Toys and Products Affecting Children:

Information and Consumer Education

Hybrid Issues & Potential Synergies

November, 2013

Lima, Peru

Deon Woods Bell

Office of International Affairs

U.S. Federal Trade Commission

Order of Discussion

• 1) Toys and Children’s Products Misrepresentations

• 2) Health Claims and Green Issues

• 3) Internet of Things Products & Information Security

• 4) Games and Apps

• 5) Dot Com Disclosures, Mobile Apps Report & Endorsement Guidelines

• 6) Consumer and Business Education

• 7) Violent Video Game Marketing

The views expressed are the presenter’s and do not necessarily reflect those of the Commission.

Toy and Children’s Products

Misrepresentations

• Cases involve false advertising or exaggerated claims of toy performance in advertising targeting children

• Violates Section 5 of the FTC Act through “deceptive acts or practices.”

• Older cases, but children’s targeted marketing still presents issues.

Toy and Children’s Products

Misrepresentations In the Matter of Grey Advertising, Inc. (1996) • FTC charged that company engaged in deceptive

toy advertising. • Hasbro, Inc. settled and paid $280,000 penalty. • This was third time Hasbro charged with

misrepresenting toys. – In 1993, Hasbro paid $175,000 penalty over “G.I. Joe

Battle Copter” and “Eco-Warrior” toy advertising. – In 1978, Hasbro paid a $40,000 penalty over deceptive

advertising for “Digger Dog” and “Bulletman” toys.

Toy Misrepresentations In the Matter of Grey Advertising, Inc. (1996)

• Hasbro commercial represented that kids can operate “Colorblaster” paint spraying toy with very little effort.

• Instead Hasbro used motorized air compressor during filming to provide pressure necessary to operate toy with ease and to achieve results shown in commercial.

• Toy itself required significant manual labor.

Parade of Toys Settle "Operation

Trade Name Games" Charges

FTC v. Parade of Toys, Inc., et al. (1998) • Parade of Toys, Inc. misrepresented their affiliation with well-known

companies; their access to thousands of hot, licensed products; and the earnings consumers would make.

• The defendants used phony references or shells to endorse the businesses and to repeat the earnings claims made by the defendants.

• The settlement order bans Parade of Toys’ principal from selling business ventures;

• Requires him to pay redress in an amount to be determined based upon the resolution of a state court action involving Parade of Toys.

• Bans the company’s officers from advertising, promoting or selling any franchise or business venture and from making misrepresentations in the sale of franchises or business ventures and from violating the FTC's Franchise Rule.

http://www.ftc.gov/opa/1998/01/paradtoy.shtm

SUBSTANTIATION

HEALTH CLAIMS AND

GREEN ISSUES

• Prince Lionheart is a California-based company which sold an electronic mosquito repellant device called the “Love Bug.” The device is battery operated, looks like a toy, and is designed to clip onto a stroller or baby carrier. The product was sold primarily through catalogs and baby products stores.

In their advertising for the “Love Bug,” the respondents made statements such as: • “Love Bug repels mosquitoes by electronically

duplicating the wingbeat of the dragonfly – the mosquito’s mortal enemy!”

• “Love Bug is as effective as costly sprays or lotions but without the mess and potential danger to infants with skin sensitive to strong chemicals.”

• “Helps protect your Baby from WEST NILE VIRUS!”

Lionheart – Alleged Deception

The consent agreement prohibits the respondents from making false or unsubstantiated claims that any electronic mosquito repellant product using sonic or ultrasonic technology: • Repels mosquitoes from a baby or any person; • Is an effective alternative to chemical repellants; or • Protects babies or other persons from contracting the West Nile virus.

The consent agreement also requires the respondents to have adequate substantiation for any claim about the benefits, performance, or efficacy of any consumer electronic product they market. In addition, the settlement requires the respondents to send a copy of the order, together with a notification letter, to catalogs and other wholesale/retail sellers that have purchased the “Love Bug” since January 1, 2002. They also had to provide further information about effective mosquito repellents and protection against the West Nile virus is available on the Web site of the Centers for Disease Control, www.cdc.gov.

Lionheart – Settlement

Lionheart – Cross Border Issues

• Prince Lionheart sold the Love Bug both in the United States and in the EU through a UK subsidiary since 2002.

• This has raised concerns in many other countries. • FTC received communications from Spanish speaking

countries as recent as 2012.

Website advertisement for the Love Bug.

The FTC has published Green Guides, which are guides for the use of environmental marketing claims. http://www.ftc.gov/os/2012/10/greenguides.pdf

The “Green” Connection Business education materials

The “Green” Connection

Consumer education materials

Guides for costumers who want to buy products that are good for the environment and that use less energy. http://www.consumer.ftc.gov/blog/green-claim-check http://www.consumer.ftc.gov/features/feature-0013-going-green

Information Security – Four

Points that Guide the FTC’s

Enforcement • Information security is an ongoing process.

• A company’s security procedures must be reasonable and appropriate in light of the circumstances.

• A breach does not necessarily show that a company failed to have reasonable security measures – there is no such thing as perfect security.

• Practices may be unreasonable and subject to FTC enforcement even without a known security breach.

Early Cases – Some Common

Mistakes

• Storing information longer than needed or online when not necessary

• Using default or other easy-to-guess passwords • Storing or transmitting information (including passwords!)

in plain text • Failing to take steps to segment or restrict access to data • Failing to provide appropriate employee training and

oversight • Failing to take reasonable steps to detect or investigate

breaches

More recent cases show

• Early mistakes continue to occur.

• New vulnerabilities may become “commonly known” (e.g., P2P software).

• Security vulnerabilities in IP cameras and mobile apps could allow unauthorized access and control.

• A hacker accessed hundreds of camera feeds – Homes, Families and Babies Monitored

• TRENDnet: transmitted user login credentials in clear, readable text over the Internet; stored user login credentials in clear, readable text on user mobile devices; failed to implement a process to actively monitor security vulnerability reports; and failed to employ reasonable and appropriate security in the design and testing of the software that it provided consumers for its IP cameras.

18

TRENDnet – unreasonable

software design and testing • Did not perform security review and testing of the software at

key points, such as upon the release of a camera or the release of software for it, such as:

– a security architecture review;

– vulnerability and penetration testing of the software;

– reasonable and appropriate code review and testing of the software.

• Did not implement reasonable guidance or training for responsible employees.

19

TRENDnet – alleged deception

• Through its marketing statement and user interface, the Company represented that it had taken reasonable steps to ensure that (1) its cameras are a secure means to monitor private areas of a consumer’s home or workplace and (2) that a user’s security settings will be honored.

• Due to the Company’s alleged security failures, these representations constitute false or misleading claims.

20

TRENDnet – alleged unfairness

• The company failed to provide reasonable security to prevent unauthorized access to live IP camera feeds.

• The alleged security failures caused, or are likely to cause, substantial injury to consumers that is not outweighed by benefits and is not reasonably avoidable by consumers.

• Potential harms from the exposure of sensitive information through the IP cameras included an increased likelihood that (1) consumers or their property will be targeted for theft or other criminal activity or that (2) consumers’ personal activities and conversations or those of their family members, including young children, will be observed and recorded over the internet.

21

On September 4, 2013, announced its settlement agreement with TRENDnet, Inc,. • The settlement prohibits TRENDnet from misrepresenting the security of its

cameras or the security, privacy, confidentiality, or integrity of the information that its cameras or other devices transmit.

• FIRST CASE OF EVERYDAY PRODUCT WITH CONNECTION TO INTERNET – INTERNET OF THINGS

• The company is barred from misrepresenting the extent to which a consumer can control the security of information the cameras or other devices store, capture, access, or transmit.

• TRENDnet is required to establish a comprehensive information security program designed to address security risks that could result in unauthorized access to or use of the company’s devices, and to protect the security, confidentiality, and integrity of information that is stored, captured, accessed, or transmitted by its devices.

• The company also is required to obtain third-party assessments of its security programs every two years for the next 20 years.

• TRENDnet must notify customers about the security issues with the cameras and the availability of the software update to correct them, and to provide customers with free technical support for the next two years to assist them in updating or uninstalling their cameras.

http://www.ftc.gov/opa/2013/09/trendnet.shtm

TRENDnet – Settlement

Consumer Education Materials

Blog entries on the FTC’s Consumer Information website: http://www.consumer.ftc.gov/blog/false-lens-security

Guidelines on how to use IP cameras safely on the FTC’s Consumer Information website:

http://www.consumer.ftc.gov/articles/0382-using-ip-cameras-safely

Business Education Materials Guidelines on how to properly maintain financial data, personal information from kids, and material derived from credit reports and how to properly secure or dispose of sensitive consumer, employee information. http://business.ftc.gov/privacy-and-security

Internet of Things – Privacy & Security in a Connected World. On November 21, 2013, the FTC will be hosting a workshop dealing with the privacy and data security implications of the Internet of Things. The FTC has invited written comments on this issue in advance of the workshop and has provided a list of specific questions it is interested in. http://www.ftc.gov/opa/2013/04/internetthings.shtm

GAMES AND APPS

Children’s Data Protection

Legislation • Children's Online Privacy Protection Act

(COPPA) requires website operators to notify parents and obtain their consent before collecting, using, or disclosing personal information from kids under age 13.

• The revised COPPA Rule addresses changes in the way children use and access the Internet, including the increased use of mobile devices and social networking. The modified rule, widens the definition of children’s personal information to include persistent identifiers such as cookies that track a child’s activity online, as well as geolocation information, photos, videos, and audio recordings.

• http://www.ftc.gov/opa/2013/07/coppa.shtm

Children’s Data Protection Cases

United States v. W3 Innovations, LLC (2011)

• FTC’s first mobile app case

• Developer of iPhone/iPad apps.

• Apps featured “Emily” character and fashion games directed toward kids and listed in Games-Kids section of Apple App Store.

• Emily App encouraged kids to email Emily with comments, blogs, and “shout-outs” to friends.

• http://ftc.gov/opa/2011/08/w3mobileapps.shtm

Children’s Data Protection Cases United States v. W3 Innovations, LLC (2011) • FTC charged W3 with

violating COPPA and alleged W3 collected and disclosed personal info from tens of thousands of children under 13 including Emily app users’ emails and personal posts on message boards.

• W3 paid $50,000 to settle FTC charges.

Children’s Data Protection Cases United States v. RockYou, Inc. (2012)

• Over 32 million users

• RockYou website allowed users to assemble slide shows with their own photos and music supplied by website.

• To save slideshow, users gave email address and email password.

Children’s Data Protection Cases United States v. RockYou, Inc. (2012)

• FTC charged that RockYou violated COPPA by knowingly collecting email addresses and passwords from 179,000 kids under 13 and enabling kids to post slide shows that could be shared online.

• Settlement bars company from making claims of data security, requires implementation of data security program, and charged $250,000 penalty.

• http://www.ftc.gov/opa/2012/03/rockyou.shtm

Children’s Data Protection Cases

United States v. Jones O. Godwin (2011)

• “Skid-e-kids” site advertised as a Facebook and MySpace for kids.

• Targeted kids ages 7-14 allowing them to create profiles, post public comments and photos, and add and message friends.

• Kids provided personal info such as full name, DOB, email address, and city without parental consent.

Children’s Data Protection Cases

United States v. Jones O. Godwin (2011)

• FTC charged that site collected personal info from 5,600 kids and that owner made deceptive claims on privacy policy.

• Settlement bared misrepresentations about data collection and use and disclosure of kids’ info, required posting of online ed link, required retaining of online privacy professional or Safe Harbor program to oversee any website, and pay $100,000 penalty.

• http://www.ftc.gov/opa/2011/11/skidekids.shtm

Children’s Data Protection Cases UMG Recordings, Inc. and Bonzi Software, Inc. (2006) • UMG web site, lilromeo.com

was directed to children by promoting 13-year-old pop star "Lil' Romeo," and hosted child-oriented games and activities.

• Bonzi Software marketed BonziBUDDY, a free downloadable software that displays interactive, animated purple gorilla on kids' computers. BonziBUDDY interacted with users providing shopping advice, jokes, and trivia.

Children’s Data Protection Cases

UMG Recordings, Inc. and Bonzi Software, Inc. (2006) • Both companies collected kids’ full names, DOBs, e-mail

addresses, home addresses, phone numbers, genders, and visitors' preferences in music, sports, and apparel.

• Each company had actual knowledge that kids were under 13.

• Did not post clear notices to parents regarding what info they were collecting.

• Both companies settled. UMG paid $400,000 penalty. Bonzi paid $75,000 penalty.

• http://www.ftc.gov/opa/2004/02/bonziumg.shtm

Updates to Dot Com Disclosures

• Dot com Disclosures Updated to address current online and mobile advertising environment

• Like the original guidance (2000), the updated version emphasizes that consumer protection laws apply equally to marketers across all mediums, whether delivered on a desktop computer, a mobile device, or more traditional media such as television, radio or print.

http://ftc.gov/os/2013/03/130312dotcomdisclosures.pdf

Mobile Apps Report

• FTC’s second Kids’ App Report

• Since FTC’s first report in 2011, staff found little progress toward giving parents the information they need to determine what data is being collected from their children, how it is being shared, or who will have access to it.

http://www.ftc.gov/os/2012/12/121210mobilekidsappreport.pdf

Guides Concerning the Use of

Endorsements and Testimonials

in Advertising The FTC has issued guides which reflect three basic truth-in-advertising principles: • Endorsements must be truthful and not misleading; • If the advertiser doesn’t have proof that the

endorser’s experience represents what consumers will achieve by using the product, the ad must clearly and conspicuously disclose the generally expected results in the depicted circumstances; and

• If there’s a connection between the endorser and the marketer of the product that would affect how people evaluate the endorsement, it should be disclosed.

Consumer Education Materials

for Children

Living Life Online Educates kids regarding kid specific online issues such as sharing info, cyber-bullying, and sexting. http://www.ftc.gov/bcp/edu/microsites/livinglifeonline/index.shtm

OnGuardOnline Educates parents and kids on video game content and ratings. http://www.onguardonline.gov/articles/0270-kids-parents-and-video-games/

Admongo

Allows kids to create avatar and play at thinking critically about advertising.

http://www.admongo.gov/

You Are Here Allows kids to visit virtual mall and learn about advertisements. http://www.ftc.gov/bcp/edu/microsites/youarehere/

Violent Video Games Marketed to

Children • Violent video games are not

illegal but possibly harmful because they easily expose kids to mature content due to easy access and marketing on kids’ websites and TV shows.

• In 2009, seventh FTC report assessed video game marketing to kids, ratings disclosures, and kid access.

• http://ftc.gov/opa/2009/12/violentent.shtm

Violent Video Games Marketed to

Children • Industry greatly improved but

still advertising on kids’ websites and TV shows.

• FTC wants industry to do more to restrict marketing of mature games to children.

• Industry improved in restricting access to kids with 80% of retailers enforcing Mature-rated game purchases

• But with gift cards, kids purchase Mature-rated games online easily.

Violent Video Games Marketed to

Children

• Mobile gaming a growing concern due to easy access for kids.

• Mobile games don’t provide ratings nor proper parental control system.

Federal Trade Commission

GRACIAS

Thank You

Questions?

November 2013