• by Wendy Davis  @wendyndavis, September 12, 2018

New Mexico Attorney General Hector Balderas has sued mobile game developer Tiny Lab Productions, along with Google, Twitter and other tech companies, for allegedly violating federal and state children's privacy laws.

The Attorney General alleges that Tiny Lab, based in Lithuania, illegally gleans personal data from young users who download games like "Fun Kid Racing," and that Google's AdMob, Twitter's MoPub, and other tech companies facilitate the data transfers.

"When children play Tiny Lab’s gaming apps on their mobile devices, their geolocation, demographic characteristics, online activity, and other personal data, are inescapably -- and without verifiable parental consent -- exfiltrated to third parties and their marketing networks in order to target the children with advertisements based on their own personal information," Balderas alleges in an 85-page complaint filed Tuesday in U.S. District Court in New Mexico.

Google also allegedly duped parents by positioning Tiny Lab's apps as appropriate for children, despite being told by researchers at the University of California, Berkeley that the apps collected personal data. The complaint specifically alleges that 86 of Tiny Lab's gaming apps participated in Google Play's "Designed for Families" program.

"Google knows that Tiny Lab’s apps track children unlawfully," the complaint alleges. "Google’s bad acts are compounded because it represents to parents and guardians that Tiny Lab’s apps are compliant with COPPA -- despite express knowledge that this is not true -- and safe for children. Indeed, Google itself is one of the ... defendants whose embedded coding tracks and profiles children."

This spring, researchers at the Berkeley's International Computer Science Institute reported that thousands of free children's apps for Android devices may be collecting data from children in violation of the federal Children's Online Privacy Protection Act. That law prohibits app developers from knowingly collecting a host of data -- including names, email addresses, device IDs, geolocation information and other "persistent identifiers" -- from children younger than 13 without their parents' consent.

Tiny Lab allegedly instituted an age-gate that screened out users who said they were younger than 13. But the FTC has said that apps aimed at children can't comply with COPPA merely by attempting to ban users younger than 13.

A Google spokesman says the company doesn't serve any personalized ads in apps in its "Designed for Families" program.

The spokesman added that apps in the Designed for Families program "must comply with more stringent policies related to topics like age-appropriate ads and privacy disclosures, as well as COPPA and other applicable laws."

Twitter said Wednesday that it suspended Tiny Lab from the MoPub platform in September of 2017 for violating its policies regarding child-directed apps. "MoPub does not permit the MoPub services to be used to collect information from apps directed to children under the age of 13 for purposes of personalized advertising," a Twitter spokesperson said.

Balderas isn't the only state law enforcement official taking aim at Google. Arizona Attorney General is investigating the company over its location-tracking practices, Missouri Attorney General Josh Hawley is probing whether Google violated state antitrust and consumer protection laws, and Mississippi Attorney General Jim Hood is suing the company over allegations that it collects data from students who use its education apps.