On December 17, 2015, the Federal Trade Commission (FTC) announced its first Children's Online Privacy Protection Act (COPPA) enforcement actions challenging the use of persistent identifiers to engage in targeted advertising to children.1 The FTC alleges that two app developers—LAI Systems, LLC (LAI) and Retro Dreamer and its principals (Retro Dreamer)—allowed third-party advertising networks to collect persistent identifiers in order to serve targeted ads to children in their apps without providing appropriate notice or obtaining parental consent, as required by COPPA. The developers entered into settlements with the FTC to resolve the allegations. The settlements prohibit the developers from further violations of COPPA and require them to pay a combined $360,000 in civil penalties. These COPPA actions are the first the FTC has brought involving the collection of persistent identifiers, a data category that the FTC added to the definition of "personal information" when it expanded the scope of the COPPA Rule in 2013. These settlements also mark the first COPPA actions involving targeted advertising to children.
Background
COPPA applies to any website, app, or other online service that knowingly collects personal information from children under 13, and to any website, app, or online service that is directed to children and collects personal information from users. Under the COPPA Rule, companies must provide appropriate notice to parents and obtain their verifiable consent before collecting and using children's personal information. In 2013, the FTC expanded the COPPA Rule's definition of "personal information" to include information not traditionally considered to be personal, including "persistent identifiers that can be used to recognize a user over time and across different websites or online services."2 In this context, persistent identifiers can include customer numbers held in cookies, Internet Protocol (IP) addresses, processor or device serial numbers, or unique device identifiers.
The FTC's complaint against LAI alleges that it is a prolific app developer that has created many apps directed to children, including My Cake Shop, My Pizza Shop, Hair Salon Makeover, Friday Night Makeover, Marley the Talking Dog, and Animal Sounds. In its complaint against Retro Dreamer, the FTC similarly alleges that the developer has created a number of apps directed to children, including Ice Cream Jump, Happy Pudding Jump, Ice Cream Drop, Sneezies, Wash the Dishes, Cat Basket, and Tappy Pop.
Under COPPA, the determination of whether an app is directed to children depends on factors such as the subject matter, visual content, language, and use of animated characters or child-oriented activities and incentives. The FTC alleges that the apps are directed to children under the age of 13 because the apps contain brightly colored, animated characters; involve only simple play; involve subject matter that would be highly appealing to children; and because the language used to describe the apps in the app stores is simple and would be appealing to a child under age 13.
The crux of the FTC's complaints is that both developers allegedly allowed third-party ad networks to collect persistent identifiers through their apps to serve targeted advertising to users based on users' activity over time and across sites. The complaints did not specify what types of identifiers were collected. Notably, the developers allegedly failed to tell the ad networks that the apps were directed to children and did not contractually require the ad networks to refrain from engaging in targeted advertising. The FTC also alleged that the developers failed to comply with COPPA's requirements of providing notice to parents and obtaining their verifiable consent for the collection and use of the persistent identifiers, and posting notices regarding their information collection, use, and disclosure practices on their websites and in their apps.
Further, in 2013 and 2014, one ad network allegedly told Retro Dreamer that some of its apps appeared to be targeting children and warned the developer about its obligations under COPPA. Nevertheless, Retro Dreamer allegedly continued to allow other ad networks to collect persistent identifiers from users of its child-directed apps.
Settlement
Under the terms of the settlements, both LAI and Retro Dreamer are prohibited from further violations of COPPA.3 In addition, LAI is required to pay a $60,000 civil penalty and Retro Dreamer is required to pay a $300,000 civil penalty.
Implications
Until now, the FTC's COPPA enforcement actions have focused on businesses that collect personal information that identifies a child, such as name or email addresses. With this pair of enforcement actions, the FTC has sent a message that businesses must pay attention to COPPA's expanded definition of "personal information" and obtain parental consent for collecting data elements not traditionally thought of as personal. Child-directed websites, apps, and online services that allow targeted advertising on their properties are particularly likely to be scrutinized. Child-directed properties are strictly liable for the information collected through their services. As such, they should take stock of the information that they collect or allow third parties to collect, including persistent identifiers such as cookies and device identifiers, precise geolocation information, audio files, photos, and videos, or risk a future FTC enforcement action.
