This is no fairy tale: The Walt Disney Company, Disney Electronic Content, and others are being sued by a San Francisco mother who claims her child was illegally tracked while using a Disney mobile application.
According to a report, Amanda Rushing, on behalf of her child, identified in the lawsuit only as “L.L.,” is suing because of an advertising-specific software development kit that is embedded in the code for the Disney Princess Palace Pets app.
This code was able to collect personal information and track her child’s behavior, according to the claim. Rushing also claims that other apps collect information from their users, including Club Penguin Island; Star Wars: Puzzle Droids; Frozen Free Fall and Disney Emoji Blitz.
Michael Sobol, an attorney representing Rushing, said that app developers and SDK providers can track children’s behaviors through mobile apps, mobile devices and online games. They can track and obtain critical pieces of data from devices, including “persistent identifiers,” he said, which are typically unique numbers linked to a mobile device.
“These persistent identifiers allow SDK providers to detect a child’s activity across multiple apps and platforms on the internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps,” writes Sobol in the complaint. “This information is then sold to various third-parties who sell targeted online advertising.”
This practice is what the Children’s Online Privacy Protection Act (COPPA) protects against, and under COPPA, developers and third-party workers cannot legally collect personal information about children who are under the age of 13.
(Read more: How to keep kids safe from unsecure IoT devices and toys)
However, according to a statement sent to The Hollywood Reporter on Friday, “the complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court,” said a Disney spokesperson.
“Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families,” said the spokesperson.
George Avetisov, founder and CEO of biometric security company HYPR, said this incident provides an opportunity to review COPPA, and the lawsuit filed against Disney and its adware partners raises an important question about whether COPPA is being invoked properly.
“The law may have not kept pace with technology or perceptions about what information is private,” said Avetisov. “What isn’t going to budge is our collective commitment to protecting children if it’s possible their privacy is being violated when many assume there are legal remedies to avoid that.”
With new and emerging technologies, children have wide access to mobile devices and every connected device that it supports. While the connected world often means convenience is abundant, said Avetisov, it also means privacy is in short supply.
“We’re struggling to strike a balance between the data at our disposal and how it drives opportunity, weighing in on what we tell devices, and what devices tell each other, is communicated to advertisers and others,” said Avetisov. “It’s our inherent responsibility to protect our children and always make the right decisions in their best interest. Children now have wide access to mobile devices, and the connected things they support.”
