As part of routine monitoring practices, The Children’s Advertising Review Unit (“CARU”) recently referred the maker of “My Friend Cayla Party Time” children’s doll and its related “My Friend Cayla App” owned and operated by Genesis Toys, to the FTC after the company did not respond to CARU’s initial privacy inquiry.
“Cayla” is an 18 inch doll that talks and interacts with Children. The doll connects via Bluetooth to the App, and the website contains product information, instructions, videos and information about how to purchase the doll, and a privacy policy.
The following issues formed the basis of CARU’s inquiry:
- Whether the app collects personally identifiable information in the form of name, address, geolocation, persistent identifiers and audio recordings of a child’s voice without first giving notice to parents of its actions or obtaining verifiable parental consent as required by COPPA and the Guidelines.
- Whether the Privacy Policy contains a complete description of what information the operator collects from children, how it uses that information and how that information may be disclosed.
- Whether Genesis provides information about third parties that collect and use children’s voice recordings.
- Whether the Privacy Policy contains adequate contact information.
- Whether the Privacy Policy provides procedures for a parent to review, have the child’s personal information deleted or for parents to refuse to permit further collection or use of such personal information.
- Whether Genesis provides a prominent link to a Privacy Policy on the homepage of its website or anywhere within its app.
- Whether the operator provides direct notice to parents of its information practices, including direct notice of any material changes to those practices.
- Whether Genesis employs reasonable security measures, such as authentication within the app, to ensure there is no unauthorized use of the doll.
- Whether Genesis follows COPPA’s deletion and data retention requirements.
- Whether Genesis’ packaging for the doll is deceptive because it does not explain to parents that children’s personal information can be collected and represents that the doll is equipped with “Kid Safe Internet.”
The matter is under review by the FTC and the results should be followed by children’s toy product manufacturers generally and those that include audio/voice recordation in particular, given the FTC’s and regulator’s increasing focus on the industry’s compliance with children’s privacy rules.