App Developers/Distributors Beware: FTC Now Cracking Down on Apps Targeting Children

A prominent developer of mobile applications, W3 Innovations, LLC, the parent company of Broken Thumb Apps ("W3"), has agreed to pay $50,000 to settle charges brought by the Federal Trade Commission ("FTC") in its first enforcement action involving mobile applications ("apps"), according to terms of the settlement announced last week. The FTC's complaint, filed on August 12, 2011, alleged that W3, which develops and distributes mobile apps for Apple and Android devices, several of which are directed at children and are listed in the "Games-Kids" section of the iTunes App Store, violated the Children's Online Privacy Protection Act (COPPA) by illegally collecting personal information from children under the age of 13 without prior parental consent.  As we've discussed in a previous post, the United States lacks a comprehensive federal privacy law regulating the collection, storage, use and disclosure of personal information in the online context and lawmakers have introduced several new initiatives in an attempt to address the issue.  However, under COPPA, one of the few existing federal laws that deals with online privacy, the FTC has been flexing its muscles by regulating online (i.e., website-based), and with this case, mobile (i.e., app-based), privacy. According to the FTC, several of W3's apps are directed at children under the age of 13, including the popular "Emily's Girl World", "Emily's Dress Up", "Emily's Dress UP & Shop" and "Emily's Runway High Fashion".  These apps encourage, but do not require, users to post comments (which could include personal information) to the Emily's Girl World blog and to directly email their comments to "Emily".  The FTC's complaint states that, "in addition to the collection and maintenance of over 30,000 emails, containing email addresses, [the company has] collected, maintained, and/or disclosed personal information from over 300 Emily's Girl World app users and 290 Emily's Dress Up app users who have registered to submit comments." Specifically, the FTC alleges that W3 failed to: (a) maintain or link to an online notice of its information collection, use and disclosure practices; (b) provide direct notice to parents of their practices regarding the collection, use, and/or disclosure of children's personal information; and (c) obtain verifiable consent from parents prior to collecting, using or disclosing such information, all in violation of COPPA. In response to the FTC action, W3 stated that its "sole purpose in collecting email data was to improve the user experience with [its] apps; we never used any email address for marketing purposes or sold it to other firms".  The company appears to have taken immediate corrective action after receiving notice from the FTC and implemented "a strict email policy that removes any possibility of collecting and retaining email addresses, even unintentionally, from users under the age of 13".  As part of the settlement, W3 has also agreed to delete all the personal information previously collected from children and to refrain from future violations of COPPA. This is the second federal enforcement action made public this year over a COPPA violation which suggests that the FTC may continue to aggressively pursue privacy violations involving children.  Playdom, a Disney Enterprises subsidiary, is the first website/app developer to settle with the FTC this year over COPPA violations.  The company operates virtual world websites where users, many of whom are Children, are required to provide ages and email addresses in order to register to play online games.  They are also allowed to post their full names, email addresses, instant messenger IDs, and location data to personal profile pages and online community forums .  In May, Playdom agreed to pay $3 million in a costly settlement over FTC charges, similar to those set forth in the W3 complaint, that it collected information from children without notifying parents and obtaining prior parental consent in violation of COPPA. Most notably for app developers and distributors, FTC Chairman Jon Leibowitz emphasized the importance of obtaining parental consent, and made clear that the app space is no different from traditional website platforms.  "The FTC's COPPA Rule requires parental notice and consent before collecting children's personal information online, whether through a website or a mobile app," said Chairman Jon Leibowitz in a statement given in response to the settlement. According to Senator Amy Klouchar, who has been working to prevent deceptive in-app purchase practices on mobile devices, "Mobile apps can be great tools for kids to learn and have fun, but parents should never have to worry that their child's personal information is being collected or violated." In light of the current evolving enforcement climate, developers, distributors and operators of apps and websites targeted at children that collect personal information, should, among other things, ensure that they adhere to the requirements of COPPA, including  the basic guidelines described below. Specifically, prior to collecting, using or disclosing personal information received from children under 13, developers, distributors and operators must obtain verifiable parental consent for any such collection, use or disclosure.  They should also provide notice on their apps, websites and other applicable platforms regarding the kind of information that is collected from children, how such information is used and their disclosure practices related thereto. Further, if and whenever requested by a parent (or guardian), such developers, distributors and operators must provide (a) a description of the specific types of personal information collected from that child; (b) the opportunity at any time to refuse to permit further use or maintenance in retrievable form, or future online collection, of personal information from that child; and (c) reasonable means for the parent to obtain any personal information collected from that child. In addition, COPPA rules proscribe conditioning a child's participation in a game, the offering of a prize, or another activity on the child disclosing more personal information than is reasonably necessary to participate in such activity. As apps continue their meteoric rise in popularity, and become, in many instances, the preferred method of digital content distribution and consumption, we will continue to monitor the FTC's actions in both the online and mobile spaces, the new privacy initiatives making their way through Congress and what these events may ultimately mean for the current stakeholders.