In a joint press release published on June 18, the California Attorney General and Los Angeles City Attorney announced a settlement with Tilting Point Media LLC (Tilting Point) in connection with alleged violations of the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA). This is the first CCPA enforcement where the California Attorney General has partnered with another enforcement agency. The settlement arises from an investigation into a mobile game called “SpongeBob: Krusty Cook-Off” that the regulators allege is directed, in part, to children under the age of 13 while engaging in both targeted advertising and in-app purchases focused on all ages.
According to the settlement agreement, Tilting Point employed an age screen that did not ask for age in a “neutral manner” and therefore encouraged children to enter an older age. Further, Tilting Point inadvertently configured third-party software development kits (SDKs) to collect and sell children’s data without first obtaining consent. Under COPPA, parental consent is required to collect personal information online from children under 13. Under the CCPA, businesses may not sell or share the personal information of children under 13 without affirmative authorization from the parent or guardian, or in the case of children ages 13 to 15, affirmative authorization from the child.
Subject to court approval, Tilting Point will be required to pay $500,000 in civil penalties and to comply with injunctive terms that include a prohibition on selling and sharing the personal information of children without affirmative consent, a requirement to use neutral age screens, restrictions on the use of SDKs, children’s data minimization requirements, and a requirement to submit annual reports regarding compliance efforts to the California Department of Justice and the Los Angeles City Attorney’s office. Prior CCPA settlements with the California Attorney General include a $375,000 fine against DoorDash in February 2024 and a $1.2 million fine against Sephora in August 2022. This settlement with Tilting Point signals an uptick in the frequency of CCPA enforcement actions.
This settlement is also the latest example of the priority placed on children’s privacy by regulators in the United States and abroad. Children’s privacy has been the subject of much recent debate in state legislatures and Congress, having been cited as a top priority by the Federal Trade Commission and state regulators as well as President Biden during the 2024 State of the Union. As we highlighted in a prior publication, California has established itself as a leader in the protection of children’s data through the introduction of the Children’s Data Privacy Act earlier this year. In the Tilting Point press release, Attorney General Rob Bonta noted: “As children spend an increasing amount of time online, both on websites and using mobile apps, we will use every enforcement tool to ensure compliance with the law and that companies exercise diligence with privacy law requirements.” Los Angeles City Attorney Hydee Feldstein Soto added: “Protecting our children has been a top priority for my administration.”
Businesses that process children’s personal information, or that provide services likely to be accessed by children, should continue to ensure that their practices align with evolving federal and state children’s privacy requirements. This includes assessing what services are directed to or accessed by children; conducting risk assessments; reviewing any marketing activities using children’s data, including the use of cookies and SDKs; and assessing age gate designs.
[View source.]
