• by Wendy Davis  @wendyndavis, June 20, 2018

A group of parents who are suing Disney over alleged privacy violations have expanded their case by adding Twitter's MoPub and comScore as defendants.

The class-action complaint, initially filed last August, alleges that Disney allowed outside companies to embed code that tracked young children who used apps like "Princess Palace Pets" and "Where's My Water?" Those outside companies include Twitter, comScore, Upsight, Unity Technologies and Kochava, according to the new complaint.

"Unbeknownst to parents and their children, Disney -- in partnership with (other) defendants -- collects and exfiltrates personal data as users play the Disney gaming apps," the parents allege in an amended class-action complaint filed last week in U.S. District Court in Oakland, California.

The parents allege that the data collected from children includes identifiers like Apple's "ID for Advertisers" and Android's "Advertising ID, and information that can be combined with other data to "fingerprint" smartphones -- like the brand, operating system, network carriers and the name assigned to the devices by users.

"Permitting technology companies to obtain children’s persistent identifiers exposes those children to targeted advertising," the complaint alleges. "The ad networks, informed by the surreptitious collection of personal data from children, will assist in the sale of advertising placed within the gaming apps and targeted specifically to children."

The complaint alleges that the alleged data collection violates privacy laws in California, New York and Massachusetts, as well as the federal Children's Online Privacy Protection Act. The latter prohibits web companies from collecting personal data from children under 13 without their parents' consent. The Federal Trade Commission, which is tasked with enforcement, said several years ago that persistent cookies and device identifiers fall within the law's definition of personal data.

COPPA doesn't empower individuals to sue for damages, but the parents argue that the law's existence supports their argument that the companies' alleged data collection practices are "highly offensive," and therefore violate various state privacy standards.

The parents say that COPPA "reflects a clear nationwide norm about parents’ expectations to be involved in how companies profile and track their children online."

Disney has previously stated that it has a "robust COPPA compliance program," and that it maintains "strict data collection and use policies for Disney apps created for children and families."

"The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in Court," the company stated when the lawsuit was first filed.