BabyBus (Fujian) Network Technology Co., Ltd. ("BabyBus" or "Company") is a China-based developer of children's apps that markets dozens of apps for toddlers and young children mainly between the ages of 1 and 6. On December 17, 2014, the Federal Trade Commission ("FTC") sent a letter to BabyBus warning the Company that it appeared to be in violation of the Children's Online Privacy Protection Act ("COPPA") Rule and focusing on the parental consent requirements.
The COPPA Rule requires companies collecting personal information from children under 13 years of age to post clear privacy policies and to notify parents and get their consent before collecting, using or disclosing any information from a child. The FTC promulgated a revised rule in 2013 to adapt to the growth of mobile technology aimed at children. The FTC recently defined personal information to include precise geolocation data, like GPS coordinates. In its letter to BabyBus, which was published on the FTC's website and made public on December 22, 2014, the FTC states that BabyBus' child-directed apps appear to collect precise geolocation information about users. Since the apps are directed towards children between the ages of 1 and 6, who apparently are the targeted "users" of the apps, the letter notes that the Company appears to be in violation of the COPPA because it does not obtain the parents' consent before collecting children's personal information. The FTC further alleges that the Company also appears to collect and share the geolocation information to third parties, including advertising networks and analytics companies. In the letter, Maneesha Mithal, associate director in the FTC's division of privacy and identity protection, recommended that the Company "review all of your applications with respect to the online collection of personal information from children in light of COPPA's legal requirements," also warning that the FTC will review the Company's apps again in the next month to ensure that they are in compliance with the Rule.
The Company responded to the FTC's letter by posting a statement on its English-language website that it will bring its apps into compliance with U.S. laws, while noting that it was in compliance with Chinese laws. The Company also said that GPS information was only gathered from users of the Android app, and BabyBus attributed the data collection to "Android's third-party statistics software plug-in." BabyBus, which says it received the FTC's warning letter on Christmas Eve, adds that its products already "have been corrected and are ready to be released." The privacy policy page of the Company's website currently flashes a message that the Company is in the process of updating its privacy policy and user agreement.
The FTC can enforce actions against companies violating the COPPA as a violation of Section 5 of the FTC Act, which bars unfair and deceptive acts and practices in or affecting commerce. A court can hold operators who violate the Rule liable for civil penalties of up to $16,000 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties and the size of the company.
The letter from the FTC to BabyBus is available here.
Reporter, Samira Shah Hariramasamy, Silicon Valley, CA, +1 650 422 6817, shariramasamy@kslaw.com.
