• by Wendy Davis , Staff Writer @wendyndavis, May 23, 2019

Citing shifting privacy norms, a federal judge has refused to dismiss a lawsuit claiming that entertainment companies as well as mobile ad-tech companies violate children's privacy by harvesting their data for ad targeting.

The ruling, issued Wednesday by U.S. District Court Judge James Donato in the Northern District of California, stems from three lawsuits filed in 2017 by parents whose children played gaming apps developed by Kiloo, Disney and Viacom. The apps -- including “Princess Palace Pets” and “Where’s My Water?” -- allegedly came embedded with tracking software from mobile ad-tech companies.

The parents alleged that the ad-tech companies collected identifiers (like the Android Advertising ID) as well as data used for device fingerprinting (including the user’s language, time zone, and mobile network).

The companies urged Donato to dismiss the lawsuit at an early stage. They argued that tracking people via device identifiers for ad targeting isn't the kind of activity that warrants a federal lawsuit.

Donato rejected that argument.

“Current privacy expectations are developing, to say the least, with respect to a key issue raised in these cases -- whether the data subject owns and controls his or her personal information, and whether a commercial entity that secretly harvests it commits a highly offensive or egregious act,” he wrote in a 22-page decision. The ruling dismisses several claims, but allows the parents to move forward with others. 

“The Court cannot say that the answers are so patently obvious that plaintiffs’ allegations are implausible or inadequate as a matter of law,” Donato wrote.

The most significant of the parents' claims involves "intrusion upon seclusion” -- which occurs when companies violate people's expectations of privacy in a "highly offensive" way.

Disney and others countered that the allegations, even if true, wouldn't amount to "intrusion upon seclusion," because the data collected wasn't "personal." Instead, the information consisted of “anonymous alphanumeric strings of data regarding users’ devices and the software running on them,” according to the companies.

They argued that mining that sort of data for advertising purposes doesn't disclose "deeply private facts.” 

But Donato found that the allegations warrant further proceedings. He specifically noted that the companies allegedly harvested “user-specific” information. 

“Plaintiffs have alleged that defendants surreptitiously gathered user-specific information; they continue to gather information and track individual users in real time; they share (and buy and sell) this information with other third-party companies; and all of this results in the minor users being shown targeted advertisements and in the users continuing to be tracked after being shown the advertisements to see if they take actions in response to the ads,” he wrote. “This is enough to let the complaints go forward.”