• by Wendy Davis  @wendyndavis, August 10, 2020

Disney, Viacom and other companies have agreed to limit data collection and behavioral advertising techniques in children's apps, to settle privacy lawsuits brought by parents.

“Children will be protected from advertising based on any past online activities or any previously collected data in the subject app or anywhere else on the internet,” class counsel writes in papers filed last week with U.S. District Court Judge James Donato in San Francisco.

“No personal data collected from a current app session can be used in any manner to target that user in future sessions in the same app, across other apps, or elsewhere on the internet,” the lawyers write in a motion asking Donato to grant the deal preliminary approval.

The plaintiff's attorneys expect to seek more than $9 million in fees and expenses.

The companies said in April that they had agreed to resolve the lawsuits, but details of the settlements were only unveiled until last week.

The potential settlement stems from three lawsuits dating to 2017, when parents whose children played gaming apps sued a host of businesses -- including Disney, Viacom, gaming developer Kiloo, and outside ad tech companies for allegedly violating young children's privacy by harvesting their data for ad-targeting purposes. 

The complaints, brought in U.S. District Court for the Northern District of California, alleged that a number of gaming apps -- including Disney's “Princess Palace Pets,” Viacom's Llama Spit Spit -- were embedded with tracking software from mobile ad-tech companies.

The parents said the ad-tech companies collected identifiers (like the Android Advertising ID) as well as data used for device fingerprinting (including the user’s language, time zone, and mobile network).

The following year, the parents also named Comscore and Twitter's MoPub as defendants.

The parents claimed the companies violated a principle prohibiting "intrusion upon seclusion" -- which involves violating people's expectations of privacy in a "highly offensive" way.

The parents specifically alleged that the companies designed apps "to surreptitiously obtain, improperly gain knowledge of, review, and/or retain" users' activity.

The class-action complaint also contended that the alleged data collection violated a California privacy law as well as the federal Children's Online Privacy Protection Act. The federal law prohibits web companies from collecting personal data from children under 13 without their parents' consent.

The Federal Trade Commission, which is tasked with enforcement, has said persistent cookies and device identifiers fall within the law's definition of personal data.

COPPA doesn't empower individuals to sue for damages, but the parents argued that law's restrictions prove that the alleged data collection practices are "highly offensive."

Most of the companies that were sued allegedly engaged or facilitated behavioral advertising.

By contrast, the allegations against Comscore focused more on its alleged market research techniques. That company's ScoreCardResearch allegedly embedded tracking code for market research purposes in Disney's “Where's My Water?” app.

The propsed settlement requires Comscore to take steps aimed at insuring it isn't collecting data from children.

Disney, Viacom and the other companies previously urged Donato to dismiss the case, arguing that the alleged tracking didn't cause any concrete injury.

Donato rejected that argument last year, citing shifting privacy norms.

“Current privacy expectations are developing, to say the least, with respect to a key issue raised in these cases -- whether the data subject owns and controls his or her personal information, and whether a commercial entity that secretly harvests it commits a highly offensive or egregious act,” Donato wrote.