FTC Dings Coloring Book App for Drawing Outside COPPA Privacy Lines

The Federal Trade Commission (FTC) recently announced a settlement with Kuuhuub Inc., the operator of an online coloring book app, along with its Finnish subsidiaries Kuu Hubb Oy and Recolor Oy, for violations of the Children’s Online Privacy Protection Act (COPPA). The FTC alleged that the app collected personal information from children who used the app without notifying their parents and obtaining their consent as required by COPPA.

Recolor Violations of COPPA
According to the FTC, the online coloring book app called Recolor provides images that users digitally color on their mobile devices. While marketed as a “coloring book for adults,” the app featured categories directed to children, including a category called “Kids” which included animated characters, cartoonish animals and other images that appealed to children.

The FTC claimed that children under 13 years of age could register for an account by providing an email address, screen name and an optional profile description and picture, which are made public to other users. By creating an account, these children could use the app’s social media features, including the ability to upload selfies and other images for others to view and could interact with other users online, including adults. The companies allegedly received dozens of complaints from parents and other users about the use of these features by children.

The FTC further claimed the Recolor app allowed third-party advertising networks to collect personal information from children under 13 in the form of persistent identifiers that were used to send targeted advertisements to them. According to the complaint, the app’s operators failed to provide notice to parents or obtain verifiable parental consent before collecting personal information from children and failed to instruct the ad networks to abstain from using the children’s personal information for targeted advertisement.

Regulators have been stepping up their COPPA enforcement, including a $170 million settlement with Google in 2019.

Settlement Agreement Highlights
Under the settlement, Kuuhuub Inc., Kuu Hubb Oy and Recolor Oy agreed to pay a $3 million monetary penalty, which was suspended upon payment of $100,000 due to their inability to pay the total amount. The companies also agreed to:

• Delete all personal information collected from children under 13 unless they obtain parental/guardian consent as required by COPPA;
• Offer a refund to any parents or guardians whose child was under 13 years of age when they signed up for the app; and
• Notify users of the app about the alleged COPPA violations and the steps that users can take in response to the settlement.

THE BOTTOM LINE

• Even if part of an online service is directed to children, providers must comply with COPPA by sending notice and obtaining parental/guardian consent before collecting any personal information from children under 13 years of age.
• Operators of apps and online services that are directed to children should review their data collection policies to ensure they are compliant with COPPA and pay special attention to any social media features that allow users to share personal information with others.