The Mobile App Playground: Looking Out for Kids’ Data Privacy

Jun 11, 2020, 09:01 AM by BBB National Programs

 

The FTC has just announced that they have reached a settlement with children’s app developer, HyperBeard, for unlawfully collecting data from children, users under 13, and using it to target them for behavioral advertising, otherwise known as interest-based advertising. As a result of this settlement, HyperBeard is prohibited from using or benefitting from the personal data they have collected and must delete that data. On top of that? A settlement of $150,000. 

So how did this all start? Back in early 2019, the Digital Advertising Accountability Program (DAAP) and Children’s Advertising Review Unit (CARU) jointly opened an inquiry into HyperBeard based on concerns that  one of their child-directed online apps could be collecting personally identifiable information (PII) from children under 13  without verifiable parental consent.  

CARU and DAAP conducted a thorough investigation of the app’s privacy practices, both overtly and “under-the-hood," to get a sense of exactly what technology the app was employing for data collection. When CARU and DAAP contacted HyperBeard about these concerns, the company did not respond to the inquiry letter, resulting in a referral to the FTC on March 5, 2019.  

Under COPPA, the Children’s Online Privacy Protection Act, if HyperBeard wanted to collect user data from children under age 13 from its app for advertising purposes, they would have needed to obtain verifiable parental consent first. Targeting children for behavioral advertising is an especially egregious COPPA violation because that data can not only reveal a child’s entertainment preferences, but their habits and even their daily routine.  

Because of the sensitive nature of behavioral advertising to children under 13 and concern for children’s overall safety while using mobile apps and games, the FTC and CARU want to empower parents to learn more about the online experiences their children are having. To that end, the FTC developed mobile app safety tips for parents, which include recommending that parents talk to their children about what personal information is and the importance of keeping that information private. The FTC and CARU encourage parents to try out children’s apps first to see how they operate. Parents can, and should, look at screenshots from the app, app reviews, and the app developer’s website and privacy policy to get a good sense of how safe the app would be for their child to use and note whether the app publisher participates in a COPPA safe harbor program. 

FTC_kids-apps-infographic

Parents also often don’t realize when there are settings they can enable to manage their child’s mobile device activity, including Apple’s screen time feature and Google’s Family Link. (To learn more, visit Keeping it Under Control, Parental Control.) Another setting parents can enable on a device a child is using to access mobile apps is Limit Ad Tracking (on iOS) or Opt-Out of Ads Personalization (on Android). This is important for apps that children encounter that may not be specifically intended for children, and therefore may not be treating the data they are collecting as children’s data. This feature disables the device’s advertising ID, which is a type of persistent identifier defined by COPPA as personal information, that allows advertisers to target and serve that device with behavioral advertising.  

The mission at BBB National Programs is to help companies adopt best practices to enhance consumer trust. We are experts in data privacy and truth-in-advertising and want to support companies who want to do good by their consumers. We find that companies respect and participate in the self-regulatory process because they understand that the U.S. economy is built on a fair and transparent marketplace. Our monitoring and enforcement actions within the mobile app environment, and our collaboration with government regulatory agencies like the FTC, are a key part of maintaining a level playing field for all businesses, upholding established best practices for data privacy, and ensuring a trustworthy environment for consumers, especially children.

 

 

Other Blog Articles

Blog

Contact Tracing and Tech: An International Comparison

To confront coronavirus, governments across the globe have devised approaches for tracing its spread and quarantining individuals known to be carriers, also known as “contact tracing.” While almost all strategies rely on traditional means of contacting and recording the movements of infected individuals, many employ modern communications technologies: sensors, Bluetooth, GPS, thermal recognition, facial-recognition, and geofencing.
Read more
Blog

Caution and Criticism: Contact Tracing through Mobile Apps

Across the world, new apps are being created to facilitate contact tracing through mobile devices. The hope is that through these technologies, governments across the globe avoid future lockdowns and moderate social distancing orders. Though governments and corporations have marshalled impressive resources to develop these strategies, contact tracing powered by smartphones comes with inevitable challenges, regardless of the technologies used and the categories of contact data generated.
Read more
Blog

Contact Tracing: The Technology

Imagine that you have been placed in charge of setting up a contact tracing system using the smartphones already in the hands of the public. As we explained in our first piece in this series, one of the main goals of this system is to alert those who may have come into contact with others infected with coronavirus. Certain information—such as the precise location where such contact has taken place—may be useful but is not strictly necessary to the app’s purpose. And, for the sake of privacy, you want to avoid releasing identifying...
Read more
Blog

Privacy and App-Driven Contact Tracing

SARS-CoV-2, commonly known as coronavirus, hit the world by storm, altering the lives of people from the American midwest to Shanghai. As the world unites to “flatten the curve” and guard the surge capacities of hospitals, a common term that has emerged is “contact tracing.” Contact tracing is broadly defined as monitoring individuals that have had contact with a person infected by a disease to ensure that they get treatment and prevent further transmission.
Read more