The Federal Trade Commission (“FTC”), in coordination with the Justice Department, recently announced a settlement in the first public enforcement action applying the Children’s Online Privacy Protection Act (“COPPA”) to mobile applications (“apps”). Regulators alleged that mobile app provider W3 Innovations, LLC d/b/a Broken Thumbs Apps (“W3 Innovations”), as well as the company’s president and majority owner, violated COPPA by failing to provide adequate notice of the company’s privacy practices and to obtain verifiable parental consent to the collection of children’s personal information.

The targeted practices and required remedies in the W3 Innovations case are similar to those in prior COPPA enforcement actions; the novelty of the case lies in the application of these patterns to the mobile app context. The Complaint takes the position that the mobile apps offered by W3 Innovations were “online services directed to children” within the scope of COPPA because they “send and/or receive information over the Internet.”1 Specifically, the apps discussed in the Complaint contained features allowing children to e-mail the company and to post blog entries and comments to the Internet.

The FTC’s Consent Decree2 requires the defendants to:

  • Delete all personal information previously collected in violation of COPPA
  • Pay a civil penalty of $50,000
  • Comply with COPPA within 60 days
  • Submit to compliance monitoring upon FTC request
  • Report on compliance to the FTC, including filing a detailed written report within 60 days
  • Meet detailed record-keeping requirements
  • Comply with administrative requirements such as distributing the order to relevant employees

In particular, the Consent Decree requires W3 Innovations to post a privacy notice, give direct notice to parents, and obtain verifiable parental consent for data practices in connection with covered websites and online services. The settlement does not give any explicit guidance regarding how W3 Innovations should satisfy these COPPA obligations within the limitations of the mobile environment.