Morrison Foerster is an international law firm with lawyers practicing throughout the United States, Asia, and Europe. Click to discover more.

mofo_share_image.jpg

Morrison Foerster

favicon.ico

favicon-16x16.png

favicon-32x32.png

apple-touch-icon.png

MoFo Favicons

Terms / Notices

Cookies

Privacy Policy

Attorney Advertising

Secure Login

Alumni

  Facebook

MoFo Facebook

  Linkedin

MoFo LinkedIN

Twitter

MoFo Twitter

YouTube

MoFo Youtube

Morrison Foerster - Footer

You have not solved the recaptcha challenge yet or session expired, try again.

Disclaimer

<p>Unsolicited e-mails and information sent to Morrison Foerster will not be considered confidential, may be disclosed to others pursuant to our <a href="https://www.mofo.com/about/privacy-policy.html"><u><em>Privacy Policy</em></u></a>, may not receive a response, and do not create an attorney-client relationship with Morrison Foerster. If you are not already a client of Morrison Foerster, do not include any confidential information in this message. Also, please note that our attorneys do not seek to practice law in any jurisdiction in which they are not properly authorized to do so.</p>

Feedback

mofo-logo-2022.svg

People

Capabilities

Resources

About

Culture

Offices

Careers

Stay Connected

In the wake of the COVID-19 pandemic, children are spending more of their lives in the digital realm, both for education and entertainment purposes—but that doesn’t mean the Federal Trade Commission (FTC) is cutting online operators slack for not complying with the Children’s Online Privacy Protection Act (COPPA). Last week, the FTC levied a $4 million penalty against HyperBeard, Inc., a popular mobile app developer, to settle allegations that HyperBeard integrated third-party ad networks into its child-directed apps in violation of COPPA.

It’s 10 p.m. Do You Know What Your Third-Party Integrations Are Doing? Mobile App Developer Fined $4 Million for Alleged COPPA Violations Through In-App Advertising

About Morrison Forester

people-default-header-desktop.jpg

people-default-header-mobile.jpg

Default Meta Data

<p>In the wake of the COVID-19 pandemic, children are spending more of their lives in the digital realm, both for education and entertainment purposes—but that doesn’t mean the Federal Trade Commission (FTC) is cutting online operators slack for not complying with the Children’s Online Privacy Protection Act (COPPA). Last week, <a href="https://www.ftc.gov/news-events/press-releases/2020/06/developer-apps-popular-children-agrees-settle-ftc-allegations-it?utm_source=govdelivery" target="_blank">the FTC levied a $4 million penalty against HyperBeard, Inc.</a>, a popular mobile app developer, to settle allegations that HyperBeard integrated third-party ad networks into its child-directed apps in violation of COPPA.<a href="#_ftn1" name="_ftnref1" id="_ftnref1">[1]</a></p><p>The <a href="https://www.ftc.gov/system/files/documents/cases/192_3109_hyperbeard_-_complaint.pdf" target="_blank">complaint</a> is notable in that the FTC did <em>not</em> allege that HyperBeard itself collected any personal information from children—rather, the alleged violations centered around the company enabling third parties to collect personal information from children through its service. The fine serves as a warning to online operators that they are strictly responsible for their third-party integrations, even if they themselves do not collect personal information from children. Andrew Smith, Director of the FTC’s Bureau of Consumer Protection, emphasized, “If your app or website is directed to kids, you’ve got to make sure parents are in the loop before you collect children’s personal information. This includes allowing someone else, such as an ad network, to collect persistent identifiers, like advertising IDs or cookies, in order to serve behavioral advertising.”</p><h4>Background</h4><p>COPPA generally requires operators of child-directed online services to provide notice and obtain parental consent before collecting—or permitting third parties to collect—personal information from children under 13. In 2013, the FTC amended its rule implementing COPPA to, among other things, expand the definition of “personal information” to include persistent identifiers that collect information about a child’s online activity when that information is used to serve targeted ads to the child. This presents an issue for app developers, such as HyperBeard, looking to monetize their apps through the use of in-app advertising.</p><h4>HyperBeard’s Apps Were Child-Directed</h4><h5>Kid-Friendly Characters and App Store Descriptions</h5><p>HyperBeard has publicly offered a number of mobile apps, including BunnyBuns, Clawbert, KleptoCats, and MonkeyNauts (the “<strong>Apps</strong>”). The Apps were free to download and play but relied on in-app advertising and in-app purchases to generate revenue. The complaint calls out the prominent usage of brightly colored, animated characters in the Apps as evidence that the Apps were child-directed. The complaint further noted that the descriptions for the Apps included adjectives such as “SUPER cute,” “adorable,” and “silly,” which are kid-friendly, and that the Apps are “very simple and easy to play.”</p><h5>Marketing Practices and Partners</h5><p>The FTC also pointed to HyperBeard’s marketing as evidence that the Apps were child-directed. For example, the complaint alleges that HyperBeard’s website descriptions for several of its Apps recommended the games to children as well as adults. In addition, HyperBeard promoted its Apps on a kids entertainment website, <em>YayOMG!</em> The <em>YayOMG!</em> reviews for certain Apps focused on how “adorable,” “fun,” and “cute” the games were and recommended the games to the website’s readers. HyperBeard amplified these reviews through the use of “retweets” and “likes” on its Twitter page.</p><h5>Spin-Off Kids’ Products and Merchandising</h5><p>Moreover, HyperBeard published books related to two of its Apps—KleptoCats and KleptoDogs. The FTC noted that the books were written by a children’s author and were categorized under “Children’s Books” on an online bookseller’s website, with a suggested age range of 7-10 years and grade level of 2-5. HyperBeard also sold KleptoCats stuffed animals and licensed its characters to other companies to create child-directed products, including a <em>K’Nex</em> block construction set, calendars, posters, stickers, and bookmarks.</p><h4>Integration of Third-Party Ad Networks</h4><p>In order to monetize the Apps, HyperBeard integrated numerous third-party ad networks in its Apps. The ad networks used persistent identifiers to collect information about children’s activity over time and across online services, and it targeted ads to those children based on their information. Because HyperBeard allegedly did not provide notice to or obtain verifiable parental consent from parents in connection with the ad networks’ activity, the ad networks’ collection of personal information violated COPPA.</p><p>Furthermore, the FTC alleged that HyperBeard did not exercise adequate oversight and controls over the ad networks. For example, the FTC alleged that HyperBeard did not inform the ad networks that the Apps were directed to children until <em>after</em> being contacted by FTC staff about the matter. In addition, HyperBeard allegedly failed to properly instruct or contractually require the ad networks to refrain from behavioral advertising in light of the child-directed nature of the Apps. The settlement reinforces the fact that, under COPPA, an online operator is strictly liable for the actions of any third party that collects personal information through the operator’s service.</p><div data-type='hr' style='border-top: 3px solid #bbb'></div><p><a href="#_ftnref1" name="_ftn1" id="_ftn1">[1]</a> Due to HyperBeard’s inability to pay the full amount, the $4 million penalty will be suspended upon payment of $150,000 by HyperBeard.</p>

<p>It’s 10 p.m. Do You Know What Your Third-Party Integrations Are Doing? Mobile App Developer Fined $4 Million for Alleged COPPA Violations Through In-App Advertising</p>

Sign Up

Julie O'Neill

Partner

Privacy + Data Security