Regulatory policy

Smart Watch Maker settles with CARU privacy policy and parental consent | Sheppard Mullin Richter & Hampton LLP

The Children’s Advertising Review Unit recently settled with TickTalk Tech, LLC its information collection practices. CARU, a self-regulatory body that enters into voluntary agreements with companies, conducts regular audits of companies’ privacy practices in the Kid’s Zone. During one such audit, he identified concerns with TickTalk Tech’s children’s smartwatch, TickTalk4.

In particular, CARU was concerned that the product’s privacy policy was not visible and did not explain in an easy-to-understand way how children’s information would be used. While parents were informed in the on-screen advertisement that the watch had geolocation tracking services, the privacy statement did not clearly explain, for example, what information would be passively collected from children. CARU noted that although the company made efforts to obtain consent during the product registration process, consent was meaningless because parents could not tell from the privacy policy what were its practices. The lack of valid consent and the unclear disclosures were, according to CARU, a violation of both its guidelines and COPPA. To address the issue, the company committed to:

  • ensure that its privacy policy clearly discloses its data collection practices regarding children;
  • ensure that the privacy policy is visible and not hidden or difficult to find for parents;
  • explain its data retention and deletion policies regarding children’s data;
  • explain how parents can limit the use of their children’s data; and
  • Obtain verifiable parental consent before collecting information about children.

put into practice: This regulation recalls that companies must ensure that they clearly and precisely describe their information collection practices in their confidentiality policies. This is especially true for products aimed at children. This regulation also reminds that CARU is actively studying the compliance of connected devices with its directives and COPPA. Both require, among other things, obtaining parental (informed) consent before collecting information online from children.