Research analysis of rules, laws, and/or regulations surrounding app and website marketing to children in the United States, the United Kingdom, the European Union, and Australia, has been provided below. Overall, overtly granular guidelines which would or could answer questions like ‘Can you embed a link to the app in the ad itself?’ or ‘Can only give an app name and a download location?’ were not uncovered during the research process. The majority of countries reviewed have implemented regulations related to major initiatives developed like the COPPA Act (in the US) and general GDPR (General Data Protection Regulation) provisions.
Additionally, major mobile marketplaces (like the App Store from Apple, YouTube Kids, and the Play Store from Google) provide guidance for apps and sites developed for children. Complete analysis from these sources on a country-by-country basis was not feasible during the research process, however have been provided for reference and review.
Also, UNICEF has produced two in-depth papers which look at this topic. Links to both are provided to allow for full review. In 2018, “Children and Digital Marketing: Rights, Risks and Responsibilities” was released. Though older (and uncovered late in the research process), the 2016 “Advertising & Marketing to Children Global Report” provides a review of regulations for 37 countries (some of which are covered in this research).
Finally, much of this research is provided verbatim from sources as it is essential due to the nature of legality surrounding the topic.
Table of Contents
UNITED STATES
In the United States, children are protected by the Children’s Online Privacy Protection Act (COPPA) which was enacted by Congress in 1998. Full text of the code can be reviewed here, however highlights (provided verbatim) are included below:
- The code “prohibits unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.”
- A child is defined as “an individual under the age of 13.”
- The regulation covers apps as well as websites. “Internet means collectively the myriad of computer and telecommunications facilities, including equipment and operating software, which comprise the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.”
- “§312.3 — Regulation of unfair or deceptive acts or practices in connection with the collection, use, and/or disclosure of personal information from and about children on the Internet.
- General requirements. It shall be unlawful for any operator of a Website or online service directed to children, or any operator that has actual knowledge that it is collecting or maintaining personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under this part. Generally, under this part, an operator must:
- (a) Provide notice on the Website or online service of what information it collects from children, how it uses such information, and its disclosure practices for such information (§312.4(b));
- (b) Obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children (§312.5);
- (c) Provide a reasonable means for a parent to review the personal information collected from a child and to refuse to permit its further use or maintenance (§312.6);
- (d) Not condition a child’s participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity (§312.7); and
- (e) Establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children (§312.8).”
- “§312.7 — Prohibition against conditioning a child’s participation on collection of personal information. An operator is prohibited from conditioning a child’s participation in a game, the offering of a prize, or another activity on the child’s disclosing more personal information than is reasonably necessary to participate in such activity.”
- “§312.8 — Confidentiality, security, and integrity of personal information collected from children. The operator must establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children. The operator must also take reasonable steps to release children’s personal information only to service providers and third parties who are capable of maintaining the confidentiality, security and integrity of such information, and who provide assurances that they will maintain the information in such a manner.”
Iubenda, a leading online legal resource and compliance solutions provider, provides the following layman interpretations of the code requirements:
- “The Rule applies to operators of commercial websites and online services (again, it includes mobile apps) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. “
- “The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Let us dissect this catalogue
- Operators of commercial websites and online services directed to children under 13 that collect, use, or disclose personal information from children.
- It also applies to: operators of general audience websites or online services if they have actual knowledge that they are collecting, using, or disclosing personal information from children under 13.
- And it applies to: Operators of commercial websites and online services directed to children under 13 that collect, use, or disclose personal information from children.
- And it applies to: websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.”
Advertising within a game, app, or website, though, has some inherent issues.
- According to a study conducted by Jenny Radesky, an assistant professor of developmental behavioral pediatrics at the University of Michigan Medical School, in 1998, many of the apps designed for children under the age of 5 contained “pop-up ads with disturbing imagery” and as many as “95% of commonly downloaded apps marketed to be played by children ages 5 and under contain at least one type of advertising.”
- The study concluded that “many of these examples seemed to violate FTC rules around unfair and deceptive advertising.”
- Researchers and family advocates deem these types of advertisements “violate Section 5 of the Federal Trade Commission Act, which bans unfair and deceptive business practices.”
- In response to the study, “a Google spokesperson said app developers can show ads so long as they agree to comply with privacy laws and the company’s policies, such as barring advertisers from collecting information on users under 13.”
- Google provides guidance for Android developers via their Designed for Families program which outlines best practices in developing apps for children audiences.
- In late 2019, Apple made changes to its internal regulations as they relate to targeting children. “Kids apps on Apple’s App Store will be banned from using external analytics software — invisible lines of code that collect extremely detailed information about who is using an app and how. Apple is also severely curtailing their ability to sell ads, which underpins the business model that results in many apps being free. The changes were prompted in part by some children viewing inappropriate ads, Apple says.”
UNITED KINGDOM
A briefing paper to the United Kingdom House of Commons dated November 20, 2020, outlines regulations surrounding advertising to children. As with the US data, much of this data is provided verbatim to guard against misinterpretation.
- ” The Advertising Codes contain strict rules to protect children (and young people) from potentially misleading, harmful or offensive material. For example, the rules:
- prohibit advertisements from depicting children in hazardous situations or encouraging them to engage in dangerous behaviour;
- and prevent advertisements from undermining parental authority or placing unfair pressure on children to buy products.”
- “The Advertising rules are regularly reviewed and updated by the ASA.”
- “The Advertising Codes are written and maintained by two industry bodies:
- The Committee of Advertising Practice (CAP) — The CAP is responsible for the UK Code of Non-Broadcast Advertising, Sales Promotion and Direct Marketing, known as the CAP Code.
- The Broadcast Committee of Advertising Practice (BCAP) — The BCAP is responsible for the “UK Code of Broadcast Advertising”, known as the BCAP Code.”
- “5.6 Promotions addressed to or targeted directly at children:
- 5.6.1 Must make clear that adult permission is required if a prize or an incentive might cause conflict between a child’s desire and a parent’s, or other adult’s, authority
- 5.6.2 Must contain a prominent closing date if applicable (see rule 8.17.4)
- 5.6.3 Must not exaggerate the value of a prize or the chances of winning it.
- 5.7 Promotions that require a purchase to participate and include a direct exhortation to make a purchase must not be addressed to or targeted at children.”
Additional parameters set forth in the CAP Code include:
- A child is defined as someone under the age of 16.
- “5.3 Marketing communications addressed to or targeted directly at children:
The Advertising Standards Authority Ltd. (ASA) actively monitors advertising on children’s websites and YouTube channels. A November 20, 2020, report on their activities includes the following:
- A published list of offending websites and a commitment to engage “directly with advertisers found to have breached the rules.”
- The most recent sweep was conducted over a three-month period (July to September 2020) and used “monitoring tools to capture age-restricted ads served on a sample of 49 websites and 7 YouTube channels attracting a disproportionately high child audience.” During that time frame, the ASA:
- “identified further instances where the ad rules were broken
- (is) taking follow-up action to contact the advertisers whose ads broke the rules to secure the removal of the problem ads; and
- warned the advertisers to review and, as necessary, amend their practices to ensure they target future ads responsibly”
EUROPEAN UNION
The European Advertising Standards Alliance (EASA) states the “majority of the national advertising codes which are enforced by the self-regulatory bodies are based on the International Chamber of Commerce (ICC) Consolidated Code of Advertising and Marketing Communication Practice (2018). The ICC Code contains several provisions regarding advertising to children like article 18 ‘Children and young people’ and article D5 ‘Digital marketing communications and children’ created because children are often very adept at adopting new technologies, media and devices ” and further that “most European self-regulatory organizations in EASA membership have developed additional rules aimed at protecting children, including recommendations to not advertise products to children that are deemed unsuitable, such as alcoholic beverages, gambling, or foods and drinks that are high in fat, sugar and salt.” Though not country specific, the ICC code is used as a baseline for many national codes in the EU.
Article 18 of the ICC Code lays out the following (verbatim):
- “Special care should be taken in marketing communications directed to or featuring children or teens.
- Such communications should not undermine positive social behaviour, lifestyles and attitudes.
- Products which are illegal for children or teens to purchase or are unsuitable for them should not be advertised in media targeted to them.
- Marketing communications directed to children or teens should not be inserted in media where the editorial matter is unsuitable for them.
- For rules on data protection relating specifically to children’s personal data see article 19.
- For other specific rules on marketing communications with regard to children:
- with respect to direct marketing and digital marketing communications see chapter C, article C7
- within the context of food and non-alcoholic beverages see the ICC Framework for responsible food and beverage marketing communications
With regard to data privacy, the following is set forth in Article 19 of the ICC Code:
- “When personal data is collected from individuals known or reasonably believed to be children, guidance should be provided to parents or legal guardians about protecting children’s privacy if feasible.
- Children should be encouraged to obtain a parent’s or responsible adult’s consent before providing personal data via digital interactive media, and reasonable steps should be taken to check that such permission has been given.
- Only as much personal data should be collected as is necessary to enable the child to engage in the featured activity. A parent or legal guardian should be notified and consent obtained where required.
- Personal data collected from children should not be used to address marketing communications to them, the children’s parents or other family members without the consent of the parent.
- Personal data about individuals known or reasonably believed to be children should only be disclosed to third parties after obtaining consent from a parent or legal guardian or where disclosure is authorized by law. Third parties do not include agents or others who provide technical or operational support to the marketer and who do not use or disclose children’s personal data for any other purpose.
- For additional rules specific to marketing communications to children using digital interactive media, see chapter C, article C7.”
In terms of marketing to children, including the marketing of apps, the ICC Code provides the following in Chapter C:
- “Parents and/or guardians should be encouraged to participate in and/or supervise their children’s interactive activities.
- Personal data about individuals known to be children should only be disclosed to third parties after obtaining consent from a parent or legal guardian or where disclosure is authorized by law. Third parties do not include agents or others who provide support for operational purposes of the website and who do not use or disclose a child’s personal information for any other purpose.
- Websites devoted to products that are subject to age restrictions such as alcoholic beverages, gambling and tobacco products should undertake measures, such as age screens, to restrict access to such websites by minors.
- Marketing communications directed at children in a particular age group should be appropriate and suitable for such children.”
Additionally, the “Audiovisual Media Services Directive 2010/13/EU includes rules for the protection of minors that apply to all audiovisual services. In particular, article 9.2 of the Directive exhort Member States and the Commission to encourage media service providers to develop codes of conduct regarding inappropriate audiovisual commercial communications for foods and drinks that are high in fat, sugar and salt, aired around or in children’s programmes.”
AUSTRALIA
The Australian Association of National Advertisers (AANA) has adopted a code as it applies to marketing to children. This self-regulated code helps to “ensure that advertisers and marketers develop and maintain a high sense of social responsibility in advertising and marketing to children in Australia.”
- “Children means persons 14 years old or younger and Child means a person 14 years old or younger.”
- “Advertising or Marketing Communication to Children:
- (a) must not mislead or deceive Children;
- (b) must not be ambiguous; and
- (c) must accurately represent, in a manner that is clearly understood by Children: (i) the advertised Product; (ii) any features (including the size and performance of the product) which are described or depicted or demonstrated in the Advertising or Marketing Communication; (iii) the need for and the price of any accessory parts; and (iv) that the Advertising or Marketing Communication is in fact a commercial communication rather than program content, editorial comment or other non-commercial communication.
- (d) Price. (i) Prices, if mentioned in Advertising or Marketing Communication to Children, must be accurately presented in a way which can be clearly understood by Children and must not be minimized by words such as “only” or “just”; (ii) Advertising or Marketing Communication to Children must not imply that the Product being promoted is immediately within the reach of every family budget.
- “Advertising or Marketing Communication to Children must not use popular personalities or celebrities (live or animated) to endorse, recommend, promote or advertise or market Products or Premiums in a manner that obscures the distinction between commercial promotions and program or editorial content.”
- “If an Advertising or Marketing Communication indicates that personal information in relation to a Child will be collected, or, if as a result of an Advertising and Marketing Communication, personal information of a Child will or is likely to be collected, then the Advertising or Marketing Communication must include a statement that the Child must obtain a parent or guardian’s express consent prior to engaging in any activity that will result in the collection or disclosure of such personal information. Personal information is information that identifies the child or could identify the child.”
Ad Standards is tasked with monitoring and enforcing the codes set forth in the AANA guidelines as well as from other regulatory bodies.
