Earlier this week, the Federal Trade Commission announced that it had reached a settlement with VTech Electronics Limited, a Chinese manufacturer of electronic learning toys, and its North American subsidiary over charges that VTech violated the Children’s Online Privacy Protection Rule (“COPPA”), a rule designed to “strengthen kids’ privacy protections and give parents greater control over the personal information that websites and online services may collect from children under 13.” The FTC’s complaint centered on three web-based platforms VTech created and maintained to support its numerous connected toys. The platforms are the Learning Lodge Navigator, a platform akin to Apple’s App Store that allows users to download games and content to their VTech devices; Kid Connect, a children’s messaging app for smart phones; and Planet VTech, an online platform that allows online game play and messaging between users. Each of these products allowed for children to share personal information or required registration from parents, including information such as a child’s name and age. In some instances, VTech stated that the collected information would be encrypted, which it was not.

The FTC complaint charged that VTech violated COPPA by (1) “failing to post a privacy policy [] providing clear, understandable, and complete notice of their information practices”; (2) “failing to provide direct notice of their information practices to parents”; (3) “failing to obtain verifiable parental consent prior to collecting, using, and/or disclosing personal information from children”; and (4) “failing to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of personal information collected from children.” As a result of the settlement, VTech will pay $650,000 to the FTC and is enjoined from future violations of COPPA. VTech must also implement and maintain a revised data security program that ensures the future protection and integrity of all collected personal information data.

The settlement order marked the first such action relating to connected toys, which have been a subject of interest to the FTC Bureau of Consumer Protection. Late last year, the FTC released a new policy enforcement statement regarding COPPA with respect to connected toys. The FTC indicated that in certain circumstances, it would refrain from pursuing COPPA enforcement actions against children toy-makers that briefly record (and then delete) a child’s voice from the purpose of replacing written words. However, this relaxation of privacy enforcement would not apply if the company failed to get consent before obtaining information about the child’s name or location or if the company failed to provide information, prominently, about its privacy policy.

Although the VTech platforms at issue in this settlement are not akin to the voice-control systems that were the subject of the FTC’s recent guidance, given the range of infractions by VTech, it seems unlikely that the recent “loosening” would have been any consolation to the company. Here, VTech was not recording children’s voices for the purposes of replacing written words. Instead, children and parents who used the VTech toys could register the children and parent’s personal information, including date of birth, e-mail and physical address. With one of the platforms at issue in the settlement, Kid Connect, the company failed to have a mechanism in place to verify that a parent was registering, or giving consent, for the child to sign-up. As a result, the company could have the child’s actual physical location without the parent’s approval. In a second platform at issue, Planet V-Tech, the personal information of the children was neither encrypted while submitted or while in transmission and storage. In addition, the FTC found that the company’s privacy policy was insufficient and misleading.

While connected toy manufacturers may have taken the FTC’s relaxed position on COPPA violations relating to voice collection as comforting, the agency’s settlement with VTech is a clear sign that position does not signal a lack of attention focused on the industry or willingness to pursue action against its participants. Although other connected toy manufacturers may view VTech’s violations as egregious, they would be wise to take stock of their own data collection and storage practices to ensure they may not be engaging in similar, if not lesser, violations of COPPA. While the VTech settlement may mark the first such action against a connected toy manufacturer, it may not be its last.