New York Attorney General Eric Schneiderman has accused four well-known companies -- Viacom, Mattel, Hasbro and Jumpstart -- of violating a federal law by allowing their sites' young visitors to be tracked by outside companies.
The companies agreed to pay $835,000 collectively, and to adopt procedures aimed at prohibiting tracking on their sites.
"The investigation revealed that website operators have not done enough to ensure that their children’s websites are free of improper third party tracking technologies," the Attorney General's office said Tuesday in a statement.
The probe is ongoing -- meaning that other online companies, including ones that power online data collection, could also face enforcement actions in New York. Schneiderman's office took the unusual step of releasing only a summary of the charges and settlements, but not the actual agreements, in order to avoid compromising the continuing investigation, according to a spokesperson.
Viacom, Mattel, Jumpstart and Hasbro allegedly allowed third-party tracking companies to collect data about visitors to sites aimed at children younger than 13. The settlements call for Viacom to pay $500,00, Mattel to pay $250,000 and Jumpstart to pay $85,000. Hasbro, which participated in a "safe harbor" program approved by the Federal Trade Commission, wasn't fined.
In 2012, the FTC updated the Children's Online Privacy Protection Act by prohibiting Web companies from using behavioral targeting techniques on sites and apps directed to young children. The agency specifically prohibited online companies from collecting the type of data used by ad networks to create behavioral profiles -- including persistent cookies and mobile device identifiers -- from children younger than 13, without their parents' permission. That change took effect in July of 2013.
Viacom allegedly violated COPPA by allowing third-party trackers on Nick.com and NickJr.com, according to Schneiderman. Similar allegations against Viacom surfaced several years ago, when lawyers for a group of children sued Viacom and Google for allegedly violating various privacy laws. A federal judge dismissed the allegations against both companies, but in June the 3rd Circuit Court of Appeals revived claims that Viacom violated New Jersey privacy standards. Viacom said at the time that it expects to ultimately prevail in that matter.
A Viacom spokesperson said today that the agreement with Schneiderman "resolves an investigation of an earlier generation of Nickelodeon websites."
“Viacom takes very seriously its longstanding commitment to protecting children’s privacy, and we work hard in today’s fast-changing digital landscape to insure our COPPA compliance," the spokesperson says.
Mattel allegedly "deployed a tracking technology supplied by a third party data broker across its Barbie, Hot Wheels, Fisher-Price, Monster High, Ever After High, and Thomas & Friends websites."
That technology "introduced many other third party tracking technologies in a process known as 'piggy backing,'" the Attorney General's office stated. "Many of these third parties engage in the type of tracking, profiling, and targeted advertising prohibited by COPPA."
Mattel also allegedly uploaded videos to YouTube. Playing the videos allegedly "enabled Google tracking technologies, which were used to serve behavioral advertisements," according to Schneiderman's statement.
JumpStart, which acquired Neopets from Viacom two years ago, allegedly "failed to configure the advertising platform used to serve ads on the Neopets website in a manner that would comply with COPPA."
Hasbro allegedly collected data about visitors to Nerf.com in order to retarget them in the future, when they visited other sites.
Privacy advocate Jeff Chester, who was instrumental in passing COPPA, suggests that today's enforcement actions only scratch the surface. "The Attorney General is blowing the whistle on what the industry knows -- that it's been thumbing its nose at COPPA."
He adds that the cases "should be a wake-up call" to other companies that are involved in tracking children online.