Protecting the online privacy of children by enforcing the Children’s Online Privacy Protection Act (COPPA) continues to be of paramount importance to federal and state regulators. In addition to the Federal Trade Commission (FTC), several state attorneys general (AGs) have brought COPPA actions recently, including the New Mexico and California AGs, and, most notably, the New York AG, who in 2019 worked in concert with the FTC to obtain a record civil penalty against YouTube for alleged COPPA violations. The latest COPPA enforcement action comes from Washington State AG Bob Ferguson, who announced a $100,000 settlement with California-based technology company Super Basic LLC and its parent company, Maple Media LLC, on June 24, 2020.

COPPA applies to operators of websites and online services that collect personal information from children, defined as under 13. Operators may not collect personal information from children without first obtaining verifiable parental consent. AG Ferguson charged that the social media platform We Heart It, operated by Super Basic and Maple Media, collected and disclosed children’s personal information without parental consent, in violation of COPPA. The complaint also asserted that the conduct amounted to an unfair or deceptive business practice under the Washington Consumer Protection Act.

According to the AG’s complaint, We Heart It, which has some 500,000 active monthly users across the United States, hosts a number of channels whose content is designed to appeal to children, such as fan pages for Disney, Harry Potter, DC Comics, and Pokemon. The platform also has its own website where users can create an account and profile, and the default setting on the platform meant that user profiles, including those of children, were public and could be seen by any user. When an account was created, We Heart It collected an email address, name, and username, as well as persistent identifiers, including cookies, IP address, iOS advertising ID, and Android advertising ID. It also permitted third party advertising networks to collect persistent identifiers. In addition, We Heart It collected metadata from uploaded photos that sometimes included geolocation data. The AG contended that the platform did not implement an age gate or obtain parental consent prior to the collection of children’s personal information.

In addition to the $100,000 settlement, Super Basic and Maple Media will be subject to $400,000 in penalties if the companies violate the terms of the consent decree. On top of the fine, the consent decree mandates that the companies set up an age gate to prevent children under 13 from creating accounts without parental consent, and the companies must delete or remove any information collected from children under 13 immediately upon learning that an age gate has been breached. The consent decree requires that the companies operate within the rules of COPPA, including by providing direct notice to parents of the companies’ data collection and disclosure practices; obtaining verifiable parental consent prior to collecting personal information from children under 13; deleting children’s personal information upon request from a parent; and retaining children’s personal information no longer than necessary to achieve the purpose for which it was collected. In addition, the companies must audit users’ profiles, tags, posts, and activity where content is relevant to or directed to children or where the companies have actual knowledge of use by children. Super Basic and Maple Media must also submit a detailed compliance report to the AG’s Office within 15 months.

The FTC’s determination in the FTC-YouTube settlement that a general audience platform has responsibilities under COPPA if content channels are directed to children has obviously caught the attention of regulators at both the national and state level. Protecting the online privacy of children by enforcing COPPA continues to garner intense interest in the age of COVID-19, particularly when many children are engaging more than ever with digital media. It is therefore unsurprising that state AGs are watching closely whether platforms that may attract children are complying with COPPA.