CARU, which monitors Websites for compliance with CARU's Self-Regulatory Guidelines for Children's Advertising (the Guidelines) as well with the federal Children's Online Privacy Protection Act (COPPA), had found that children under age 13 who clicked on the "Kids" area at KFC.com and who wanted to send email cards to friends were asked to disclose their first and last names and email addresses, along with the full names and email addresses of the friends to whom they wished to send cards. Because only first names of sender and recipient are needed to send ecards, the site was thus collecting more information than necessary to engage in this activity, in contravention of the Guidelines and COPPA. The site also asked each child sender if KFCC could periodically send her free coupons, thus collecting and using personally identifiable information (PII) without parental consent as required by the Guidelines and COPPA.

In addition, the home page of the KFC.com site contained a request for visitors to Sign-up to join the Colonel's Email Club, which gave KFCC permission to send the member information on future KFCC promotions, coupons and recipes. In order to sign up, one had to submit first and last name, email address and date of birth. Although the registration stated that one must be at least 13 years old to participate, thus tipping off visitors to enter ages of 13 or older, one who entered a date of birth corresponding with an age of 12 or younger was able to disclose PII. Thus, this information was collected without parental notification and opportunity to opt out as required by the Guidelines and COPPA.

When contacted by CARU, KFCC immediately agreed to change their requirements for sending ecards, and now requires only first name and email address of sender and recipient, and no longer offers to send anything to children under 13 on the site. With respect to the Colonel's Email Club, visitors are asked for date of birth in a neutral manner before one is asked for any PII. No other information is requested or provided. Those younger than 13 are not allowed to submit PII. In addition, the operator installed a session cookie to prevent underage users from clicking the back button and changing their ages to circumvent the age screening.