Privacy & Information Security Law Blog

On September 17, 2014, the Federal Trade Commission announced that the online review site Yelp, Inc., and mobile app developer TinyCo, Inc., have agreed to settle separate charges that they collected personal information from children without parental consent, in violation of the Children’s Online Privacy Protection Rule (the “COPPA Rule”).

Yelp

According to the FTC’s complaint against Yelp, from 2009 to 2013, Yelp app users had to provide information such as their name, email address, ZIP code and possibly date of birth and gender in connection with the app registration process. The FTC alleged that Yelp failed to implement a functional age-screening mechanism as part of the app registration process, thus allowing several thousand children who provided a date of birth indicating that they were under the age of 13 to register and gain full access to the Yelp online review service through the Yelp app and website. In addition, Yelp automatically collected information from Yelp app users’ phones, including unique identifiers associated with their mobile devices. The FTC alleged that because Yelp collected information from users whose self-declared birth date indicated that they were under the age 13, Yelp was deemed to have “actual knowledge” under the COPPA Rule that it was collecting information from children. Yelp’s alleged conduct thus violated the COPPA Rule requirements that website operators notify parents and obtain their consent before collecting, using or disclosing personal information from children under 13 years of age.

Pursuant to the proposed settlement with the FTC, Yelp is required to pay a civil penalty of $450,000 and must delete information obtained from users who stated they were 13 years of age or younger at the time they registered for the Yelp App, unless Yelp can prove that the users actually were older than 13. Yelp also is required to comply with the COPPA Rule requirements in the future and must submit a detailed compliance report one year from the date when the court order is entered.

TinyCo

According to the FTC’s complaint, TinyCo offers free mobile apps for download and play, including “Tiny Pets,” “Tiny Zoo,” “Tiny Village,” “Tiny Monsters,” and “Mermaid Resort.” The FTC assessed various features (such as the themes appealing to children, animated characters and simple language) and determined that the apps were directed at children under 13. The FTC claimed that many of the apps included an optional feature that collected users’ email addresses. The FTC also claimed that TinyCo had received complaints from parents related to the apps and information collected from their children, but failed to take steps to verify whether TinyCo had collected information from the children. As in the Yelp action, the FTC alleged that TinyCo violated the COPPA Rule by failing to notify parents and obtain their consent before the company collected, used or disclosed personal information from children under 13 years of age.

Pursuant to the terms of the proposed settlement, TinyCo is required to pay a civil penalty of $300,000 and must delete information obtained from children under 13. TinyCo also is required to comply with the COPPA Rule requirements in the future and to submit a detailed compliance report one year from the date when the court order is entered.

A post on the FTC’s Business Center blog describing the settlement with Yelp identifies the following key takeaways:

• companies should not disregard COPPA compliance just because they believe their business is not child-related;
• companies need to appraise their apps in light of the privacy or security promises they make; and
• companies need to pay attention to the information prospective customers are providing because “[a]n age-screening feature that doesn’t really screen for age can hardly be considered effective.”