No Time to Weigh in and Monitor Child Data Compliance | BakerHotelier


The Federal Trade Commission (FTC) recently reached a settlement with Weight Watchers (WW) and its subsidiary Kurbo for alleged violations of the Children’s Online Privacy Protection Act (COPPA). COPPA requires websites, apps, and other online services to obtain express parental consent before collecting, using, or disclosing personal information about children under 13. This is a complex rule, but generally, to be subject to this rule, websites must either (1) be directed to children or (2) have actual knowledge of collecting data from children under under 13 years old. This case involved a product intended for children, actual knowledge and multiple violations of COPPA.

Kurbo is a weight management product for children and teens. According to the complaint, children as young as 8 years old created accounts on the Kurbo app to track their weight, food intake and physical activity. Consumers interested in using the Kurbo app would first encounter an age restriction, asking them to choose one of the following options: (1) I am a parent. I will first register to be able to support my child in the Kurbo program; or (2) I am at least 13 years old and using the Application for myself without parental supervision. If a child selected the second option, they would be prompted for their date of birth, and if they entered an age of 13, they could enter the app. The FTC alleges that in hundreds of cases, children under 13 circumvented the age limit by later revising their date of birth to reflect their true age. A more compliant age barrier should be as neutral as possible and ideally be supported by some form of tracking technology to prevent multiple attempts.

COPPA also requires Covered Businesses to “make reasonable efforts, taking into account available technology, to ensure that a parent of a child is directly informed of their information practices.” The FTC alleged that Kurbo made no attempt to notify parents through the app. And on the desktop version, the review was buried in a pile of other hyperlinks. Appropriate notice should always be given when data is collected from children to ensure that there is valid consent. Kurbo’s data deletion procedure also allegedly violated COPPA’s requirement that companies may only retain data “for as long as reasonably necessary to fulfill the purpose for which the information was collected.” Until 2021, the data was kept indefinitely unless specifically requested to be deleted. This is not sufficient for the purposes of COPPA.

WW agreed to pay a civil penalty of $1.5 million to settle the case. There is one additional provision in the ordinance that is worth noting. Similar to the 2021 Everalbum case, the order requires defendants to remove “any models or algorithms developed in whole or in part using personal information collected from children through the Kurbo program,” at the notice. exception of items that they are required to keep for defined reasons. such as legal obligations. There is no indication of whether and which algorithms would be subject to this provision, but it is clearly one the FTC will request more frequently in the future. And depending on the models or algorithms involved, this is a provision that could create some real challenges. Complying with COPPA and managing children’s data requires a precise approach.

[View source.]


Comments are closed.