On July 1, 2021, the Federal Trade Commission (FTC) announced that it had settled the allegations against Toronto-based Kuuhuub Inc., as well as the Finnish subsidiaries of Kuuhuub, Kuu Hubb Oy and Recolor Oy (together, defendants), according to which defendants allegedly violated children’s online privacy. Protection law rule (COPPA rule).1 The FTC alleged that the defendants were operating a coloring book mobile app that contained a section intended for children, and that the defendants had violated the COPPA rule by failing to provide the required COPPA notices and obtaining verifiable parental consent before proceeding. collect, use and disclose personal information of children. . As part of the settlement, defendants must implement new procedures, remove children’s personal information, provide in-app notices and issue refunds to consumers, pay a civil penalty, and submit to compliance reports from routine.
The FTC complaint
The COPPA rule applies to operators of online services whose service, or part of the service, is aimed at children under the age of 13 or who actually know they are collecting information from children.2 It imposes rules surrounding the collection, use and disclosure of personal information collected from children.
According to the FTC complaint, while the defendants’ Recolor coloring book app (the app) was touted as an “adult coloring book,” part of the app was intended for children under 13. years.3 The FTC noted that the app has different categories of images that can be colored. These categories included a “Kids” category which featured simple characters that children would love, including cartoon animals.4 The complaint also noted that the defendants have received more than 120 reports from users and parents that children are using the app, of which about a dozen specifically mentioned children under the age of 13. Personal Information of Children Under 13, reports of use by children likely contributed to the FTC’s finding that the “Children” section of the app was intended for children.
The FTC alleged that the defendants violated COPPA by inappropriately collecting, using and sharing children’s personal information. The app contained social media features that allowed users to post their final images to a gallery and write a caption; import photos from their device, such as a selfie, without company review; and like and comment on other users’ photos and follow other accounts.5 To access the social media features of the app, users had to create an account in the app by providing an email address, an account screen name, as well as an optional user description and a profile picture.
The complaint also alleges that the app allowed third-party ad networks to collect persistent identifiers for targeted advertising.6 The Application did not inform the networks that some of the users were children and did not ask the networks to refrain from using the data collected from the Application for targeted advertising purposes. While users could purchase subscriptions to remove ads, a subscription was not required to use the app.7
The complaint further alleged that, despite the defendants’ collecting personal information from children – including first and last name, photographs, comment content, artwork descriptions and persistent identifiers – the defendants had not provided sufficient general COPPA notice and direct COPPA notice to parents or obtain verifiable parental authorization.8
The consent order
As is customary in all COPPA consent orders, the order prohibits defendants from violating COPPA in the future, including by failing to provide parents with the confidentiality notice required by COPPA; failing to obtain verifiable parental consent before processing children’s personal information; not to delete a child’s personal information at the request of a parent; or retain children’s personal information for longer than is reasonably necessary to fulfill the purpose for which the information was collected.9
The order also requires defendants to remove all previously collected personal information associated with children who have created accounts on the app with a few exceptions, such as allowing the transfer of artwork from the platform. to a device with the user’s consent.ten Presumably because defendants have no way of reliably knowing whether an account was created by a child, the FTC included a clause allowing defendants to comply with the deletion requirement by: (1) performing FTC-approved search terms “or an equivalent method” to identify accounts created by children and remove information associated with those accounts; and (2) delete personal information associated with a user’s account when the defendants have âactual knowledgeâ or âfairly implied knowledge on the basis of objective circumstancesâ that an account has been created by a child. In addition, defendants should ask third parties who received personal information from those accounts to delete the personal information associated with those accounts.
Refunds to users under 13
If current users have a subscription and that subscription was purchased when the user was under 13, the order allows the user or their parents to cancel the subscription and receive a refund.
Notice to users in the app
In addition, the order requires defendants to present an in-app pop-up alert and a news feed informing users that, under the terms of the defendants’ settlement with the FTC: (1) if the child of the user was under 13 years of age when using the application, the user can request the defendants to delete personal information associated with the user account by contacting customer service; and (2) if the user’s child was under 13 and signed up for a subscription, the user can cancel the subscription and submit a refund request through customer service.
Finally, the defendants must pay a civil fine of $ 3,000,000, which will be suspended from payment of $ 100,000 due to their inability to pay the full amount, and submit to a 10-year compliance reporting period.11
Key points to remember
This consent order goes beyond the scope of previous FTC COPPA consent orders. Typically, when a consumer service contains a portion of the service intended for children, COPPA requires the operator to treat all data collected from that portion of the service as collected from a child. The operator can assume that the data collected outside this part of the service belongs to a person 13 years of age or older. Here, the FTC order goes one step further and requires defendants to conduct an investigation to determine which accounts appear to be owned by children and to remove all information associated with those accounts. This ordinance is also new in that it requires defendants to reimburse subscriptions purchased by children, a remedy that previously did not appear in COPPA regulations.
Finally, this is the first COPPA consent order to contain a notice provision, in that it requires defendants to post an in-app notice of the settlement for 180 days. These extensive corrective actions signal the FTC’s continued attention to the enforcement of COPPA, with potentially significant consequences in the event of non-compliance.
To mitigate the risks of an FTC COPPA enforcement action, online services such as mobile apps, both US-based and overseas, should consider whether their services are at risk of entering the market. the scope of the COPPA rule. Even if a service advertises itself as intended for adults, the service still faces risk if it contains features intended for children, even if those features are only a part of the service.
Companies wishing to avoid the application of COPPA should consider measures such as:
- design their online services in such a way that neither the service as a whole nor any specific feature or section stands out as appealing to children;
- assess whether there is extrinsic evidence that the service is being used by children; and
- create policies to delete user information and close user accounts if the company receives a report or other indication that a user is under 13 years of age.
Companies covered by COPPA must comply either by avoiding the collection of personal information, with some exceptions (online services with social media features often do not qualify for such exceptions) or by meeting parental consent requirements and of COPPA consent.
See online coloring book app Recolor resolves FTC allegations of illegal collection of children’s personal information (July 1, 2020), https://www.ftc.gov/news-events/press-releases/2021/07/online-coloring-book-app-recolor-settles-ftc-allegations-it.
 16 CFR pt. 312
 Complaint for civil penalties, permanent injunction and other equitable remedies, file number 1: 21-cv-01758 (6/30/21), https://www.ftc.gov/system/files/documents/cases/1823184recolorcomplaint.pdf at 5.
 Identifier. at 7 O’clock.
 Identifier. at 9 o’clock.
 Identifier. to 10.
 Identifier. to 6.
 Username. at 11-12.
 Stated order of permanent injunction and judgment of civil sanction, case n Â° 21-cv-01758 (6/30/21), https://www.ftc.gov/system/files/documents/cases/1823184recolorstipulatedorder.pdf to 10.
 Identifier. at 12.
 Username. at 14, 17-20.