October 31, 2020

Volume X, Number 305

Advertisement

October 30, 2020

Subscribe to Latest Legal News and Analysis

October 29, 2020

Subscribe to Latest Legal News and Analysis

October 28, 2020

Subscribe to Latest Legal News and Analysis

Washington State AG Settles with Online Platform Over Alleged COPPA Violations

Protecting the online privacy of children by enforcing the Children’s Online Privacy Protection Act (COPPA) continues to be of paramount importance to federal and state regulators. In addition to the Federal Trade Commission (FTC), several state attorneys general (AGs) have brought COPPA actions recently, including the New Mexico and California AGs, and, most notably, the New York AG, who in 2019 worked in concert with the FTC to obtain a record civil penalty against YouTube for alleged COPPA violations. The latest COPPA enforcement action comes from Washington State AG Bob Ferguson, who announced a $100,000 settlement with California-based technology company Super Basic LLC and its parent company, Maple Media LLC, on June 24, 2020.

COPPA applies to operators of websites and online services that collect personal information from children, defined as under 13. Operators may not collect personal information from children without first obtaining verifiable parental consent. AG Ferguson charged that the social media platform We Heart It, operated by Super Basic and Maple Media, collected and disclosed children’s personal information without parental consent, in violation of COPPA. The complaint also asserted that the conduct amounted to an unfair or deceptive business practice under the Washington Consumer Protection Act.

According to the AG’s complaint, We Heart It, which has some 500,000 active monthly users across the United States, hosts a number of channels whose content is designed to appeal to children, such as fan pages for Disney, Harry Potter, DC Comics, and Pokemon. The platform also has its own website where users can create an account and profile, and the default setting on the platform meant that user profiles, including those of children, were public and could be seen by any user. When an account was created, We Heart It collected an email address, name, and username, as well as persistent identifiers, including cookies, IP address, iOS advertising ID, and Android advertising ID. It also permitted third party advertising networks to collect persistent identifiers. In addition, We Heart It collected metadata from uploaded photos that sometimes included geolocation data. The AG contended that the platform did not implement an age gate or obtain parental consent prior to the collection of children’s personal information.

In addition to the $100,000 settlement, Super Basic and Maple Media will be subject to $400,000 in penalties if the companies violate the terms of the consent decree. On top of the fine, the consent decree mandates that the companies set up an age gate to prevent children under 13 from creating accounts without parental consent, and the companies must delete or remove any information collected from children under 13 immediately upon learning that an age gate has been breached. The consent decree requires that the companies operate within the rules of COPPA, including by providing direct notice to parents of the companies’ data collection and disclosure practices; obtaining verifiable parental consent prior to collecting personal information from children under 13; deleting children’s personal information upon request from a parent; and retaining children’s personal information no longer than necessary to achieve the purpose for which it was collected. In addition, the companies must audit users’ profiles, tags, posts, and activity where content is relevant to or directed to children or where the companies have actual knowledge of use by children. Super Basic and Maple Media must also submit a detailed compliance report to the AG’s Office within 15 months.

The FTC’s determination in the FTC-YouTube settlement that a general audience platform has responsibilities under COPPA if content channels are directed to children has obviously caught the attention of regulators at both the national and state level. Protecting the online privacy of children by enforcing COPPA continues to garner intense interest in the age of COVID-19, particularly when many children are engaging more than ever with digital media. It is therefore unsurprising that state AGs are watching closely whether platforms that may attract children are complying with COPPA.

© 2020 Keller and Heckman LLPNational Law Review, Volume X, Number 209
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

Sheila Millar, Keller Heckman, advertising lawyer, privacy attorney
Partner

Sheila A. Millar counsels corporate and association clients on advertising, privacy, product safety, and other public policy and regulatory compliance issues.

Ms. Millar advises clients on an array of advertising and marketing issues.  She represents clients in legislative, rulemaking and self-regulatory actions, advises on claims, and assists in developing and evaluating substantiation for claims. She also has extensive experience in privacy, data security and cybersecurity matters.  She helps clients develop website and app privacy policies,...

202-434-4646
Tracy Marshall, Keller Heckman, regulatory attorney, for-profit company lawyer
Partner

Tracy Marshall assists clients with a range of business and regulatory matters.

In the business and transactional area, Ms. Marshall advises for-profit and non-profit clients on corporate organization, operations, and governance matters, and assists clients with structuring and negotiating a variety of transactions, including purchase and sale, marketing, outsourcing, and e-commerce agreements.

In the privacy, data security, and advertising areas, she helps clients comply with privacy, data security, and consumer protection laws, including laws governing telemarketing and...

202-434-4234
Advertisement
Advertisement