Video Game Developer Settles Alleged Violations of Federal and State Privacy Laws Governing Children’s Data

On June 18, 2024, the California Attorney General (AG) and Los Angeles City Attorney jointly announced that video game developer and publisher Tilting Point Media LLC (Tilting Point) agreed to a $500,000 settlement for violations of the California Consumer Privacy Act (CCPA), Children’s Online Privacy Protection Act (COPPA), and California Unfair Competition Law (UCL) based on the company’s collection and processing of children’s personal information without consent and age-inappropriate advertising to children. The settlement highlights the increased focus by state regulators on the collection and processing of personal information from children and advertising directed to children.

The complaint against Tilting Point followed a September 2022 investigation by the Children’s Advertising Review Unit (CARU), one of the self-regulatory programs of BBB National Programs. CARU concluded that Tilting Point violated COPPA by failing to provide a neutral and effective age screen to limit the collection of personal information of users under age 13 or obtain verifiable parental consent before collecting and using personal information from children. CARU also found that Tilting Point displayed ads that used deceptive tactics or were inappropriate for children, in violation of CARU’s advertising guidelines. CARU recommended that Tilting Point take a number of steps to come into compliance, such as updating its age screening mechanism, updating its privacy policy to better reflect the company’s data practices, and enhancing its practices when sharing data with ad networks. However, the California AG and Los Angeles City Attorney alleged that Tilting Point’s corrective actions fell short and its data collection practices violated the CCPA, COPPA, and UCL. 

Tilting Point generates revenue through targeted advertising and in-app purchases in its free mobile app games. The company’s “SpongeBob: Krusty Cook-Off” game has a mixed-age audience, so content is directed to children under the age of 13 as well as teens and adults. Tilting Point’s terms of service and privacy policy stated that users under 13 were not authorized to access the SpongeBob app, but the company was aware that children under 13 were playing the game. While the company provided an age screen, CARU and the California AG and Los Angeles City Attorney found that the screen did not sufficiently encourage children to establish their real age and was not age neutral, in violation of COPPA. 

The California AG and Los Angeles City Attorney also alleged violations of the CCPA. In particular, they alleged that the company failed to obtain consent to the sale or sharing of personal information from parents (for users under age 13) or from users ages 13 to 16. Further, they asserted that the company’s privacy policy did not sufficiently disclose its practices regarding the collection and processing of consumers’ personal information, including personal information pertaining to children, as required by the CCPA. In addition, Tilting Point failed to configure its third-party software development kits (SDKs) to prevent the sale or sharing of children’s personal information without consent. 

The complaint by the California AG and Los Angeles City Attorney also claims that Tilting Point allowed users under age 13 to consent to the use of their personal data for targeted advertising instead of obtaining consent from parents, as required by the Federal Trade Commission’s (FTC) COPPA Rule. In addition, the complaint claims the company “displayed ads that used deceptive tactics such as having unclear methods to exit the ads, blurred lines between advertising and gameplay, and caused the download of unnecessary apps.” The complaint also asserts that the app displayed ads that were inappropriate for children, such as ads for marijuana. 

In addition to paying $500,000 in civil penalties, Tilting Point must take several corrective actions, including the following:

• Ensure all games directed to children comply with the CCPA and COPPA.
• Obtain consent before selling children’s personal information or sharing personal information for cross-context behavioral advertising.
• Provide just-in-time privacy notices explaining what personal information is collected, the purposes, and if personal information will be sold or shared, and link to the complete privacy policy that explains if parental or opt-in consent to collect personal information from children is required.
• Use only neutral age screens that encourage children to enter their age accurately.
• Appropriately configure third-party SDKs to comply with laws governing the privacy of children’s data.
• Implement and maintain an SDK governance framework and conduct annual assessments and training.
• Comply with laws and best practices related to advertising to minors and minimize the collection and use of children’s data.
• Implement and maintain a program to assess and monitor compliance that is conducted by a third-party or COPPA safe harbor program and provide annual reports to the California Department of Justice and Los Angeles City Attorney’s Office for three years.

The settlement also imposes specific operational requirements related to the deployment of advertising and separation of advertising from content and specifies that willful disregard of a child’s age constitutes actual knowledge. All games featuring characters from SpongeBob SquarePants will be deemed directed to children but could also be categorized as mixed audience for privacy purposes.

Conclusion

While the FTC and states continue to enforce violations of COPPA, the Tilting Point settlement is the California AG’s third enforcement action under the CCPA and the first enforcement action under the CCPA concerning children’s data. Given the ongoing legislative focus on children’s privacy and advertising, both at the federal level and in California and other states, more enforcement actions by regulators would not be surprising. Companies offering games and other content appealing to children and teens should be aware of the increased focus on data collection and advertising practices by state regulators.