On the heels of the FTC’s updated Children’s Online Privacy Protection Rule, Google and Viacom are facing multiple lawsuits for alleged child-related privacy violations.
According to the six different class actions filed in federal courts across the country, cookies were placed by Viacom and Google in the computers of children who visited sites such as Nick.com and NickJr.com. The companies then collected and shared information about children who visited the site.
In the California lawsuit, a plaintiff under the age of 13 created a profile on the Nickelodeon sites and watched videos. During the plaintiff’s visits to the sites, Google’s DoubleClick placed cookies in the child’s computer that tracked communications both to the Nick Web sites and other Web sites visited by the computer, according to the complaint. The suit alleges Viacom allowed Google to track the plaintiff’s use of the site and to then use that data to sell targeted advertising “based on [the plaintiff’s] individualized web usage communications and videos requested and obtained.”
As the registration process requires that users provide their birthdates, the suit contends Viacom was aware of the users’ age. Despite this knowledge, “Viacom does not attempt to gain permission or otherwise inform the parent or guardian” that an account has been created, the plaintiff claims.
The suits allege violations of the Video Privacy Protection Act and the Wiretap Act and seeks statutory damages of $2,500 per violation to $100 for each day the plaintiffs’ data was wrongfully obtained or $10,000 per violation, respectively. The complaints also request punitive damages and injunctive relief.
To read the complaint in L.G. v. Google, click here.
Why it matters: The lawsuits were filed one week after the FTC updated the COPPA Rule and may benefit from the current regulatory focus on children’s privacy. In the updated Rule, the FTC revised the definition of “personal information” to include persistent identifiers such as cookies, which have the ability to identify an individual, either by themselves or coupled with other information. Not surprisingly, consumers (and perhaps more importantly, the plaintiffs’ bar) have embraced this new definition and are now seeking to apply these data collection practices to decades-old privacy statutes in the hopes of proving liability and exacting penalties from the defendants.