OAKLAND — California Attorney General Rob Bonta, along with Los Angeles City Attorney Hydee Feldstein Soto, announced a $500,000 settlement with Tilting Point Media LLC (Tilting Point) resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA) by collecting and sharing children’s data without parental consent in their popular mobile app game “SpongeBob: Krusty Cook-Off.” In addition to $500,000 in civil penalties, Tilting Point must comply with injunctive terms ensuring legal data collection and disclosure, including obtaining parental consent and diligence in configuring third-party software in their mobile games.
“Businesses have a legal obligation to protect kids’ data and to comply with important state and federal privacy laws designed to protect children online. Failing to do this puts our kids at risk, leaving them vulnerable to having their personal data collected, tracked, and sold,” said Attorney General Bonta. “As children spend an increasing amount of time online, both on websites and using mobile apps, we will use every enforcement tool to ensure compliance with the law and that companies exercise diligence with privacy law requirements. I thank the Los Angeles City Attorney’s Office for their work on this issue and look forward to continuing to work collaboratively with local, state, and federal partners to protect children’s privacy.”
“The “SpongeBob: Krusty Cook-Off” game is based on some of the most beloved and recognizable characters in children’s entertainment. Tilting Point Media is alleged to have collected and shared its young players' personal data, violating consumer privacy laws and industry guidelines,” said Hydee Feldstein Soto, Los Angeles City Attorney. “Protecting our children has been a top priority for my administration. I am proud to partner with Attorney General Bonta to protect children throughout our State and am grateful to the lawyers in the Public Rights Branch in my office for initiating this action to stop data harvesting of minors.” Feldstein Soto continued.
“SpongeBob: Krusty Cook-Off” (SpongeBob) is a popular cooking simulation game that includes both targeted advertising and in-app purchases and is directed to children under the age of 13 as well as targeted to older teens and adults. The app was first investigated by the Children’s Advertising Review Unit (CARU), a division of the Better Business Bureau National Programs that investigates potential deceptive or inappropriate data collection from children online. CARU found that the privacy and advertising practices of the SpongeBob app failed to comply with COPPA and CARU’s industry guidelines. Although Tilting Point took some corrective action, a joint investigation by California Department of Justice and Los Angeles City Attorney’s Office found that Tilting Point was in violation of the CCPA and COPPA in connection with how the mobile app handled children’s data. Tilting Point’s age screen did not ask age in a neutral manner, meaning children were not encouraged to enter their age correctly to be directed to a child-version of the game. Additionally, Tilting Point inadvertently misconfigured third-party software development kits (SDKs), resulting in the collection and sale of kids’ data without parental consent.
In addition to paying $500,000 in civil penalties, Tilting Point media must comply with strong injunctive terms. Tilting Point must:
- Comply with the CCPA and COPPA related to children’s data in the SpongeBob game and all of its games directed to children.
- Not sell or share the personal information of consumers less than 13 years old without parental consent, and not sell or share the personal information of consumers at least 13 and less than 16 years old without the consumer’s affirmative “opt-in” consent.
- In instances where Tilting Point sells or shares the personal information of children, provide a just-in-time notice explaining what information is collected, the purpose, if the information will be sold or shared, and link to the privacy policy explaining the parental or opt-in consent required.
- Use only neutral age screens that encourage children to enter their age accurately.
- Appropriately configure third-party software development kits (SDKs) to comply with legal requirements related to children’s data.
- Implement and maintain a SDK governance framework to review the use and configuration of SDKs within its apps.
- Comply with laws and best practices related to advertising to minors, and minimize data collection and use from children.
- Implement and maintain a program to assess and monitor its compliance with the judgment, including annual reports to the California Department of Justice and Los Angeles City Attorney’s Office.
COPPA AND CCPA
COPPA is a federal law that requires operators of websites and online services that are either directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13, to provide notice to parents and obtain parental consent before collecting, using, or disclosing personal information from children. The CCPA is a landmark state law that secures increased privacy rights for California consumers, including the right to know how businesses collect, share, and disclose their personal information and the right to opt-out of the sale or sharing of their personal information. The CCPA imposes on businesses specific responsibilities related to children’s data, including requiring parental consent before selling or sharing personal information from children under 13 years old, and obtaining the consumer’s affirmative opt-in consent for users at least 13 and under 16 years old.
A copy of the complaint and proposed judgment, subject to court approval, can be found here and here.