Last week, a federal class action lawsuit was filed in California against the Walt Disney Company for allegedly violating privacy protection laws by collecting children's personal information from 42 of its apps and sharing data with advertisers without parental consent.
Disney and three software companies – Upsight, Unity and Kochava – have been targeted by the lawsuit alleging that the companies have created mobile apps aimed at children that contain embedded software to track, collect, and export their personal information along with information about their online behaviour.
A San Fransisco woman, the plaintiff, Amanda Rushing says she was unaware that information about her child was collected while playing Disney Princess Palace Pets, and that data was then sold to third parties for ad targeting.
The class action suit claims that this violates the Children's Online Privacy Protection Act (COPPA), which was enacted by Congress in 1999. The act was designed to protect the privacy of children online.
COPPA requires that companies who design apps for children under 13 years of age obtain consent from parents or guardians before collecting personal information. In 2013, the FTC revised COPPA, expanding what counts as personal information to include geolocation markers and IP address, among other things. In addition, the update requires third-party advertisers to comply with the rules.
In total, the lawsuit names 42 Disney apps that have run afoul of COPPA. These Include:
The plaintiff is seeking an injunction barring the defendants from tracking and sharing data collected without parental consent, as well as "appropriate relief, including actual and statutory damages and punitive damages," – plus all costs related to prosecuting the action.
Disney has responded to the lawsuit, saying: "Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families. The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court."
This is not the first time Disney has faced COPPA violations – in 2011, the FTC levied a $3 million civil penalty against subsidiary Playdom after it allegedly collected and disclosed personal information from "hundreds of thousands of children under age 13 without their parents' prior consent."
Hopefully, the lawsuit ensures that the privacy and protection of children using Disney apps are secured.
