The Federal Trade Commission (FTC) recently announced a settlement with online review site, Yelp, Inc., and mobile app developer, TinyCo, Inc., against separate charges that the companies were collecting children’s information in violation of the Children’s Online Privacy Protection Act, or COPPA.
In general, COPPA forbids online services from collecting data on children under the age of 13 without verifiable parental consent. A previous post on this blog discussing approved methods for obtaining verified parental consent under COPPA is available here.
The FTC’s complaint against Yelp, Inc., alleged that it has reason to believe that from 2009 to 2013, the company violated privacy laws by gathering information from children through the Yelp App without first notifying parents of its information practices, and obtaining verifiable parental consent before collecting, using, or disclosing personal information from children. The information in question was submitted during the registration process, and users were asked to provide their date of birth, but according the FTC, the company failed to test the age-registration feature on its application that would have prevented children under the age 13 from registering.
In a blog post on September 16, 2014, Yelp stated that the situation stemmed from a glitch in the registration process, and that “only about .02 percent of users who actually completed Yelp’s registration process during this time period provided an underage birthdate.” Under terms of the stipulation, among other things, Yelp will pay a $450,000 civil penalty, and is required to close the affected users’ accounts.
The FTC’s complaint against TinyCo, Inc., alleged that it has reason to believe that many of the company’s apps, including Tiny Pets, Tiny Zoo, and Tiny Monsters, which have been downloaded more than 34 million times, were targeted to children under the age of 13, and improperly gathered personal information from those children. Under the terms of the stipulation, among other things, TinyCo will pay a $300,000 civil penalty, and is required to delete the information it collected from children under 13.