Disney Apps Spying On Kids? Company Allegedly Collected Children's Data, Suit Says

A class action lawsuit filed last week alleges Disney violated privacy protections laws by collecting personal information from children through a number of mobile apps and games and sharing it with advertisers without parental consent.

The lawsuit is directed at Disney and three software developers: Upsight, Unity and Kochava. According to the complaint, those companies developed apps designed for kids for Disney that could track and collect personal information and online behavior from users.

Read: Can Children Toys Spy on You? Consumer Watchdogs File Lawsuit

Forty-two apps are listed in the lawsuit, which was brought by a San Francisco woman named Amanda Rushing. According to her, she was unaware that the mobile game “Disney Princess Palace Pets” was collecting data from her child and selling that data to third-parties for targeted advertising.

Disney and the other defendants named in the suit are accused of violating the Children’s Online Privacy Protection Act (COPPA). Enacted by the United States Congress in 1999, the law was designed to protect the privacy of children online.

Under COPPA, apps designed for audiences of children age 13 or younger are required to get consent from parents or legal guardians before collecting any personally identifying information from the user.

A revised version of COPPA, passed by the U.S. Federal Trade Commission (FTC) in 2013, updated the definition of personal information to include geolocation data that could be used to track a user’s whereabouts and IP addresses. Under the updated version of COPPA, third-party companies must also comply by the rules and collect no personal information from users under 13 years of age.

Read: Are Smart Toys Spying On You? Millions Of Passwords And Messages Sent Through Smart Toy Leak Online

Rushing is seeking an injunction that would bar Disney and its software partners from collecting and sharing data from the apps in question without parental consent. She is also asking for “appropriate relief, including actual and statutory damages and punitive damages,” as well as all costs related to the case to be covered.

“Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families,” a company spokesperson said in response to the lawsuit. “The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court.”

While Disney holds that the case is the result of a misunderstanding of COPPA, the company itself has a history of incorrect interpretations of the rule. In 2011, the FTC found Disney subsidiary Playdom violated COPPA by collecting and disclosing personal information from children under the age of 13 without parental consent. The violation resulted in a $3 million fine against Playdom.

The full list of 42 apps named in the class action complaint are available below: