FTC enforces the Children’s Online Privacy Protection Act

WW International Being Fined by the Federal Trade Commission for Privacy Violations

WW International, Inc., previously known as Weight Watchers, has found itself in the crosshairs of the Federal Trade Commission (FTC).  The Department of Justice filed a complaint on behalf of the FTC alleging that the defendant marketed a weight loss app for children as young as eight years old and then collected their personal information without parental consent.  The FTC’s request for relief is that the defendant would pay a $1.5 million fine, delete any personal information collected from children under 13 without parental consent, and destroy any algorithms that the defendant derived from the data.

The personal information of children is generally considered to be sensitive personal information and deserving of greater privacy protections than comparable information about adults.  One particular app, known as Kurbo by WW, is the result of a collaboration with one of WW International, Inc.’s subsidiaries, Kurbo.  Kurbo is also a named defendant in the complaint.  Kurbo by WW, was alleged to be marketed to families, teens, and children as young as eight years old.  It tracks the food intake, activity, and weight of users.  It doesn’t anonymize the data though, they also collect the names, email addresses, and birth dates of the corresponding users.

Under the Children’s Online Privacy Protection Act (COPPA), websites, apps, and online services must notify parents and get parental consent prior to processing the personal information of any children under the age of 13.  Over the course of several years, hundreds of users of the app allegedly signed up, indicating that they were over 13 years of age, but then subsequently filled out their birthdates, indicating that they were in fact not yet 13 years of age.  With this contradictory information, indicating that Kurbo by WW was possibly illegally processing the data of children under 13, the defendants should have attempted to get parental consent for the users whose birthdates indicated they were under 13 or otherwise stopped processing their data.

More recently, Kurbo by WW made some changes to the sign-up process but allegedly still failed to verify that the “parent” giving consent was in fact the child’s parent.

Even when a parent did sign their child up, the notice was allegedly inadequate.  The complaint indicates that a parent would have to click through multiple hyperlinks before being shown the details of Kurbo by WW’s information collection of children.

The COPPA also has rules regarding data retention.  Kurbo by WW is alleged to have violated these as well.  Under the COPPA, companies should not be retaining the personal information of children indefinitely, but instead need to delete it after it has fulfilled the purpose for which it was collected.

Although state privacy laws have been hogging the limelight lately in the privacy world, the FTC is always lurking in the background, discouraging deceptive and unfair business practices and scams, and enforcing various privacy focused federal rules, such as the COPPA.  Clarip’s consent management features can help companies to stay out of the crosshairs of regulators like the FTC and ensure that you only collect data with proper consent.  Clarip’s other privacy compliance solutions include automated data subject request fulfillment, automated data mapping, vendor management, website scanning, data risk intelligence, and much more.  Call us at 1-888-252-5653 or visit our website at www.clarip.com to learn more.

Email Now:

Mike Mango, VP of Sales
mmango@clarip.com