A federal class action lawsuit filed last week in California alleges that the Walt Disney Company is violating privacy protection laws by collecting children’s personal information from 42 of its apps and sharing the data with advertisers without parental consent.
The lawsuit targets Disney and three software companies — Upsight, Unity, and Kochava — alleging that the companies created mobile apps aimed at children that contained embedded software to track, collect, and then export their personal information along with information about their online behavior. The plaintiff, a San Francisco woman named Amanda Rushing, says she was unaware that information about her child, “L.L.,” was collected while playing mobile game Disney Princess Palace Pets, and that data was then sold to third parties for ad targeting.
The class action suit says this violates the Children’s Online Privacy Protection Act (COPPA), which was enacted by Congress in 1999 and designed to protect the privacy of children online. COPPA requires that companies designing apps for children under the age of 13 obtain consent from parents before collecting personal information. In 2013, the FTC revised COPPA, expanding what counts as personal information to include things like geolocation markers and IP addresses. The update also requires third-party advertisers to comply with the rules.
COPPA requires that companies designing apps for children under the age of 13 obtain consent from parents before collecting personal information
In total, the lawsuit names 42 Disney apps it says run afoul of COPPA. The plaintiff is seeking an injunction barring the defendants from tracking and sharing data collected without parental consent, as well as “appropriate relief, including actual and statutory damages and punitive damages,” plus all costs related to prosecuting the action.
Disney has responded to the lawsuit, saying:
“Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families. The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court.”
This is not the first time Disney has faced COPPA violations. In 2011, the FTC levied a $3 million civil penalty against subsidiary Playdom after it illegally collected and disclosed personal information from “hundreds of thousands of children under age 13 without their parents’ prior consent.”
The full list of Disney apps named in the lawsuit includes:
AvengersNet
Beauty and the Beast
Perfect Match
Cars Lightening League
Club Penguin Island
Color by Disney
Disney Color and Play
Disney Crossy Road
Disney Dream Treats
Disney Emoji Blitz
Disney Gif
Disney Jigsaw Puzzle!
Disney LOL
Disney Princess: Story Theater
Disney Store Become
Disney Story Central
Disney Magic Timer
Disney Princess: Charmed Adventures
Dodo Pop
Disney Build It Frozen
DuckTales: Remastered
Frozen Free Fall
Frozen Free Fall: Icy Shot
Good Dinosaur Storybook Deluxe
Inside Out Thought Bubbles
Maleficent Free Fall
Miles from Tomorrowland: Missions
Moana Island Life
Olaf's Adventures
Palace Pets in Whisker Haven
Sofia the First Color and Play
Sofia the First Secret Library
Star Wars: Puzzle DroidsTM
Star WarsTM: Commander
Temple Run: Oz
Temple Run: Brave
The Lion Guard
Toy Story: Story Theater
Where's My Mickey?
Where’s My Water? (paid, lite, and free)
Where's My Water? 2
Zootopia Crime Files: Hidden Object