Privacy In Focus®

On March 3, 2022, the Federal Trade Commission (FTC) reached a settlement with WW International, Inc. (formerly known as Weight Watchers) and its subsidiary Kurbo, Inc. to resolve a complaint that the companies’ app – Kurbo by WW – collected personal information from children without parental notice and consent, among other alleged violations of the Children’s Online Privacy Protection Act (COPPA) Rule. This Settlement Agreement is an example of the FTC’s focus on children’s privacy issues, and is particularly noteworthy because of the FTC’s settlement terms, which include both a $1.5 million civil penalty and a requirement that the companies must “delete or destroy” any “models or algorithms developed in whole or in part using Personal Information Collected from Children through the Kurbo Program.” Settlement pp. 2, 8. Companies that deal with children’s data should pay close attention to this recent enforcement, as it provides insight into the FTC’s expectations under the COPPA Rule, as well as its willingness to impose strict and costly penalties against companies that do not meet those expectations.

The FTC’s COPPA Rule Allegations Against WW International, Inc. and Kurbo, Inc.

According to the FTC’s Complaint in this case, the two companies advertised, marketed, and distributed a weight-management program for children and teens – Kurbo by WW. The program, which included an app and website, was “designed for use by children ages eight and older, teenagers, and families.” Complaint at ¶¶ 16-19. The program allegedly collected personal information from children under 13 in two distinct circumstances: (1) where “users initially stated they were 13 or over but subsequently indicated they were not,” and (2) where users under 13 were registered by a parent. Complaint ¶¶ 43-44. In these cases, the FTC lists a variety of personal information that the program collected, including the child’s name, email address, and persistent identifiers. Of note, the FTC took a broad approach to the term “personal information” under COPPA, alleging that the program collected “other information like height, weight, food intake, and activity that, when combined with the identifying information, also constituted personal information.” Complaint ¶ 43.

The FTC alleged that WW International, Inc. and Kurbo, Inc. violated the COPPA Rule in several crucial areas. First, the FTC alleged that the companies did not provide direct notice to parents about the companies’ information collection practices. For some time, the FTC alleged that no notice at all was provided. But even when the companies began providing notice, the FTC alleged that it was inadequate to satisfy the COPPA Rule requirements, as it was not “clear[]” and “complete[]”, and it was not directly provided to parents; rather, it was buried in a string of other hyperlinks. See Complaint at ¶ 50. Second, with respect to the app, the companies allegedly did not obtain the parent’s verifiable consent before collecting information from the child. Third, the FTC alleged noncompliance with the COPPA Rule requirement to “retain[] children’s personal information for only as long as is reasonably necessary to fulfill the purpose for which it was collected.” Complaint ¶ 49. Specifically, the Complaint alleges that the companies for some time retained the data indefinitely, and then switched to retaining data for three years, “regardless of whether the child’s account [wa]s even active.” Complaint ¶ 54.

WW International, Inc. and Kurbo, Inc. Face Strict Penalties Under the Settlement Agreement

Under the settlement agreement, the companies have agreed to pay $1.5 million in civil penalties for the alleged violations of COPPA. While the civil penalty is significant, it is the settlement agreement’s injunctive relief that is most noteworthy. Specifically, under the settlement agreement, the companies are subject to strict requirements, including that the companies must, among other things:

• “Refrain from Disclosing, using, or benefitting from Personal Information Collected from Children that Defendants Collected through the Kurbo Program prior to entry of th[e] Order unless Verifiable Parental Consent is obtained”;
• “Within thirty (30) days of entry of th[e] Order, destroy all Personal Information Collected through the Kurbo Program by Defendants from accounts that have not, by that date, received direct notice and provided Verifiable Parental Consent”;
• “Maintain and adhere to a retention schedule for Children’s Personal Information Collected through the Kurbo Program, setting forth the purpose for which the information is Collected, the specific business need for retaining such Personal Information, and a set time frame and set of criteria for deletion of such information which may not exceed one (1) year after the last instance of a user tracking food, weight, or activity intake, and make such information about the retention schedule publicly available on Defendants’ website(s) and in the direct notice”; and
• “Within ninety (90) days of entry of this Order, delete or destroy any Affected Work Product, and provide a written statement to the Commission, sworn under penalty of perjury, confirming such deletion or destruction.” Settlement 7-9.

With respect to the last item listed, deleting or destroying any “Affected Work Product” means deleting or destroying any “models or algorithms developed in whole or in part using Personal Information Collected from Children through the Kurbo Program.” Settlement pp. 2, 8. Note that we have seen the FTC employ this far-reaching condition of settlement in cases dealing with traditionally sensitive information – for example in a case dealing with privacy violations with respect to the use of facial recognition technology. Companies should take note that the impacts of privacy violations with respect to certain data – such as children’s data and biometric data – can go beyond traditional injunctive relief and monetary penalties.

The FTC’s Latest Action Is Part of a Larger Trend Toward Heightened Scrutiny Around Children’s Privacy Issues and Practices

This decision – lauded by FTC Chair Lina Khan, who noted that these companies “illegally harvested [children’s] personal and sensitive [] information” – is the latest example of the FTC’s focus on protecting children’s privacy. Indeed, the FTC has brought several high-profile COPPA enforcement cases over the past several years, including against VTech and YouTube. Further, the FTC’s action here comes at a time when federal and state policymakers – as well as the President – are keying in on children’s privacy.

© 2022 Wiley Rein LLP