![Scarinci Hollenbeck, LLC](/_next/image?url=https%3A%2F%2Fres.cloudinary.com%2Fscarinci-hollenbeck%2Fimages%2Ff_auto%2Cq_auto%2Fv1676448213%2Fwp.scarincihollenbeck%2Fsh-mini-diamond-500x500-1%2Fsh-mini-diamond-500x500-1.png%3F_i%3DAA&w=256&q=75)
Scarinci Hollenbeck, LLC
The Firm
201-896-4100 info@sh-law.comAuthor: Scarinci Hollenbeck, LLC|September 19, 2017
The Walt Disney Co. is facing a novel class-action lawsuit related to its Princess Palace Pets app. According to the complaint, Disney and the software companies that helped design the app violated the Children’s Online Privacy and Protection Act (COPPA) because the app tracks children’s online activity to facilitate targeted advertisements. The case is significant given the popularity of mobile applications directed at children as well as Disney’s already considerable COPPA-compliance efforts.
Photo courtesy of Stocksnap.io
Under COPPA, operators of online services directed to children under age 13 are required to provide notice and obtain parental consent before collecting items of “personal information” from children. Under COPPA, “personal information” includes more commonly understood information like names, email addresses, and social security numbers, as well as “persistent identifier[s] that can be used to recognize a user over time and across different Web sites or online services.”
In addition, COPPA not only applies to websites and online services dedicated to children, but also to operators of general audience websites or online services with “actual knowledge that they are collecting, using, or disclosing personal information from children under 13.”
Under COPPA, operators are required to implement certain safeguards to protect children’s privacy. They include:
According to the COPPA class-action complaint, several software companies, which are also named in the suit, provided their own proprietary computer code to Disney, known as software development kits (SDK), for installation and use in the Disney Princess Palace Pets app. The SDKs in Disney’s gaming apps subsequently collected app users’ personally identifying information in the form of “persistent identifiers,” typically a unique number linked to a specific mobile device, and transmitted it to the defendants to facilitate subsequent behavioral advertising.
“These persistent identifiers allow SDK providers to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps,” the complaint contends. “This information is then sold to various third-parties who sell targeted online advertising.”
The lawsuit further maintains that companies no longer need to rely on traditional forms of personal information, such as email addresses or phone numbers, to serve targeted ads. Rather, it is more effective to simply track a users’ digital habits across platforms.
According to the plaintiffs, when linked to other data points about the same user, persistent identifiers can disclose a personal profile that can be exploited in a commercial context. “Permitting technology companies to obtain persistent identifiers associated with children exposes them to the behavioral advertising (as well as other privacy violations) that COPPA was designed to prevent,” the complaint states.
Regulation and enforcement of online privacy continues to be a hot topic in regard to children’s applications, with several federal agencies including the Federal Trade Commission (FTC) evaluating whether additional regulation may be needed. In the meantime, COPPA remains the primary enforcement mechanism.
As the class-action suit highlights, COPPA violations can lead to significant liability. There is a considerable incentive for plaintiffs’ class action attorneys, who tend to be paid fees out of funds recovered for the plaintiffs, to press novel theories of violation. In 2011, Disney subsidiary Playdom Inc. paid a $3 million civil penalty for violating COPPA when it allegedly collected and disclosed personal information from children without obtaining their parents’ prior verifiable consent. This settlement is currently the largest civil penalty for a violation of COPPA.
Do you have any questions? Would you like to discuss the matter further? If so, please contact me, Charles Yuen, at 201-806-3364.
The Firm
201-896-4100 info@sh-law.comThe Walt Disney Co. is facing a novel class-action lawsuit related to its Princess Palace Pets app. According to the complaint, Disney and the software companies that helped design the app violated the Children’s Online Privacy and Protection Act (COPPA) because the app tracks children’s online activity to facilitate targeted advertisements. The case is significant given the popularity of mobile applications directed at children as well as Disney’s already considerable COPPA-compliance efforts.
Photo courtesy of Stocksnap.io
Under COPPA, operators of online services directed to children under age 13 are required to provide notice and obtain parental consent before collecting items of “personal information” from children. Under COPPA, “personal information” includes more commonly understood information like names, email addresses, and social security numbers, as well as “persistent identifier[s] that can be used to recognize a user over time and across different Web sites or online services.”
In addition, COPPA not only applies to websites and online services dedicated to children, but also to operators of general audience websites or online services with “actual knowledge that they are collecting, using, or disclosing personal information from children under 13.”
Under COPPA, operators are required to implement certain safeguards to protect children’s privacy. They include:
According to the COPPA class-action complaint, several software companies, which are also named in the suit, provided their own proprietary computer code to Disney, known as software development kits (SDK), for installation and use in the Disney Princess Palace Pets app. The SDKs in Disney’s gaming apps subsequently collected app users’ personally identifying information in the form of “persistent identifiers,” typically a unique number linked to a specific mobile device, and transmitted it to the defendants to facilitate subsequent behavioral advertising.
“These persistent identifiers allow SDK providers to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps,” the complaint contends. “This information is then sold to various third-parties who sell targeted online advertising.”
The lawsuit further maintains that companies no longer need to rely on traditional forms of personal information, such as email addresses or phone numbers, to serve targeted ads. Rather, it is more effective to simply track a users’ digital habits across platforms.
According to the plaintiffs, when linked to other data points about the same user, persistent identifiers can disclose a personal profile that can be exploited in a commercial context. “Permitting technology companies to obtain persistent identifiers associated with children exposes them to the behavioral advertising (as well as other privacy violations) that COPPA was designed to prevent,” the complaint states.
Regulation and enforcement of online privacy continues to be a hot topic in regard to children’s applications, with several federal agencies including the Federal Trade Commission (FTC) evaluating whether additional regulation may be needed. In the meantime, COPPA remains the primary enforcement mechanism.
As the class-action suit highlights, COPPA violations can lead to significant liability. There is a considerable incentive for plaintiffs’ class action attorneys, who tend to be paid fees out of funds recovered for the plaintiffs, to press novel theories of violation. In 2011, Disney subsidiary Playdom Inc. paid a $3 million civil penalty for violating COPPA when it allegedly collected and disclosed personal information from children without obtaining their parents’ prior verifiable consent. This settlement is currently the largest civil penalty for a violation of COPPA.
Do you have any questions? Would you like to discuss the matter further? If so, please contact me, Charles Yuen, at 201-806-3364.
No Aspect of the advertisement has been approved by the Supreme Court. Results may vary depending on your particular facts and legal circumstances.