CARU Finds Gameloft’s Disney Getaway Blast App in Violation of COPPA and CARU’s Advertising and Privacy Guidelines; Gameloft Agrees to Corrective Actions

McLean, VA – November 1, 2022 – The Children’s Advertising Review Unit (CARU) of BBB National Programs has found Gameloft S.A., owner and operator of the Disney Getaway Blast mobile app, in violation of the Children’s Online Privacy Protection Act (COPPA) and CARU’s Self-Regulatory Guidelines for Advertising and for Children’s Online Privacy Protection. Upon receipt of CARU’s inquiry, Gameloft proactively implemented changes to address CARU’s concerns regarding its advertising and privacy practices and continues to take other corrective actions to address the remaining violations.

The Disney Getaway Blast app, featuring Disney and Pixar movie characters licensed by The Walt Disney Company, came to CARU’s attention through its routine monitoring of child-directed content. Given the app’s child-directed subject matter, intended for ages four and up, its use of animated characters, colorful visual content, fun background music, and simplistic nature of the gameplay, CARU determined that the Gameloft app was a child-directed app and as such is subject to COPPA and CARU’s Guidelines. CARU further determined that the App qualifies as a “mixed audience” child-directed app because children under 13 may not be its primary audience.

Children’s Privacy Issues

As the operator of a child-directed app, Gameloft is required under COPPA and CARU’s Privacy Guidelines to ensure that either no personal information is collected, used, or disclosed from users under age 13, or that notice is provided and verifiable parental consent is obtained prior to such collection, use, or disclosure. As a mixed-audience online service, Gameloft is permitted to implement an age screen in order to provide these protections to children under 13, however even after CARU created a test account identifying as a 10-year-old child, a prompt was generated by Apple’s App Tracking Transparency Framework that asked for permission to track the user’s “activity across other companies’ apps and websites” for the purpose of delivering personalized ads. CARU found that even after identifying as a child under age 13, there was nothing preventing a child from enabling this setting and potentially allowing the app to collect personal information from children under 13 without first obtaining verifiable parental consent.

CARU also found the Operator’s privacy policy language to be unclear and inconsistent with its actual privacy and data collection practices regarding children. The App’s privacy policy indicates that Gameloft uses the information it collects to serve behaviorally-targeted advertising, enabling Gameloft to “provide you with advertising that better suits your interests and profile and is age-/gender-appropriate and targeted to your general location.” However, in another provision addressing children, Gameloft states it “will prevent the collection and use of their precise geolocation data and display to them contextual advertising only (excluding any behavioral advertising).” CARU recommended the Operator amend its Privacy Policy to make clear its actual privacy and data collection practices with respect to children.

After a review of the evidence in the record, CARU determined that Gameloft violated COPPA and CARU’s Privacy Guidelines by its failure to provide parents with notice of its children’s information collection and use practices that is clearly and understandably written, complete, and contains no unrelated, confusing, or contradictory materials, and obtain verifiable parental consent before any collection or use of personal information from children, as required by COPPA.

Children’s Advertising Issues

CARU’s Advertising Guidelines make clear that advertisers must not manipulate or deceive children. Conduct that would violate this provision includes the use of emotional manipulation and other tactics that either pressure or manipulate a child into engaging with ads, downloading and installing unnecessary apps, or making unintended purchases.

CARU found that the Disney Getaway Blast app served ads periodically after players completed a level, with promises of free “rewards” and in-game boosters for watching the ad. Once in the ad, users cannot easily exit the full-screen, 30-second video ad during which an “install now” button appears, taking users away from the app to the app store. Many of these ads are non-avoidable.

In addition to the use of bright colors to draw children to click on ads, the app also uses emotional manipulation tactics to persuade children to watch ads and make in-app purchases. When a user runs out of moves to complete a puzzle, the app character demonstrates visual disappointment providing the user two options: to continue or “give up.” In contrast, when players solve a puzzle, they are rewarded with screens that feature their characters celebrating and congratulating them with a message such as “LEVEL COMPLETED!” If a user gives up, it costs one “life” (represented by a heart-shaped icon), and they are prodded to purchase additional moves. However, if a user chooses to continue and complete the puzzle, they are rewarded with screens that feature their characters celebrating and congratulating them with encouraging language.

CARU found these practices to be emotionally manipulative tactics in violation of CARU’s Advertising Guidelines that prey on children’s weaknesses and insecurities to persuade them to watch excessive ads and make in-app purchases so their character will feel happy and praised, able to continue playing with their virtual friends.

CARU also found that some ads displayed in the App are not easily identifiable as advertising because they lacked clear and conspicuous disclosures and that the methods provided in the App to exit ads are neither clear nor conspicuous to children, in violation of the Ad Guidelines.

CARU recommended that Gameloft take the following corrective actions, some of which it proactively implemented early in CARU’s investigation:

• Provide a clear and understandable notice of its children’s information collection and use practices that contains no unrelated, confusing, or contradictory materials.
• Design its app with children in mind to ensure that it does not deceive, manipulate, or pressure children into watching or engaging with excessive ads, making costly and unnecessary in-app purchases, and downloading and installing unnecessary apps.
• Provide clear and conspicuous disclosures of all ads to ensure they are easily identifiable as advertising to children.
• Ensure any exit methods offered by the App are clear and conspicuous by using such design techniques as color, text size, language, borders, and shading to make them recognizable to children.

Gameloft participated in and cooperated fully with CARU’s self-regulatory program.

All BBB National Programs case decision summaries can be found in the case decision library. For the full text of NAD, NARB, and CARU decisions, subscribe to the online archive.

About BBB National Programs: BBB National Programs is where businesses turn to enhance consumer trust and consumers are heard. The non-profit organization creates a fairer playing field for businesses and a better experience for consumers through the development and delivery of effective third-party accountability and dispute resolution programs. Embracing its role as an independent organization since the restructuring of the Council of Better Business Bureaus in June 2019, BBB National Programs today oversees more than a dozen leading national industry self-regulation programs, and continues to evolve its work and grow its impact by providing business guidance and fostering best practices in arenas such as advertising, child-directed marketing, and privacy. To learn more, visit bbbprograms.org.

About the Children’s Advertising Review Unit: The Children’s Advertising Review Unit (CARU), a division of BBB National Programs and the nation’s first Safe Harbor Program under the Children’s Online Privacy Protection Act (COPPA), helps companies comply with laws and guidelines that protect children from deceptive or inappropriate advertising and ensure that, in an online environment, children’s data is collected and handled responsibly. When advertising or data collection practices are misleading, inappropriate, or inconsistent with laws and guidelines, CARU seeks change through the voluntary cooperation of companies and where relevant, enforcement action.