• by Wendy Davis  @wendyndavis, December 9, 2014

The campaign centered on a contest that gave children the opportunity to have photos of themselves used in a music video by the group R5, the groups allege.

For the initiative, the site Candymania.com allegedly invited children to upload photos of themselves wearing Ring Pops to the social media platforms Facebook, Twitter and Instagram. The photos carried the hashtag RockThatRock, as well as the children's screen names, according to the complaint.

“Of the photos collected, Topps used several that were photos of children clearly under 13,” the organizations say. “In addition, Topps disclosed children’s photos along with contact information in the music video and disclosed children’s photos and online contact information on the Ring Pop Facebook page. It also used the online contact information to directly contact and market to children.”

The complaint — filed by eight organizations, including the Center for Digital Democracy, Center for Science in the Public Interest and American Academy of Child and Adolescent Psychiatry — alleges that the Michael Eisner-owned Topps violated the Children's Online Privacy Protection Act by collecting and disclosing personal data from children under 13 without their parents' permission. Recent revisions to the COPPA regulations provide that photos of children are the type of personal data that can't be gathered without parental permission.

The watchdogs argue that Topps violated the children's privacy law, even though the children allegedly uploaded their photos and provided their screennames to outside companies — Facebook, Twitter and Instagram.

“You can't get out of COPPA by outsourcing the collection of data,” says Angela J. Campbell, a lawyer with the Georgetown University's Institute for Public Representation, which represents the Center for Digital Democracy.

She adds that when the FTC revised the COPPA regulations in 2012, the agency made clear that companies are responsible for data collection by third parties.

But not everyone agrees that the allegations make out a case against Topps. “I think it's a very broad reading of COPPA, and not what it was intended for,” says attorney Allison Fitzpatrick a partner in the advertising department of Davis & Gilbert. “It would be unreasonable to believe that COPPA would cover the collection of personal information on a site such as Facebook,” she adds, pointing out that Facebook attempts to screen out users who are under 13.

Twitter and Instagram also say they're not intended for children under 13. But the advocacy groups argue that anyone can sign up for Twitter and Instagram, and that it's “common knowledge” that many children have Facebook accounts.

Fitzpatrick adds that COPPA regulations holding Web site operators responsible for third-party data collection are aimed at curbing data gathering by ad networks, or via plug-ins, and not platforms where people directly upload their information.
The complaint urges the FTC to “take prompt action” against Topps.