Harvesting data from children with cuddly creatures and cutesy keyboards

And you thought Beacon is (was) creepy.

Yesterday I had my first experience at a Build-A-Bear Workshop store. Build-A-Bear, if you're not familiar with it, is a publicly traded company headquartered in St. Louis, MO, with some 350 retail outlets worldwide. It's irresistible to boys and girls alike, if the birthday party we attended was any indication. Kids can choose one of over 30 different styles of animal, stuff it onsite using big yellow machines filled with flying fluff, carefully add a small heart to bring the animal "to life," and customize to their heart's content (and their parents' wallets' horror) from a stupefying collection of sounds, clothes, shoes, and accessories that include miniature skateboards and MP3 players.

All good, clean — if decidedly consumer-culture focused, and potentially bank-breaking — fun. Until you get to the last step in the process, which had me nostalgic for (egad) the Cabbage Patch Kids. Who as I recall were discharged from their mythical birthplace without asking for their new owner's home address.

You see, each Build-A-Bear critter is issued a "birth certificate," which is generated after the kids — and hopefully their parents, though that didn't seem to be making a bit of difference on the common sense front — visit a bank of computers. These are big orangey-purple affairs, sort of Dr. Seussian in presentation. The keyboard buttons include stars and other colored shapes to make data input all the easier and more intuitive for youngsters. In fact, the computer-plus-keyboard experience is very close (no doubt intentionally so) to something children and their parents might have experienced in a kids' museum, library, or school. Before their new friend can get its birth certificate, the kids are prompted to enter a host of very personal personal information: birth date, home address, gender, phone, and email among them. Along the way is the option to "skip" some of this input, but unlike what we're used to in the world of online retail forms, there's no effort to communicate what data is "required" for the transaction to proceed, and what's "optional." The overall effect is to sideline the privacy-savviness that might otherwise accompany the parent and/or child. I sat there and watched parent after parent prompt their kids to flex their memory muscles and practice their computer skills: "Ok Timmy, now, what's our address? What's your birthday? Do you remember our phone number? Good typing!!"

It's not until after the kids have given up all this data, most often with their parents help and lulled consent (though there's no requirement that parents participate at all), that Build-A-Bear gives its customers a copy of its privacy policy, which comes tucked away in the packaging folks take home.

I really don't have any problem with Build-A-Bear's privacy policy, or the tie-ins with the virtual world (Build-A-Bearville) the company hopes your child will visit with his or her new stuffed friend. But though the policy looks good on paper, this is a case where the execution stinks. Parents and kids should not be urged or encouraged to give up personal data, and when they're asked to do so there should be some up-front reminders as to what is happening.

Cory Doctorow likes to tell an anecdote about how today's children are becoming more and more inured to invasions of privacy. In his case, children in line at Disneyland thought it odd when he refused to supply a fingerprint. Here, kids are learning it's ok for a store to know quite a bit about them. Parents should make a stink about this sort of thing and be on the lookout for it.

(Bonus link: Kim Pallister, Can a stuffed bear hold the secret to game piracy?)

(Images by gitb and Brittany G, CC Attribution-2.0)