The FTC’s most recent COPPA enforcement action, announced on June 4 with app developer HyperBeard, provides evidence of an ongoing debate within the Commission about privacy harm and the role of monetary relief in the agency’s privacy enforcement program. Specifically, Commissioner Noah Phillips voted against the settlement with app developer HyperBeard and two corporate officers, and argues in a dissent that the $4 million civil penalty (to be suspended after payment of $150,000) imposed on HyperBeard is too great for the consumer harm caused by the company’s alleged COPPA violation. In a separate statement, Chairman Simons defended the fine and rejected Commissioner Phillips’s argument that consumer harm should guide the FTC’s civil penalty calculations.
The action against HyperBeard also underscores that developers of child-directed services must not allow third-party interest-based advertising unless they meet COPPA’s parental notice and consent requirements, and that COPPA enforcement remains an FTC priority while the COPPA Rule is under review.
HyperBeard’s Alleged COPPA Violation
The central allegation in the FTC’s complaint is that HyperBeard allowed third-party ad networks to serve interest-based advertising in several child-directed apps without providing notice to parents or obtaining verifiable parental consent. To support its conclusion that HyperBeard’s apps were child-directed, the complaint cites the apps’ content (e.g., cartoon characters and kid-friendly prizes) as well as a cross-promotion with children’s books that were categorized as such and declared as intended for child audiences on Amazon.
The complaint cites specific alleged failures in how HyperBeard handled third-party advertisers. According to the complaint, HyperBeard did not “inform [the] third-party advertising networks that any of the [company’s apps were] directed to children and did not instruct or contractually require the advertising networks to refrain from behavioral advertising.”
Commissioner Phillips Dissents; Chairman Simons Responds
Although Chairman Simons and Commissioner Phillips apparently agreed on the merits of charging HyperBeard with a COPPA violation, they differed sharply on the magnitude and justification for the fine. Chairman Simons argues that “deterrence should come first” when it comes to calculating civil penalties. Specifically, penalties should “make compliance more attractive than violation.” The correct starting place for such a measure in this case was HyperBeard’s gain from allowing interest-based advertising in its apps. Consumer harm, in Chairman Simons’s view, is “inapposite” to the objective of deterrence.
Commissioner Phillips, however, argues that consumer harm should be “a more central consideration in the calculation of privacy penalties.” He also raises concerns that the FTC has been “relentless, without clear direction other than to maximize the amount in every case” and invites Congress to “pay attention to how the FTC is approaching monetary relief, including civil penalties, especially in privacy cases.” In Commissioner Phillips’s view, the only harm that HyperBeard caused was to collect data that allowed “users presumed to be children” to be served with interest-based ads without the parental notice and consent that COPPA requires. Such data collection is “endemic to the economy” and does not warrant a penalty that approaches the $5.7 million fine recently issued against Musical.ly – a case that involved a range of more serious alleged harms.
We do not expect a resolution of the questions about privacy harm and civil penalty calculations anytime soon. In the meantime, developers should take note of the FTC’s continuing attention to COPPA enforcement and closely examine how they manage any data that flows from child-directed apps to third parties.
[View source.]
