Privacy Policies on Kids’ Favourite Web Sites Jacquie Burkell, University of Western Ontario Valerie Steeves, University of Ottawa

Children’s Online Privacy Protection Act Sites directed at children Sites directed at children Privacy policy Privacy policy Verifiable parental consent for children Verifiable parental consent for children under 13 years of age under 13 years of age

Personal Information Protection and Electronic Documents Act Consent-based information regime Consent-based information regime Openness about information practices Openness about information practices Legal guardian can consent for minor Legal guardian can consent for minor

Is Web Use Supervised? COPPA and PIPEDA provide for and COPPA and PIPEDA provide for and even assume parental involvement for even assume parental involvement for consent consent BUT, in 2005… BUT, in 2005… only 13% of children surveyed are “mostly” with an adult when using the Internet only 13% of children surveyed are “mostly” with an adult when using the Internet Among the youngest respondents (grades Among the youngest respondents (grades 4-5), 73% are “sometimes” or “usually” alone when they use the Internet 4-5), 73% are “sometimes” or “usually” alone when they use the Internet

Transparent Information Practices Transparent Information Practices + Voluntary Disclosure = Informed consent

Overview How accessible are privacy policies on How accessible are privacy policies on the sites kids visit? the sites kids visit? How easy are they to understand? How easy are they to understand?

Kids’ Favourite Sites 5,272 kids 2,800 favourite sites Over 25% picked Neopets Over 25% picked Addictinggames

Kids’ Favourite Sites Game sites Game sites Multimedia/streaming sites Multimedia/streaming sites Special interest sites Special interest sites Shopping sites Shopping sites Television sites Television sites Only 1% were sites directed at children Only 1% were sites directed at children

The Top 50 Sites Represent over one-half of all choices Represent over one-half of all choices 50 of 50 (100%) are commercial sites 50 of 50 (100%) are commercial sites 45 of 50 (90%) ask kids to register 45 of 50 (90%) ask kids to register 47 out of 50 (94%) collect personal 47 out of 50 (94%) collect personal information information 48 out of 50 (96%) have privacy policies* 48 out of 50 (96%) have privacy policies* * As of September, 2005; one additional site has added a privacy policy since that date

An accessible policy is … An accessible policy is … Linked directly from the home page Linked directly from the home page Immediately visible on the home page Immediately visible on the home page Emphasized to be highly visible Emphasized to be highly visible Clearly labeled to identify content Clearly labeled to identify content

Is there a privacy policy? 48 of 50 (96%) have a link to a privacy 48 of 50 (96%) have a link to a privacy policy policy 1 site has a ‘dead link’ 1 site has a ‘dead link’ 1 site has no link, no policy 1 site has no link, no policy

How many links to the policy? 3 websites with 2 links to the policy 3 websites with 2 links to the policy 45 websites with 1 link 45 websites with 1 link 1 website with a link, no policy 1 website with a link, no policy

Can you see it immediately? First page, no scrolling: 21 First page, no scrolling: 21 1,2, or 3 screenlengths of scrolling: 18 1,2, or 3 screenlengths of scrolling: 18 More than 3 screenlengths scrolling: 9 More than 3 screenlengths scrolling: 9 1 site has a link, but not on the home 1 site has a link, but not on the home page page

Where is the link? Top: 7 Top: 7 centre: 2 centre: 2 right: 5 right: 5 Side Navigation: 2 Side Navigation: 2 Bottom: 39 Bottom: 39 centre: 29 centre: 29 left: 10 left: 10 Not on home page: 1 Not on home page: 1

How visible are the links? Unique, highly visible: 5 Unique, highly visible: 5 Primary navigation/Key link: 3 Primary navigation/Key link: 3 Secondary navigation: 16 Secondary navigation: 16 Fine Print: 22 Fine Print: 22 Minimized: 3 Minimized: 3

How are the links labelled? 47 of the 49 links use the word ‘privacy’ 47 of the 49 links use the word ‘privacy’ Privacy Privacy Privacy policy Privacy policy Safety and privacy Safety and privacy 2 of the 49 do not 2 of the 49 do not Terms and Conditions Terms and Conditions Legal Legal

Doing it right: Doing it right: Candystand Candystand Candystand Kazaa Kazaa Kazaa

Making it hard to find: Making it hard to find: Newgrounds Newgrounds Newgrounds

The rest of the picture… Getting to the policy is only the first step Getting to the policy is only the first step Privacy policies must be understood by Privacy policies must be understood by the users the users

An understandable policy is… Relatively short Relatively short Written at an appropriate reading level Written at an appropriate reading level Easy to navigate, with appropriate sub- Easy to navigate, with appropriate sub- headings headings Self-contained (does not require linking Self-contained (does not require linking out) out)

How long are the policies? Average word count: 1902 Average word count: 1902 Minimum: 121 Minimum: 121 Minimum: 121 Minimum: 121 Maximum: 6414 Maximum: 6414 Maximum: 6414 Maximum: 6414

What is the reading level? Flesch Reading Level (60-70 is acceptable for Flesch Reading Level (60-70 is acceptable for adult readers, higher is better) adult readers, higher is better) Average: Average: Best: 58.9 (ebaumsworld) Best: 58.9 (ebaumsworld)ebaumsworld Worst: 23.3 (flowgo) Worst: 23.3 (flowgo)flowgo Flesch Reading Level (Grade 8 is acceptable Flesch Reading Level (Grade 8 is acceptable for adult readers) for adult readers) Average: Average: Minimum: 9.1 (mxtabs) Minimum: 9.1 (mxtabs)mxtabs Maximum: 12 (msn) Maximum: 12 (msn)msn

What about navigation? No navigation aids: 5 (NBA) No navigation aids: 5 (NBA)NBA Text Headings: 35 (msn) Text Headings: 35 (msn)Text Headings: 35msnText Headings: 35msn Linked Navigation: 8 (CHUM) Linked Navigation: 8 (CHUM)CHUM

What about linking out? 25 sites have self-contained privacy 25 sites have self-contained privacy policies policies 1 links to other pages on the site (miniclip) miniclip 24 are on a single page (neopets) neopets 23 sites require linking out for complete 23 sites require linking out for complete privacy information privacy information (ebaumsworld) ebaumsworld

Privacy policies on kids’ favourite sites are… Not uniformly easy to find Not uniformly easy to find Long Long Written at a high reading level Written at a high reading level Difficult to navigate Difficult to navigate

If a web site has a privacy policy, you can be sure they will not share any personal information they collect from you with others.

On the websites kids visit, finding out about privacy is relatively difficult… BUT Disclosing personal information is NOT

Disclosure is… Easy Easy Ubiquitous Ubiquitous Fun Fun Seamless Seamless Tied to kids developmental needs Tied to kids developmental needs

The good news… The sites kids visit usually have privacy The sites kids visit usually have privacy policies policies

The bad news Policies are not easy to find Policies are not easy to find Once found, many policies are long, and Once found, many policies are long, and written at a level too difficult for children written at a level too difficult for children and many adults and many adults Many policies are difficult to navigate Many policies are difficult to navigate Many policies are not self-contained Many policies are not self-contained

The worst news In contrast, disclosure of information is In contrast, disclosure of information is made easy, fun, and natural made easy, fun, and natural

We need a new approach To ensure that privacy policies are read To ensure that privacy policies are read To ensure that privacy policies are To ensure that privacy policies are understood understood To ensure that decisions about privacy To ensure that decisions about privacy are directly linked to disclosure are directly linked to disclosure