On the Web, Children Face Intensive Tracking

By STEVE STECKLOW

A Wall Street Journal investigation into online privacy has found that popular children's websites install more tracking technologies on personal computers than do the top websites aimed at adults.

Explore the Data

The Journal examined 50 sites popular with U.S. teens and children to see what tracking tools they installed on a test computer. As a group, the sites placed 4,123 "cookies," "beacons" and other pieces of tracking technology. That is 30% more than were found in an analysis of the 50 most popular U.S. sites overall, which are generally aimed at adults.

The most prolific site: Snazzyspace.com, which helps teens customize their social-networking pages, installed 248 tracking tools. Its operator described the site as a "hobby" and said the tracking tools come from advertisers.

Starfall.com, an education site for young children, installed the fewest, five.

The research is part of a Journal investigation into the expanding business of tracking people's activities online and selling details about their behavior and personal interests.

The tiny tracking tools are used by data-collection companies to follow people as they surf the Internet and to build profiles detailing their online activities, which advertisers and others buy. The profiles don't include names, but can include age, tastes, hobbies, shopping habits, race, likelihood to post comments and general location, such as city.

Enlarge Image

Close

Travis Dove for The Wall Street Journal

PRIZED EYES: The mother of Lee La Fon, 6, found dozens of tracking tools installed by a site for kids.

Selling the data is legal, but controversial, especially when it involves young people. Two companies identified by the Journal as selling teen data initially denied doing so. Only when shown evidence that they were offering data for sale—in one case, it was labeled "teeny boppers"—did they confirm it.

The Journal found that many popular children's sites are run by small companies or mom-and-pops, and privacy practices vary widely. Among the sites studied, the Journal identified one, y8.com—featuring kids' games with names like "Crush the Castle 2" and "Dreamy Nails Makeover"—that has had ties to a pornography site, xnxx.com, according to Internet registration records. Y8 installed 69 tracking files on the Journal's test computer. It also asks users to provide an email address to register.

"Children are safe on y8," a site employee named Olivier G. said in response to emailed questions. "We are *strongly against* the exposure of children to any adult content." Asked twice about y8.com's apparent ties to a pornography site, he didn't respond.

The Journal's study focused on sites popular with young people according to comScore Media Metrix. (Full methodology, as well as previous privacy investigations in this series, at wsj.com/WTK.)

Enlarge Image

Close

Travis Dove for The Wall Street Journal

Angela La Fon, a teacher in Virginia, called it "creepy" how many cookies were installed by a website used by her kids, Brady Elizabeth, left, and Lee.

Companies placing the tracking tools say the information they collect is anonymous and mainly used to deliver targeted ads or to gauge ads' effectiveness. They also say they don't collect "personally identifiable information" like names or email addresses and generally don't specifically target children.

Collecting data on minors is regulated, albeit lightly. The only federal restrictions require parental consent to collect names and other personal information of children under 13 in most circumstances. Currently, the Federal Trade Commission is considering whether changes to the law are warranted. No changes are expected before next year.

Many kids' sites are heavily dependent on advertising, which likely explains the presence of so many tracking tools. Research has shown children influence hundreds of billions of dollars in annual family purchases.

Google Inc. placed the most tracking files overall on the 50 sites examined. A Google spokesman said "a small proportion" of the files may be used to determine computer users' interests. He also said Google doesn't include "topics solely of interest to children" in its profiles.

Still, Google's "Ads Preferences" page (google.com/ads/preferences) displays what Google has determined about web users' interests. There, Google accurately identified a dozen pastimes of 10-year-old Jenna Maas—including pets, photography, "virtual worlds" and "online goodies" such as little animated graphics to decorate a website.

"It is a real eye opener," said Jenna's mother, Kate Maas, a schoolteacher in Charleston, S.C., viewing that data.

Jenna, now in fifth grade, said: "I don't like everyone knowing what I'm doing and stuff."

A Google spokesman said its preference lists are "based on anonymous browser activity. We don't know if it's one user or four using a particular browser, or who those users are." He said users can adjust the privacy settings on their browser or use the Ads Preferences page to limit data collection.

As part of the project, the Journal calculated an "exposure index" for each site, taking into account the number of trackers on the site and data-handling practices of those trackers. Snazzyspace.com ranked highest in exposing users to potentially aggressive tracking. A site owned by Viacom Inc., neopets.com, where kids can create make-believe "pets," had the highest exposure index of sites popular with children under 12.

How to Protect Yourself and Your Children

Almost every major website you visit is tracking your online activity. See what you can do to protect your child's privacy . Plus, below, a step-by-step guide to fending off trackers on all sites.

View Interactive

Glossary

Key tracking terminology

Viacom's Nickelodeon TV network accounted for eight of the 50 sites in the survey. On average, the eight installed 81 tracking tools, close to the 82 average for all 50 sites. One, a games site called Shockwave.com, installed 146; another game-and-video site, nick.com, installed 92.

The vast majority of tracking files on Nickelodeon sites were installed by other firms, such as ad networks. A Nickelodeon official said those services "are collecting data on what users like to see and do based on their web behaviors and activities."

Many tools raise no privacy concerns. They might merely remember, say, where users pause in a game, so they aren't forced to start every time they visit.

But other tools are used to develop profiles of web-surfing behavior. Those can be used to deliver targeted ads that home in on children's concerns—say, dieting ads aimed at youngsters worried about their weight.

The number of tracking files installed by any specific site can vary from visit to visit. In the Journal's examination, the math-games site coolmath4kids.com installed 60 on a test computer.

However, when Angela La Fon, a teacher in Big Island, Va., checked her own computer with a tracker-detection tool called Abine, she found the site had installed 89 "cookies" on her machine. (Cookies are little text files that can give a computer a unique identity, which data-collection companies can use to track people's activities).

"That's creepy," says Ms. La Fon, who encouraged her six-year-old son, Lee, to use the site. "I wouldn't have thought I would have had 89 cookies, period. Much less than from one site."

Karen Davis, chief executive of coolmath4kids.com, declined to be interviewed, citing concern for her own privacy. In an email she wrote, "We are assured by our service providers that all data gathered is anonymous and compliant with all laws and privacy policies."

Several sites, including coolmath4kids.com, modified their privacy policies after being contacted by the Journal with its findings. For example, the math-games site no longer states that using cookies to collect anonymous data is "no big deal." Ms. Davis said she made the changes "to provide as much transparency as possible for our users."

A spokeswoman for weeworld.com, where kids can create a WeeMee avatar and chat with friends, said that as a result of a Journal analysis, it changed its privacy policy to provide a clearer explanation of how to disable cookies. Weeworld.com installed 144 tracking tools in the Journal's test.

Of the 50 sites examined by the Journal, only one had no posted privacy policy, the gaming site y8.com. Records at archive.org, a library of previous versions of websites, indicate that y8.com launched in the late 1990s as a sex site for adults at least 21 years old.

Y8.com became a game site aimed at a younger audience in 2006. ComScore reports that 12.2% of its users are 2 to 11 years old, and 22.8% are 12 to 17.

Internet registration records from December 2006 show that y8.com and a hard-core sex site, xnxx.com, shared the same mailing address in France, plus the same email address. Later, the sites changed their contact information and no longer share the same addresses. On the website games.xnxx.com, which bills itself as offering "fun sex games," there is a prominent link at the top and bottom of the page to "non-adult" games on y8.com.

The y8.com employee, Olivier G., didn't respond to questions about who owns the site or its apparent relationship with xnxx.com. He wrote in an email that y8.com is "strongly against the collection and use of personal information." He also said "we don't do anything" with email addresses provided by users.

Parents hoping to let their kids use the Internet, while protecting them from snooping, are in a bind. That's because many sites put the onus on visitors to figure out how data companies use the information they collect.

Gaiaonline.com—where teens hang out together in a virtual world—says in its privacy policy that it "cannot control the activities" of other companies that install tracking files on its users' computers. It suggests that users consult the privacy policies of 11 different companies.

In a statement, gaiaonline.com said, "It is standard industry practice that advertisers and ad networks are bound by their own privacy policy, which is why we recommend that our users review those." The Journal's examination found that gaiaonline.com installed 131 tracking files from third parties, such as ad networks.

An executive at a company that installed several of those 131 files, eXelate Media Ltd., said in an email that his firm wasn't collecting or selling teen-related data. "We currently are not specifically capturing or promoting any 'teen' oriented segments for marketing purposes," wrote Mark S. Zagorski, eXelate's chief revenue officer.

But the Journal found that eXelate was offering data for sale on 5.9 million people it described as "Age: 13-17." In a later interview, Mr. Zagorski confirmed eXelate was selling teen data. He said it was a small part of its business and didn't include personal details such as names.

BlueKai Inc., which auctions data on Internet users, also said it wasn't offering for sale data on minors. "We are not selling data on kids," chief executive Omar Tawakol wrote in an email. "Let there be no doubt on what we do."

However, another data-collecting company, Lotame Solutions Inc., told the Journal that it was selling what it labeled "teeny bopper" data on kids age 13 to 19 via BlueKai's auctions. "If you log into BlueKai, you'll see 'teeny boppers' available for sale," said Eric L. Porres, Lotame's chief marketing officer.

Mr. Tawakol of BlueKai later confirmed the "teeny bopper" data had been for sale on BlueKai's exchange but no one had ever bought it. He said as a result of the Journal's inquiries, BlueKai had removed it.

The FTC is reviewing the only federal law that limits data collection about kids, the Children's Online Privacy Protection Act, or Coppa. That law requires sites aimed at children under 13 to obtain parental permission before collecting, using or disclosing a child's "personal information" such as name, home or email address, and phone and Social Security number. The law also applies to general-audience sites that knowingly collect personal information from kids.

The FTC is considering, among other things, whether to broaden "personal information" to include data "collected in connection with online behavioral advertising."

To try to avoid having to comply with Coppa, some sites state they prohibit kids under 13 from visiting. But that's easy for children to circumvent. Jenna Maas, the Charleston 10-year-old, opened an account on weeworld.com (which prohibits kids under 13 from registering) simply by fibbing about her age.

In Jenna's case, she got her mother's permission first. Ms. Maas says she lets Jenna visit sites for older kids "as long as I can monitor it."

Claire Quinn, weeworld.com's chief of safety, says the site has "tools in place" to prevent underage kids from joining, but "there is obviously no great age verification system out there."

FTC officials said website operators can't be held responsible if children lie about their age unless they glean from other information that a child is under 13.

Some experts believe the federal law also should apply to collecting data on teens, though not necessarily by requiring parental consent.

"We need clearer explanations of what's happening to their data online, that they can understand—not the kind of legalese in a privacy policy that basically obscures what's really going on," says Kathryn C. Montgomery, a professor of communication at American University.

Write to Steve Stecklow at steve.stecklow@wsj.com