The Federal Trade Commission (FTC) reached a settlement with WW International Inc., formerly known as Weight Watchers (WW), over allegations that the company collected children’s information without parental consent in violation of the Children’s Online Privacy Protection Act (COPPA). The settlement order requires WW to delete personal information collected from children, destroy any algorithms derived from the data and pay a $1.5 million penalty. The settlement demonstrates the FTC’s continued interest in pursuing companies that collect and share children’s information without parental consent.
COPPA requires operators of websites directed to children under the age of 13, or that have actual knowledge that they are collecting personal information from a child under the age of 13, to provide notice and obtain verifiable parental consent prior to any such collection, use or disclosure of a child’s personal information. The verifiable consent must be “reasonably calculated, in light of available technology, to ensure that the person providing consent is the child’s parent.” 16 C.F.R. § 312.5(b).
According to the complaint filed by the Department of Justice (DOJ) on behalf of the FTC,1 WW marketed a weight management and tracking service designed for use by children ages 8–17, named Kurbo by WW. The complaint alleged that Kurbo’s “age gating” sign-up process encouraged younger users to falsely claim they were over the age of 13, despite text indicating that children under 13 must sign up through a parent.
The complaint also alleged that hundreds of users who signed up for the app claiming to be over the age of 13 later changed their birthdates on their profiles to indicate they were really under 13.
Among other things, the settlement requires WW and Kurbo to pay $1.5 million in civil penalties, destroy any models or algorithms developed using children’s personal information, and maintain a schedule for retaining children’s data for no longer than one year after the last instance in which the user tracks their food intake, weight or activity level. The requirement that WW and Kurbo destroy the models or algorithms reflects the FTC’s ongoing interest in pursuing broader remedies against those that commit unfair and deceptive practices. In a May 2021 action, the FTC required a facial recognition technology company to destroy models or algorithms the company developed by using photos and videos uploaded by users who were allegedly deceived about the company’s use of facial recognition technology.
The FTC has been active in the children’s privacy space in recent months. For example, it announced a $2 million settlement with an ad exchange company over alleged COPPA violations in December 2021. In that action, the FTC alleged that the ad exchange company knowingly collected personal information from children under age 13 without parental consent and collected geolocation data from users of all ages who opted out of being tracked. State attorneys general, who are also empowered to enforce COPPA, have publicly announced multistate investigations into major social media platforms in recent months over allegations related to children’s data.
In his State of the Union address, President Joe Biden specifically called on Congress to “strengthen privacy protections, ban targeted advertising to children, [and] demand tech companies stop collecting personal data on our children.”
Online website operators that collect children’s information, especially those operators whose websites target children, should check their internal data privacy protections to ensure compliance with COPPA’s requirements for collection and use of children’s data.
1 Although COPPA permits the FTC to promulgate rules interpreting COPPA, the FTC lacks statutory authority to directly seek civil penalties for violations of the law. The FTC instead refers matters to the DOJ, which files actions on the FTC’s behalf.
