Disney sued for illegally tracking children through its mobile games

Disney is being sued for allegedly violating privacy laws by illegally tracking and collecting children's personal information and activity through its mobile games. The lawsuit, filed in the US District Court for the Northern District of California on Thursday (3 August) on behalf of Amanda Rushing who claims that her daughter was tracked using the Disney Princess Palace Pets app.

The gaming app allegedly contains ad-tracking software that keeps track of users' online activities. The collected data is then sold to third-party companies for ad-targeting purposes.

The FTC has stringent regulations regarding internet companies collecting data about children under the age of 13.

According to the 1999 Children's Online Privacy Protection Act (COPPA), developers that design apps for kids, as well as third-party advertisers, are required to obtain verifiable parental consent before collecting personal information for children under age 13.

"Most consumers, including parents of children consumers, do not know that apps created for children are engineered to surreptitiously and unlawfully collect the child-users' personal information, and then exfiltrate that information off the smart device for advertising and other commercial purposes," the complaint reads.

It also notes that children are "especially vulnerable" to online tracking and subsequent targeted advertising.

"As children's cognitive abilities still are developing, they have limited understanding or awareness of sophisticated advertising and therefore are less likely than adults to distinguish between the actual content of online gaming apps and the advertising content that is targeted to them alongside it," the suit reads. "Thus, children may engage with advertising content without realizing they are doing so."

The complaint alleges that Disney embedded software development kits (SDKs) in its gaming apps to collect users' personal information and track their online behaviour to "facilitate behavioral advertising or marketing analysis" and create "robust online profiles" to target them over time across various websites and services.

While the complaint focuses on the game "Disney Princess Palace Pets", it also mentions dozens of other popular Disney sims that also use similar ad-tracking technology including Cars Lightning League, Disney Crossy Road, Disney Build it Frozen, Club Penguin Island and Zootopia.

Rushing alleges that Disney failed to obtain "verifiable" parental consent and claimed she "never knew" that the company "collected, disclosed or used her child's personal information" because the firm did not provide any required disclosures or sought consent from parents.

The suit also noted that Disney has been accused of violating COPPA in the past as well.

In 2011, Disney's subsidiary Playdom Inc. was ordered to pay a $3m (£2.29m) penalty for illegally collecting and disclosing the personal data of hundreds of thousands of children under age 13 without parental consent - the largest civil penalty for a violation of the FTC's COPPA.

"Congress enacted COPPA for very good reasons," Michael W. Sobol, one of the attorneys who filed the lawsuit, said in a statement. "As a company long-engaged in the practice of engaging – and profiting from – children, Disney needs to make sure its games and apps comply with the law. They and the companies they work with always have to obtain verifiable parental consent before extracting kids' data from their mobile devices when kids play Disney's mobile apps."

The plaintiffs are asking the court to certify the suit as a class action, and are seeking an injunction to force the company to cease tracking the personal information of children without prior verifiable consent from parents. They also seek unspecified damages "in an amount to be determined at trial."

In a statement to TheWrap, a Walt Disney Company spokesman said: "Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families.The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in Court."