A federal court in California has granted final approval of class-action settlements in which Disney, ViacomCBS, and ad-tech companies have agreed to limit collection of personal data and behaviorally targeted ads for kids under age 13.
The agreement settles “first-of-their kind” privacy actions by implementing industrywide privacy protections for children in the mobile app space, according to court documents.
Collectively, the settlements span “tens of thousands” of child-directed gaming apps and implement “holistic protections” both at the developer and software development kit (SDK) level, the documents state.
“This is going to be the biggest change to the children’s app market that we’ve seen that gets at the business models,” Josh Golin, executive director for the advocacy nonprofit Campaign for a Commercial-Free Childhood told The New York Times. The “most insidious and manipulative forms of marketing” used on kids’ apps will now be banned, Golin asserted.
The settlement calls for the companies — which have admitted no wrongdoing — to remove or disable tracking software that could be used to target children with ads. Going forward, no personal data collected from a current app session for a child under 13 can be used in any manner to target that user in future sessions in the same app, across other apps, or elsewhere on the internet.
Developers will still be able to show contextual ads based on app content to users under 13.
App developers will go through an enrollment process to educate them and enable the SDK defendants to screen apps for child-directed content.
The final approval settles three class-action lawsuits originally brought in 2017 by
parents whose children played gaming apps.
As previously reported, the complaints, brought in U.S. District Court for the Northern District of California, alleged that some of the most popular gaming apps — including Kiloo-developed “Subway Surfers” (with an installation base of 1.5 billion-plus, per Sensor Tower), Disney's “Princess Palace Pets” and Viacom's “Llama Spit Spit” — were embedded with tracking software from mobile ad-tech companies without parents’ knowledge or consent, in violation of state privacy and fair business practice laws.
The tracking enabled profiling kids across apps and devices, targeting them with ads and promoting in-app purchases, the lawsuits charged.
The parents said the ad-tech companies collected identifiers such as the Android Advertising ID, as well as data used for device fingerprinting, including the user’s language, time zone and mobile network.
The following year, the parents also named Comscore and Twitter's MoPub as defendants.
Because its business practices are “unique” among the SDK defendants, the settlements require Comscore to commit to a different set of practice changes in regard to children’s information. Specifically, Comscore is required to create and maintain a database of child-directed apps to check against all current and future business partners and ensure that no child’s personal data is obtained or used.
Comscore also agreed not to use its technology in any behavioral advertising in which the modeling involves an age under 18.
In addition to companies mentioned above, other defendants in the settlement include Sybo, AdColony, Chartboost, Flurry, inMobi, ironSource USA, Tapjoy, Vungle, Unity Technologies, and Upsight.