A federal class action lawsuit filed last week in California alleges that the Walt Disney Company is violating privacy protection laws by collecting children’s personal information from 42 of its apps and sharing the data with advertisers without parental consent.
The lawsuit targets Disney and three software companies — Upsight, Unity, and Kochava — alleging that the companies created mobile apps aimed at children that contained embedded software to track, collect, and then export their personal information along with information about their online behavior. The plaintiff, a San Francisco woman named Amanda Rushing, says she was unaware that information about her child, “L.L.,” was collected while playing mobile game Disney Princess Palace Pets, and that data was then sold to third parties for ad targeting.
The class action suit says this violates the Children’s Online Privacy Protection Act (COPPA), which was enacted by Congress in 1999 and designed to protect the privacy of children online. COPPA requires that companies designing apps for children under the age of 13 obtain consent from parents before collecting personal information. In 2013, the FTC revised COPPA, expanding what counts as personal information to include things like geolocation markers and IP addresses. The update also requires third-party advertisers to comply with the rules.
Disney has responded to the lawsuit, saying:
“Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families. The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court.”
This is not the first time Disney has faced COPPA violations. In 2011, the FTC levied a $3 million civil penalty against subsidiary Playdom after it illegally collected and disclosed personal information from “hundreds of thousands of children under age 13 without their parents’ prior consent.”