The Walt Disney Company, Disney Enterprises, Disney Electronic Content Inc. and software companies Kochava, Upsight and Unity are accused of embedding tracking software in mobile apps geared toward children, which tracked their online behavior and collected their information.
Amanda Rushing of San Francisco, the plaintiff, said she was unaware that third parties were using data collected from her child while playing the Disney Princess Palace Pets mobile game. The data collected is used to generate targeted ads.
Under the 1999 Children’s Online Privacy Protection Act (COPPA), parental consent must be given before companies that design applications for children younger than 13 can collect personal information. The federal lawsuit says that 42 Disney apps have violated the COPPA.
Rushing is seeking an injunction that would prohibit the companies from tracking and sharing information gathered without consent, along with "appropriate relief, including actual and statutory damages and punitive damages," and legal costs, according to The Verge.
The complaint says that collected data can be used "to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps."
This chronology is “then sold to various third-parties who sell targeted online advertising."
Responding to the lawsuit in a statement, the Walt Disney Company said, "Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families. The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court."
One of the attorneys who filed the lawsuit, Michael W. Sobol, said in a statement that Congress enacted the COPPA legislation "for very good reasons."
"As a company long-engaged in the practice of engaging — and profiting from — children, Disney needs to make sure its games and apps comply with the law," he said. "They and the companies they work with always have to obtain verifiable parental consent before extracting kids’ data from their mobile devices when kids play Disney’s mobile apps."
Disney has violated COPPA in the past, according to the complaint, and Disney subsidiary Playdom had to pay a record-setting $3 million civil penalty in 2011 for collecting and sharing the data of "hundreds of thousands of children under age 13 without their parent's’ prior consent," according to the Federal Trade Commission.
