Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Our Privacy, Cyber & Data Strategy and Consumer Protection/FTC teams offer key takeaways from the Federal Trade Commission's enforcement action in the midst of renewed emphasis on children's privacy by both the Biden Administration and Congress.

On March 4, 2022, the Federal Trade Commission (FTC) announced a settlement of an enforcement action against WW International, formerly known as Weight Watchers, and Kurbo alleging that the companies' app did not comply with the Children's Online Privacy Protection Act (COPPA) and the regulations promulgated by the FTC pursuant to COPPA. The complaint, filed in the Northern District of California, alleges that WW violated COPPA by failing to provide notice and obtain verifiable parental consent before collecting personal information from children under age 13 and violated the COPPA Rule by failing to implement proper data retention and deletion practices.

The settlement order requires the companies to pay a $1.5 million civil penalty, delete personal information illegally collected from children under 13, and destroy any algorithms derived from the data. This comes as the Biden Administration and Congress express a continued interest in protecting the personal information and privacy of children.

COPPA and the FTC's COPPA Rule, which apply to businesses that collect online personal information from users, require covered entities that market their products or services to children under 13, or who have actual knowledge that a user is a child under 13, obtain verifiable parental consent before collecting information from the user. Personal information under the COPPA Rule includes, among other things, names and addresses, phone numbers, email addresses and screen names, persistent identifiers, hobbies and interests, photos or video or audio files, IM details, or geolocation information.

The rule further requires that covered entities provide parents with direct notice of the entity's practices for the collection, use, or disclosure of personal information from children and that covered entities only retain the personal information collected online from children for as long as is reasonably necessary to fulfill the purpose for which the information was collected.

WW and Kurbo market a weight management app, Kurbo by WW, that tracks food intake, weight, and activity and collects information such as name, date of birth, and email address. The app is marketed to families, teens, and children as young as eight, and therefore is “directed to children” within the meaning of COPPA. The original age gate mechanism implemented by WW and Kurbo in 2014 for Kurbo by WW offered users an option to have a parent register or to indicate the user is 13 or older. In addition, users who registered as 13 or older could update their profile after registration to reflect that they were under 13 without being barred from the app.

FTC staff contacted WW about these features in 2019. WW and Kurbo updated the age gate mechanism in response, but according to the FTC, the new interface still encouraged children under 13 to falsely declare that they are 13 or older in order to use the app. An age gate alone is not sufficient to ensure compliance with COPPA. Covered entities need additional mechanisms or additional actions to ensure the age gate is effective.

The FTC alleged that this insufficient age gate mechanism resulted in WW and Kurbo collecting personal information of children under 13 without securing verifiable parental consent. The FTC also alleged that parents were not provided proper notice of the app's information collection practices. In the complaint, the FTC notes that parents were only shown a notice containing information about the website's information collection practices if they clicked a hyperlink buried in a string of other links. According to the FTC, this did not satisfy COPPA's requirement that the notice be prominent and clearly labeled.

Finally, the FTC alleged that WW and Kurbo retained data indefinitely, only deleting information upon request by a parent. The settlement order from the FTC requires WW and Kurbo to delete information relating to children under 13 if they have not used the app in more than a year.

This enforcement action comes in the midst of renewed emphasis on children's privacy by both the Biden Administration and Congress. President Biden noted in the State of the Union address on March 1 that it's “time to strengthen privacy protections,” including banning targeted advertising to children and demanding that tech companies stop collecting personal data on children. Before President Biden's call for increased protections for children's sensitive information, Congress showed interest in increasing the safety of children online. Proposed bills include increased protections for children on social media, as well as bans on targeted advertising to children and tighter restrictions on the use of children's data in marketing.

Any entity that markets online products or services to children under 13, or that has actual knowledge that children under 13 use its online services, and collects personal information should consider the following to ensure compliance with COPPA.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

  © Mondaq® Ltd 1994 - 2022. All Rights Reserved.

Password Passwords are Case Sensitive

Free, unlimited access to more than half a million articles (one-article limit removed) from the diverse perspectives of 5,000 leading law, accountancy and advisory firms

Articles tailored to your interests and optional alerts about important changes

Receive priority invitations to relevant webinars and events

You’ll only need to do it once, and readership information is just for authors and is never sold to third parties.

We need this to enable us to match you with other users from the same organisation. It is also part of the information that we share to our content providers ("Contributors") who contribute Content for free for your use.