BabyBus (Fujian) Network Technology Co., Ltd. ("BabyBus" or "Company") is a China-based developer of children's apps that markets dozens of apps for toddlers and young children mainly between the ages of 1 and 6. On December 17, 2014, the Federal Trade Commission ("FTC") sent a letter to BabyBus warning the Company that it appeared to be in violation of the Children's Online Privacy Protection Act ("COPPA") Rule and focusing on the parental consent requirements.
The COPPA Rule requires companies collecting personal information from children under 13 years of age to post clear privacy policies and to notify parents and get their consent before collecting, using or disclosing any information from a child. The FTC promulgated a revised rule in 2013 to adapt to the growth of mobile technology aimed at children. The FTC recentlydefined personal information to include precise geolocation data, like GPS coordinates. In its letter to BabyBus, which was published on the FTC's website and made public on December 22, 2014, the FTC states that BabyBus' child-directed apps appear to collect precise geolocation information about users. Since the apps are directed towards children between the ages of 1 and 6, who apparently are the targeted "users" of the apps, the letter notes that the Company appears to be in violation of the COPPA because it does not obtain the parents' consent before collecting children's personal information. The FTC further alleges that the Company also appears to collect and share the geolocation information to third parties, including advertising networks and analytics companies. In the letter, Maneesha Mithal, associate director in the FTC's division of privacy and identity protection, recommended that the Company "review all of your applications with respect to the online collection of personal information from children in light of COPPA's legal requirements," also warning that the FTC will review the Company's apps again in the next month to ensure that they are in compliance with the Rule.
The FTC can enforce actions against companies violating the COPPA as a violation of Section 5 of the FTC Act, which bars unfair and deceptive acts and practices in or affecting commerce. A court can hold operators who violate the Rule liable for civil penalties of up to $16,000 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties and the size of the company.
The letter from the FTC to BabyBus is available here.