A federal law that limits companies’ ability to collect data from children applies to businesses that gather data from connected toys and other devices, the Federal Trade Commission says.
Trying to keep pace with developments in internet-connected toys and other devices for children, the Federal Trade Commission (“FTC”) announced June 21, 2017 that it has updated its guidance, a “Six-Step Compliance Plan for Your Business,” for complying with the Children’s Online Privacy Protection Act (“COPPA”). COPPA is intended to help parents control what information is collected from young children. The FTC’s updated guidance, which is intended to help businesses understand when COPPA applies and how [click for more]
The FTC staff published today a “Six-Step Compliance Plan” for businesses to comply with the Children’s Online Privacy Protection Act (COPPA). The guidance, which provides a useful framework for businesses, states explicitly that COPPA applies to connected toys and other devices that collect personal information from children over the Internet.
All these years watching COPPA languish over the large enough to drive a truck through “Actual Knowledge” loophole I find out that I missed something big time. Go for the money not for the lawmakers.
Federal Trade Commissioner Julie Brill, one of the agency’s most vocal privacy advocates, is leaving the commission at the end of the month.
She will go to the law firm Hogan Lovells, where she will serve as co-director of the privacy and cybersecurity practice.
Today’s huge news that the FTC has settled COPPA violation cases with two small app developers with civil penalties totaling $360,000 came as quite a surprise. Since it has been nearly two and a half years since the updated COPPA became law, many had written off the FTC ever enforcing COPPA.
The EU thinks it can out-guess tweens and teens. US Congress thinks it can out-guess tweens and teens. The FTC used to think it could out-guess tweens. But anyone whom has ever taught young people, raised a young person or interacted with a young person knows they are wrong. No one can out-guess a tween or teen, except another tween or teen.
The fact that the FTC is making a show of enforcing COPPA is notable because it’s over a quarter of a million dollars’ worth of reminder that your games should be COPPA-compliant if there’s a chance they could collect personal information about a player under the age of 13, or be used to do so.
A hacker broke into the servers of toymaker VTech last month, compromising the personal information of millions of children and adults. While the consequences of the hack are still unclear, police now have a suspect. Authorities have arrested a 21-year-old man in the UK on suspicion of crimes related to unauthorized access to a computer, reports the BBC. “We are still at the early stages of the investigation and there is still much work to be done,” said officials in a statement.
On this past Monday, a class action lawsuit was filed in Superior Court in Los Angeles against Mattel and ToyTalk in their active roles promulgating the safety and privacy aspects of Hello Barbie. kidSAFE is also named under their role of COPPA safe haven. The lawsuit alleges unfair competition, negligence, unjust enrichment, and invasion of privacy. The plaintiffs so far are two little girls (and their mothers) who state that Hello Barbie is an “inherently dangerous product” and the information she gathers is unlawful and and the collection is negligent.
Plaintiff C.H. received the doll as a gift on December 2, 2015 from her mother Ashley Archer-Hayes. Plaintiff A.P. is a friend of C.H. and played with the doll at C.H.’s birthday party as did other party-goers. C.H. and her mother, Charity Johnson were not registered with ToyTalk or Mattel while they played with the doll allegedly “triggering” voice recording and cloud storage and the A.I. routines based on the recorded voice.
Plaintiff’s lawyers propose the following questions of law for certification in California and nationally:
- Whether Defendants failed to satisfy the requirements of COPPA;
- Whether Defendants’ conduct is an unlawful business act or practice within the meaning of Cal. Bus. & Prof. Code § 17200, et seq.;
- Whether Defendants have collected, used, or maintained recordings of children under 13 whose parents have not consented;
- Whether Defendants failed to reasonably prevent or detect recordings of children under 13 whose parents have not consented;
- Whether recordings of children under 13 whose parents have not consented have bee shared or sold to third parties by Defendants;
- Whether Defendants failed to notify affected individuals that their children had been recorded without their consent;
- Whether Defendants notified purchasers that they may only use the doll outside the presence of other children under 13;
- Whether Defendants’ conduct violated the causes of action herein alleged;
- Whether, as a result of Defendants’ conduct in this case, Plaintiffs have suffered ascertainable loss; and
- Whether Plaintiffs are entitled to monetary damages and/or other remedies, and, if so, the nature of any such relief.
Copy of the lawsuit (warning, large file to do processing and OCR): HelloBarbieComplaint.pdf
I’m think COPPA won’t be the lynch pin here. I think the dodge is the Actual Knowledge standard. COPPA doesn’t kick in unless the online site or service is aware that someone under 13 is using the service. C.H. is under COPPA and verified parental consent was obtained from her mother. “Actual Knowledge” is a huge loophole though I haven’t seen it used when”incidental” PII is captured.
The COPPA angle seems to be against common sense. A 13 year old may upload a video to a COPPA compliant website of his 10 year old brother playing video games. The 13 year old isn’t a parent but I’m sure the 10 year old doesn’t have to have verified parental consent else the video service is in trouble. Another example is smart phone created for a child under 13 where the child’s parent provided verified consent. Lets say the child handed the phone to another preteen who then snaps a selfie of their self. Is it a violation that the phone manufacturer should have known that the phone would come into contact with other children? Did C.H.’s mom have enough information provided by Mattel that would make her responsible for understanding what the doll does and therefore how it might gather info from other girls that enter the house?
The other causes of action might have more merit and they definitely can survive if COPPA gets knocked out. They include:
Violation of the Unfair Competition Law
Unjust Enrichment (they made money on the doll where they shouldn’t have)
Invasion of Privacy
David vs. Goliath:
The attorneys for the proposed class are not ambulance chases (though this lawsuit came together in a few days). They are big time tort and class action practitioners. The primary law-firm is Kirtland & Packard with 4 attorneys appearing in the case. There are three more in California, two in Florida, and one in Wilmington N.C. That’s 10 attorneys total
But will Mattel be toppled? I’ve always been concerned with the fact that they didn’t do all of the heavy lifting themselves. They are exporting a lot of risk to a third party that they are ultimately responsible for. Did Mattel’s lawyers didn’t think of this? The main thing that has made me think that Mattel was COPPA compliant was because they have better lawyers than the F.T.C.
This would be a massive screw-up. Forget the money or removing the doll from the marketplace, good will is paramount for them.
What happens next:
Mattel has 30 calendar days to respond to the lawsuit starting from December 7, 2015. They will likely motion for additional time which the Plaintiff’s lawyers will agree to out of courtesy. No danger for a market upset this Christmas. There’s also a chance that the case will be removed to Federal court which will make it easier for court watchers to keep an eye on it. If that happens then the laws of California will still prevail.
The long-term solution would be to have a notice explaining what can happen if the doll interacts with other children. Maybe it should say that the parent is responsible for how their children play with the dolls. But isn’t that common sense?
Blame Mattel or blame mom?
The lawsuit states that kidSAFE’s list (seals) do not included Hello Barbie but the doll seems to be listed here: http://www.kidsafeseal.com/certifiedproducts/toytalk_hellobarbie_device.html