Google Can't Shake New Mexico Suit Over Children's Privacy

• by Wendy Davis  @wendyndavis, April 30, 2020

Siding against Google, a federal judge in New Mexico ruled Wednesday the company must face claims that it violated privacy laws by knowingly collecting data from children who downloaded mobile games games created by Tiny Lab Productions.

U.S. District Court Judge Martha Vazquez dismissed similar claims against other tech companies -- including Twitter's MoPub, Inmobi and AppLovin.

Vazquez's ruling stems from a 2018 lawsuit by New Mexico Attorney General Hector Balderas against Google, Twitter and other ad-tech companies. He alleged that mobile game developer Tiny Lab, based in Lithuania, illegally gleans personal data from young users who download games like "Fun Kid Racing," and that Google's AdMob, Twitter's MoPub, and other tech companies -- including Inmobi and AppLovin -- facilitate the data transfers.

The complaint alleges those companies violated the Children's Online Privacy Protection Act, which prohibits website operators from knowingly collecting a host of data -- including names, email addresses, device IDs, geolocation information and other "persistent identifiers" -- from children younger than 13 without their parents' consent.

Balderas alleged in the complaint that 86 of Tiny Lab's gaming apps participated in Google Play's "Designed for Families" program, for apps aimed at children. He filed suit several months after researchers at the International Computer Science Institute at the University of California, Berkeley reported that thousands of free children's apps for Android devices may be violating the Children's Online Privacy Protection Act.

Balderas noted that report in the complaint, and alleged that Google conducted a new review of 84 Tiny Lab apps after being contacted by researchers at the UC Berkeley in early 2018.

In September of 2018, Google terminated Tiny Lab’s Google Play account and removed Tiny Lab’s apps.

Google, Twitter and the other ad-tech companies sued by Balderas in January asked Vazquez to dismiss the complaint.

On Wednesday she granted that request for Twitter and the ad-tech companies other than Google, ruling that the allegations -- even if true -- wouldn't establish that those companies knew they were collecting data from young children.

She wrote that those companies' automated methods of gathering data didn't involve “the communication of comprehensible information from which a sentient being might ascertain the child-directed content of Tiny Lab apps.”

The judge added: “The complaint does not allege, and it would hardly be plausible if it did, that any sentient being at the ad networks had contemporaneous knowledge of who was using the apps in which the [software tools] were embedded, and based on that knowledge, was able to instantaneously send ads to those users.”

By contrast, she found that Balderas could proceed with claims against Google's AdMob, because the allegations in the complaint, if true, could show that Google knew Tiny Lab apps were aimed at children.

She wrote that the “reasonable inference” from the allegations is that “Google conducted not one but two reviews of the content of Tiny Lab’s apps, during which Google gained ... a first-hand awareness or understanding of the child-directed nature of those apps.”

Google had argued that Tiny Lab represented it complied with the federal privacy law, and that AdMob had no independent obligation to investigate whether Tiny Lab was telling the truth.

Vazquez rejected that argument, writing that there was no authority in the federal children's privacy law for the proposition that Google was entitled to rely on Tiny Lab's representations.