Search

History of COPPA Violations

Here is a list of significant COPPA violations to date. A court can hold operators who violate the Rule liable for civil penalties of up to $50,120 per violation. 
privo-headerkid-12

The FTC enforces COPPA violations. A court can hold operators who violate the Rule liable for civil penalties of up to $50,120 per violation. COPPA gives states and certain federal agencies authority to enforce compliance with respect to entities over which they have jurisdiction. For example, New York has brought several COPPA enforcement actions (see below). In addition, some federal agencies, such as the Office of the Comptroller of the Currency and the Department of Transportation, are responsible for handling COPPA compliance for the specific industries they regulate.

Who is covered by COPPA?
The Rule applies to operators of commercial websites and online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Although nonprofit entities generally are not subject to COPPA, the Federal Trade Commission (FTC) encourages such entities to post privacy policies online and to provide COPPA’s protections to their child visitors.

 

Below is a timeline of COPPA violations, and a brief overview of important details that got companies into trouble. Check out our quick tips on how to comply with COPPA, or contact us for more information on getting your organization in compliance.

 

Timeline of Violations

youtubeCOPPAAsset 23@4x
$520,000,000
December 19, 2022

Fortnite (Epic Games)

Epic will pay a $275 million penalty for violating children’s privacy law, change default privacy settings, and pay $245 million in refunds for tricking users into making unwanted charges.
read more...

TrackAsset 16@4x
$1,500,000
February 18, 2022

WW International and Kurbo Inc.

WW International — previously Weight Watchers — has agreed to pay $1.5 million to resolve claims from the Federal Trade Commission (FTC) that it illegally gathered the data of underage users of its Kurbo program.  

COPPA FineAsset 9@4x
$2,000,000
Dec 15, 2021

OpenX

California-based online advertising platform OpenX Technologies, Inc. will be required to pay $2 million to settle Federal Trade Commission allegations that the company collected personal information from children under 13 without parental consent,read more....

youtubeCOPPAAsset 23@4x
$3,000,000
July 1st, 2021

Recolor

In its complaint, the FTC alleged that the Recolor app collected personal information from children under the age of 13 who used the app’s social media features and allowed third-party advertising networks to collect personal information from users in the form of persistent identifiers, also known as cookies, for targeted ads. The companies failed to instruct the ad networks to refrain from using children’s persistent identifiers for behavioral advertising, according to the complaint

 

RecordAsset 20@4x
July 6, 2020

Miniclip

Miniclip falsely claimed from 2015 through mid-2019 that it was a member of the Children’s Advertising Review Unit’s (CARU) COPPA safe harbor program even though Miniclip’s membership had been terminated in 2015. Miniclip is prohibited from misrepresenting its participation or certification in any privacy or security program sponsored by a government or any self-regulatory organization, including the CARU COPPA safe harbor program. Miniclip is also subject to compliance and record keeping requirements.

ProfileAsset 12@4x
$100,000
June 24, 2020

We Heart It

The Washington AG alleged that We Heart It, which has approximately 500,000 monthly active U.S. users, allowed children under the age of 13 to create accounts, collected U13 users’ personal information, and allowed third-party advertisers to collect data from U13 users, all without obtaining COPPA-compliant verifiable parental consent.

AppsAsset 13@4x
$150,000
June 4, 2020

HyperBeard

The app developer violated COPPA by allowing third-party ad networks to collect personal information in the form of persistent identifiers to track users of the company’s child-directed apps, without notifying parents or obtaining verifiable parental consent.

HyperBeard has an array of children's apps including Axolochi, BunnyBuns, Chichens, Claberta, Clawbert, KleptoCats, KleptoCats 2, KleptoDogs, MonkeyNauts, and NomNoms.

COPPA FineAsset 9@4x
Consent Agreement
October 22, 2019

Retina-X Studios, LLC

The apps—MobileSpy, PhoneSheriff and TeenShield—referred to as "stalking apps", allowed purchasers to monitor the mobile devices on which they were installed, without the knowledge or permission of the device’s user.

Retina-X violated the COPPA by failing to take reasonable measures to secure the personal information it collected from children.

To see the Decision and Order, click here. 

youtube coppa violation
$170,000,000
September 4, 2019

YouTube

Google LLC and its subsidiary YouTube, LLC will pay a record $170 million to settle allegations by the Federal Trade Commission and the New York Attorney General that the YouTube video sharing service illegally collected personal information from children without their parents’ consent.

The settlement requires Google and YouTube to pay $136 million to the FTC and $34 million to New York for allegedly violating the COPPA.

More information read the press release by clicking here.

TikTok
$5,700,000
February 27, 2019

Musical.ly (TikTok)

Musical.ly, now known as TikTok, has agreed to pay $5.7 million to settle FTC allegations that the company illegally collected personal information from children. The operators knew many children were using the app but they still failed to seek parental consent before collecting names, email addresses, and other personal information from users under the age of 13,

At the time, it was the largest civil penalty ever obtained by the Commission in a children’s privacy case.

Oath AOL coppa violation
$4,950,000
December 1, 2018

Oath (AOL)

TechCrunch’s Verizon-owned parent, Oath, an ad tech division made from the merging of AOL and Yahoo, has agreed to pay $4.95 Million – and adopt comprehensive reforms to protect children from improper tracking. The company conducted billions of auctions for targeted ads on hundreds of children’s websites in violation of COPPA.

View the NY Attorney General Press Release by clicking here.

 

 

 

iDressup COPPA penalty noncompliance
$35,000
August 3, 2018

Unixiz Inc. (i-Dressup)

i-Dressup collected and retained personal information from children without parental consent. In addition to violating COPPA’s parental consent provisions, i-Dressup violated COPPA’s data security requirements.

Explore Talent COPPA violation
$500,000
February 5, 2018

Explore Talent

Along with collecting names, contact information and age, the company also asked users for their mailing address, weight, “body type,” and measurements for waist, hips, bust, shirt, etc. In addition, they urged users to upload a photo because “agents & casting directors choose only serious candidates with pictures. All of this was done without collecting parent permission.

InternetAsset 18@4x
$650,000
February 5, 2018

VTech

The company was found collecting information from children without parents permission through connected toys violating children's privacy.

Operation Child Tracker
$835,000
September 13, 2016

Operation Child Tracker

Operation Child Tracker was a two-year investigation by the NY Attorney General’s office, discovered that websites operated by Mattel, Viacom, Hasbro and Jumpstart were home to tracking technology that illegally enabled third-party vendors, such as marketers or advertising companies, to track children’s online activity in violation of COPPA.

Mattel $250,000   Viacom $500,000
Hasbro No fine.  Jumpstart $85,000.

Location icon
$650,000
June 22, 2016

InMobi

The FTC charged the company for deceptively tracking the locations of hundreds of millions of consumers – including children – without their knowledge or consent to serve them geo-targeted advertising.

Tiny Co COPPA Violation
$300,000
September 17, 2014

Tiny Co

Tiny Co runs many games and applications including Tiny Pets, Tiny Zoo, Tiny Village, Tiny Monsters and more. In exchange for in-app currency to buy game enhancements, TinyCo encouraged kids to turn over their email addresses, but the company didn't get parental permission as required by COPPA.

Yelp COPPA violation
$450,000
September 17, 2014

Yelp

The lawsuit also alleged that Yelp didn’t adequately test its apps to ensure that users under the age of 13 were prohibited from registering

CV_theft
Feb 13, 2013

Path, Inc.

The Path social networking app was charged for deceiving users by collecting personal information from their mobile device address books without their knowledge and consent. In addition to the civil penalty, the settlement requires Path, Inc. to establish a comprehensive privacy program and to obtain independent privacy assessments every other year for the next 20 years.  For more information read the press release by clicking here.

Kids Music Asset 7@4x
$1M
Oct 4, 2012

Artist Arena

The operator of fan websites for music stars Justin Bieber, Rihanna, Demi Lovato, and Selena Gomez violated COPPA by improperly collecting personal information from children under 13 letting them register to join the fan clubs, create profiles and post on members’ walls without their parents’ consent.

For more information read the press release by clicking here.

Fine icon
$250,000
March 27, 2012

RockYou

While touting its security features, RockYou failed to protect the privacy of its users, allowing hackers to access the personal information of 32 million users and violated COPPA in collecting information from approximately 179,000 children. As part of settlement, the FTC required RockYou to implement and maintain a data security program, bars future violations of the COPPA Rule, and requires it to pay fine.

COPPA Violation Social Network
$100,000
November 8, 2011

Skid-e-kids

The operator of www.skidekids.com(link is external), a website that advertises itself as the “Facebook and Myspace for Kids,” targeted children ages 7-14 to register, create and update profile information, create public posts, upload pictures and videos, and “friend” and send messages to other Skid-e-kids members.

Broken Thumbs Apps COPPA
$50,000
August 15, 2011

Broken Thumbs Apps

This was the Commission’s first case involving mobile applications, known as apps, collecting children's information. 

Playdom COPPA Violation
$3,000,000
May 12, 2011

Playdom, Inc.

The operators of 20 online virtual worlds have agreed to pay $3 million to settle Federal Trade Commission charges that they violated COPPA by illegally collecting and disclosing personal information from hundreds of thousands of children under age 13 without their parents’ prior consent. 

Iconix Brands COPPA violation 2009
$250,000
October 20, 2009

Iconix Brand Group

Iconix required consumers on many of its brand-specific Web sites to provide personal information, such as full name, e-mail address, zip code, and in some cases mailing address, gender, and phone number – as well as date of birth – in order to receive brand updates, enter sweepstakes contests, and participate in interactive brand-awareness campaigns and other Web site features.

Sony BMG Music COPPA Violation
$1,000,000
December 11, 2008

Sony BMG Music

The Commission’s complaint alleges that, through its music fan Web sites, Sony Music improperly collected, maintained and disclosed personal information from thousands of children under the age of 13, without their parents’ consent.

Industrous kid COPPA Violation
$130,000
January 30, 2008

Industrious Kid, Inc.

The web site in the violation was advertised as a “free, secure, social networking and blogging destination specifically designed for kids ages 8 to 14.” however collected and maintained personal information from children under the age of 13 without first notifying parents and obtaining their consent.

Doll Palace
$11,500
December, 2007

TheDollPalace.com

In December 2007, Texas became the first state to file COPPA enforcement actions, by separately suing the entities behind Gamesradar.com and TheDollPalace.com.

CV_law
December, 2007

Gamesradar.com

In December 2007, Texas became the first state to file COPPA enforcement actions, by separately suing the entities behind Gamesradar.com and TheDollPalace.com.

Xanga Coppa Violation more information
$1,000,000
September 7, 2006

Xanga

Xanga is a social networking site that collected, used and disclosed information from children under 13. This is the first million-dollar penalty since COPPA was enacted.

UMG Recordings COPPA fine
$400,000
February 18, 2004

UMG Recordings, Inc.

UMG Recordings operates hundreds of general audience Web sites that advertise and promote its music and artists, many of whom are popular with children.

UMG gained actual knowledge that a child was registering on the site whenever a child entered a birth date indicating he was under the age of 13. Yet, UMG collected this personal information from children without first notifying parents and obtaining verifiable parental consent.

Bonzi Software coppa violation
$75,000
February 18, 2004

Bonzi Software

The Bonzi Software case is the first COPPA case to challenge the information collection practices of an online service in connection with a software product

Hershey's coppa violation
$85,000
February 22, 2003

Hershey

Hershey operates more than 30 Web sites - many of which are candy-related sites directed to children. On a number of these sites, the company allegedly employed a method of obtaining parental consent that does not meet the standard delineated under the COPPA Rule.

Mrs Fields COPPA
$100,000
February 22, 2003

Mrs. Field's Cookies

Portions' of Mrs. Fields web sites were directed to children. The company allegedly collected personal information from more than 84,000 children, without first obtaining parental consent.

Kid Birthday ClubAsset 4@4x
$35,000
April 22, 2002

Ohio Art Company (Etch-a-Sketch)

The Ohio Art Company was found collecting personal information from children registering for "Etchy's Birthday Club." The site collected the names, mailing addresses, e-mail addresses, age, and date of birth from children who wanted to qualify to win an Etch-A-Sketch toy on their birthday without parent permission

Pop Corn COPPA
$10,000

American Pop Corn Company

The company’s website featured a “Kids Club" section that features games, crafts, contests, and jokes directed to children under the age of 13. The company collected personal information without parent consent.

Lisa Frank COPPA
$30,000
October 4, 2001

Lisa Frank

The Lisa Frank website was directed towards children and asked girls to register before they accessed many areas of the site, including the "club" and "shop" areas. The site asked girls for their first and last names, street addresses, phone numbers, e-mail addresses and birth dates, as well as their favorite color and season without parent permission.

icon for fine
$100,000
April 19, 2001

Monarch Services, Inc., Girls Life, Inc., Bigmailbox.com, Inc, Nolan Quan & Looksmart Ltd.

Marking the first anniversary of COPPA, the FTC announced settlements with three Web operators for illegally collecting personally identifying information from children under 13 years of age without parental consent. The companies together will pay a total of $100,000 in civil penalties and are required to comply with COPPA in connection with any future online collection of personally identifying information from children under 13. The settlement also requires the operators to delete all personally identifying information collected from children online at any time since the Rule's effective date.

More information read the press release by clicking here.

CV_law
July 21, 2000

Toysmart.com

This was the first complaint the Commission filed alleging a violation of COPPA. Toysmart collected detailed personal information about its visitors, including name, address, billing information, shopping preferences, and family profiles -- which included the names and birthdates of children. When it ran into financial difficulties, it attempted to sell all of its assets, including its detailed customer databases. Agreement enforces privacy promises, prohibits sale of customer lists except under very restricted circumstances.

Read the press release here.

CV_slap
Feb 12, 1999

GeoCities

GeoCities, agreed to settle FTC charges that it misrepresented the purposes for which it was collecting personal identifying information from children and adults. This was the first FTC case involving Internet privacy.

read more

Significance

Since COPPA came into force, fines for violating children's privacy online have become greater and greater. However, paying the fine is just the start of the process to repair brand damage. It takes years to build a positive brand relationship and just seconds for parents around the world to see your organization as unsafe for their children.

Understanding COPPA is complex to navigate. Each violation highlights a key lesson. Here are some important points from the list of violations above:

  • Websites, apps, games or other online services collecting information from children must obtain verifiable parental consent.
  • General audience websites, apps, games and other online services that have actual knowledge of children entering the site, must notify parents and get consent.
  • Common features that involve kids must get parent consent including:
    • Birthday clubs
    • Wish lists
    • Email subscriptions
    • Accounts with personal information
    • Multi-player chat
    • User generated content (photos/videos)
    • Third-party tracking

To get a better understanding of COPPA, view our COPPA Resource or "What is COPPA?" blog. If you are bringing children into your website, app, or game, there's a good chance COPPA applies to your organization.


Comply with COPPA

Complying with COPPA not only protects your organization from legal trouble, but shows that you are willing to go the extra mile to keep kids safe online. Learn more about the COPPA Regulation or our COPPA Safe Harbor Certification, and see how we can help your organization safely engage with children and their families online.

Want to receive our biweekly industry newsletter?

Contact Us