Toy Company Settles DOJ Complaint Alleging Violations of Children’s Online Privacy Rule and FTC Act
The Federal Trade Commission (FTC) recently announced a settlement with an electronic toy manufacturer for violating the Children’s Online Privacy Protection Rule (COPPA) and the FTC Act. The COPPA Rule prohibits unfair or deceptive acts or practices in connection with the collection, use and/or disclosure of personal information on the internet from and about children under the age of 13. The FTC Act prohibits false or misleading statements to consumers.
According to a Department of Justice (DOJ) Complaint, the toy manufacturer marketed and sold “electronic learning products,” games, applications, and other related online content for young children that resulted in the creation of nearly 3,000,000 online accounts.
One online gaming application allegedly allowed unencrypted customer accounts to be created without a mechanism in place to verify that the person creating the account was a parent and not a child. The DOJ Complaint also alleges the company failed to encrypt stored customer account data, including personally identifiable information, and customer-created content, such as communications, photos, and audio recordings created by children.
The company allegedly failed to provide online links to its Privacy Policy when personal information was collected from account holders, nor did it provide adequate notice of its information collection and use practices, in direct violation of the COPPA Rule. The company allegedly violated the FTC Act by making a false or misleading statement online that personally identifiable information submitted by consumers would be transmitted in encrypted form.
In November 2015, a hacker breached the company’s computer network and gained access to personally identifiable information of customer account holders, including information about children who used the company’s products online.
The company’s failures to provide notice to consumers about its information collection/use practices, to obtain verifiable parental consent to collect information, and to protect the confidentiality of consumer information was deemed an unfair or deceptive act or practice in or affecting commerce. The settlement of the case included a $650,000 payment by the company to the FTC and a permanent injunction on future practices that would violate the COPPA Rule and FTC Act.
The FTC’s announcement of the settlement can be viewed here: https://www.ftc.gov/news-events/press-releases/2018/01/electronic-toy-maker-vtech-settles-ftc-allegations-it-violated.
The DOJ Complaint can be viewed here: https://www.ftc.gov/system/files/documents/cases/vtech_file_stamped_complaint_w_exs_1-8-18.pdf.
