A San Francisco mom says her child was illegally tracked while using the Disney Princess Palace Pets app.
Amanda Rushing, on behalf of her child referred to as “L.L.,” is suing The Walt Disney Company, Disney Electronic Content and others in a proposed class action filed Thursday in California federal court.
Rushing claims an advertising-specific software development kit is surreptitiously embedded in the code for the app, and that’s how Disney is collecting personal information and tracking online behavior.
“App developers and their SDK-providing partners can track children’s behavior while they play online games with their mobile devices by obtaining critical pieces of data from the mobile devices, including ‘persistent identifiers,’ typically a unique number linked to a specific mobile device,” writes attorney Michael Sobol in the complaint. “These persistent identifiers allow SDK providers to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps. This information is then sold to various third-parties who sell targeted online advertising.”
Sobol argues this is exactly the kind of practice the Children’s Online Privacy Protection Act was enacted to prevent. Under COPPA, app developers and any third-parties working with them can’t legally collect personal information about children who are under the age of 13 without verifiable consent from their parents.
“Disney has failed to safeguard children’s personal information and ensure that third-parties’ collection of data from children is lawful,” writes Sobol.
According to the suit, a Disney subsidiary, Playdom Inc., paid the largest civil penalty to date ($3 million) for violating COPPA in 2011.
Rushing says L.L. was tracked while using the princess pets app, but the suit claims dozens of other games also track their users, including Club Penguin Island, Star Wars: Puzzle Droids, Frozen Free Fall and Disney Emoji Blitz. (Read the full list on pages 9 and 10 of the complaint, which is posted below.)
Rushing is seeking class certification with a class defined as: “all persons residing in the States of Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Georgia, Hawaii, Idaho, Illinois, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, South Dakota, Texas, Utah, Vermont, Washington, and West Virginia who are younger than the age of 13, or were younger than the age of 13 when they played the Game Tracking Apps, and their parents and/or legal guardians, from whom Defendants collected, used, or disclosed personal information without verifiable parental consent.”
She’s also seeking certification of a sub-class of California residents who could also have claims for violation of the state’s right to privacy.
Disney has not yet replied to a request for comment on the complaint.
