The Walt Disney Co. was slapped with a proposed class action Thursday in California federal court. This Disney Lawsuit alleges that certain mobile games violate privacy laws by surreptitiously collecting children’s personal information while they play, and this data is then shared with advertising networks.
Amanda Rushing’s suit alleges that her child, who is younger than 13, regularly played “Disney Princess Palace Pets,” but she had no idea the game was secretly collecting information about her kid, identified as L.L., to send to third parties that track children’s internet behavior across applications and devices for targeted advertising.
“Defendants’ tracking and collection of L.L.’s personal information without her verifiable parental consent is highly offensive to Ms. Rushing and constitutes an invasion of her child’s privacy and of Ms. Rushing’s right to protect her child from this invasion,” the complaint says.
The complaint accuses Disney and technology companies Upsight Inc., Unity Technologies SF and Kochava Inc. of violating the Children’s Online Privacy Protection Act by including code in many of the entertainment giant’s children-focused gaming apps that causes them to send along users’ personally identifiable information, which the companies subsequently use to facilitate targeted ads.
The tech companies embed their so-called software development kits into the code for a number of Disney mobile games, allowing them to track children’s behavior while they play by collecting key information from the mobile devices being used, including persistent identifiers, which are typically a unique number linked to a specific device, according to the complaint.
These identifiers allow software development kit providers to follow a kid’s activity across multiple apps and platforms, providing a full view of their internet usage, and sell that information to companies who sell targeted online advertising, the suit says.
This practice earns app developers and other third parties millions of dollars in profit, even when an app is free to download, according to a Thursday news release from Lieff Cabraser Heimann & Bernstein LLP and Carney Bates & Pulliam PLLC, the firms representing Rushing.
But by allowing the tech companies to embed their code in games intended for children — including “Beauty and the Beast: Perfect Match” and “Star Wars: Puzzle Droids” — and failing to get parental permission for the subsequent information collecting, Disney has shirked its obligation to safeguard children’s personal data. Under COPPA, the developers of apps intended for children and any third parties working with the developers can’t collect the personal information of kids younger than 13 without getting permission from their parents, according to the complaint.
This is not the first time Disney has come under fire for COPPA violations, Rushing alleges, noting that subsidiary Playdom Inc. paid a $3 million civil penalty in 2011 for collecting and disclosing hundreds of thousands of children’s personal information without parental consent. Privacy watchdog the Center for Digital Democracy concluded in 2014 that Disney’s MarvelKids.com website was violating the act, and other child-oriented sites it operated likely were, too.
Rushing seeks to represent a class of children under 13 living in a number of states — including California, New Jersey, Pennsylvania and Texas — who played Disney games that collected their personal information without parental consent, as well as their guardians. The consumer also proposes a California subclass.
The suit alleges intrusion upon seclusion and violations of the right to privacy provided by the California Constitution, seeking an injunction barring Disney from collecting children’s personal information without parental consent and to bring the companies in compliance with COPPA, as well as damages and attorneys’ fees and costs.
Lieff Cabraser partner Michael W. Sobol, who represents Rushing, said in a Thursday statement that Congress enacted COPPA for good reasons.
“As a company long engaged in the practice of engaging — and profiting from — children, Disney needs to make sure its games and apps comply with the law,” Sobol said. “They and the companies they work with always have to obtain verifiable parental consent before extracting kids’ data from their mobile devices when kids play Disney’s mobile apps.”
Disney and the tech companies didn’t immediately return requests for comment Friday.
Rushing is represented by Michael W. Sobol, Nicholas Diamand, Douglas I. Cuthbertson and Abbye R. Klamann of Lieff Cabraser Heimann & Bernstein LLP and Hank Bates, Allen Carney and David Slade of Carney Bates & Pulliam PLLC.
Counsel information for the defendants wasn’t immediately available Friday.
The suit is Rushing v. The Walt Disney Co. et al., suit number 3:17-cv-04419, in the U.S. District Court for the Northern District of California.
This story was first reported by Shayna Posses of Law 360.