information, and its disclosure practices for such information, and to use reasonable efforts using available technology to provide such direct notice. Privacy notices must be clearly and understandably written, complete, and must contain no unrelated, confusing, or contradictory materials.
When CARU opened this inquiry, the KidGeni website did not have a Privacy Policy posted on its website. Since then, KidGeni has posted a privacy policy that is incomplete, insufficient, and obscurely embedded in the copyright footer on the website.
As a result of these findings, CARU concluded that KidGeni violated multiple provisions of COPPA and CARU’s Privacy Guidelines by:
- Failing to provide clear notice of its information collection and use practices.
- Not making reasonable efforts to ensure parents/guardians receive direct notice of its practices regarding the collection, use, or disclosure of children’s personal information.
- Omitting a clearly labeled link to its online notice of children’s information collection on its website and at each point where personal information is collected from children.
- Failing to obtain parental consent before collecting children’s personal information.
- Not providing a reasonable means for parents to review and request the deletion of personal information collected from their children.
Due to these violations, CARU recommends KidGeni take the following corrective actions:
- Revise the website to provide clear, conspicuous notice to parents about data collection practices, including the use of AI technologies.
- Update the Privacy Policy to accurately reflect all data collection practices, including details on third-party data sharing and retention policies.
- Implement clear mechanisms for obtaining verifiable parental consent before any data collection from children.
- Ensure that user inputs, including from children, are not used to train AI models and that no personally identifiable information is collected or used for algorithm development.
In its advertiser’s statement, KidGeni stated it will comply with CARU’s recommendations and that it “appreciates the opportunity to address the concerns raised” and is “committed to ensuring our platform provides a safe and secure environment for our users.”
All BBB National Programs case decision summaries can be found in the case decision library. For the full text of NAD, NARB, and CARU decisions, subscribe to the online archive.
About Children’s Advertising Review Unit: The Children’s Advertising Review Unit (CARU), a division of BBB National Programs and the nation’s first Safe Harbor Program under the Children’s Online Privacy Protection Act (COPPA), helps companies comply with laws and guidelines that protect children from deceptive or inappropriate advertising and ensure that, in an online environment, children’s data is collected and handled responsibly. When advertising or data collection practices are misleading, inappropriate, or inconsistent with laws and guidelines, CARU seeks change through the voluntary cooperation of companies and where relevant, enforcement action.
About BBB National Programs: BBB National Programs, a non-profit organization, is the home of U.S. independent industry self-regulation, currently operating more than a dozen globally recognized programs that have been helping enhance consumer trust in business for more than 50 years. These programs provide third-party accountability and dispute resolution services that address existing and emerging industry issues, create a fairer playing field for businesses and a better experience for consumers. BBB National Programs continues to evolve its work and grow its impact by providing business guidance and fostering best practices in arenas such as advertising, child-and-teen-directed marketing, data privacy, dispute resolution, automobile warranty, technology, and emerging areas. To learn more, visit bbbprograms.org.
Join the conversation!