SpongeBob App Owner Agrees to Pay $500,000 in Calif. COPPA Settlement
Tilting Point Media agreed to pay a $500,000 settlement resolving privacy allegations involving the SpongeBob: Krusty Cook-Off game app, said a news release Tuesday from California Attorney General Rob Bonta (D) and Los Angeles City Attorney Hydee Feldstein Soto.
Bonta and Soto’s Tuesday complaint on behalf of the state in U.S. District Court for Central California in Los Angeles alleged violations of the Children’s Online Privacy Protection Act (COPPA) and the California Consumer Privacy Act (CCPA). The suit (docket 2:24-cv-05140) was based on “Tilting Point’s collection, disclosure, sale, and/or sharing of children’s personal information without the required parental or opt-in consent and based on age-inappropriate advertising to children in connection with Tilting Point’s mobile free-to-play games.”
A joint stipulation for entry of judgment, filed concurrently with the complaint, said the parties agreed to resolve the allegations contained in the enforcement action by entry of the proposed final judgment and permanent injunction "without the taking of proof and without trial or adjudication of any issue of fact or law” and without an admission by Tilting Point regarding any issue of law or fact alleged in the complaint, except that Tilting Point “stipulates to and admits facts sufficient to establish jurisdiction” of the court. The company also didn’t admit any liability regarding allegations of violations that occurred prior to entry of the judgment, said the joint stipulation.
In addition to $500,000 in penalties, Tilting Point must comply with injunctive terms “ensuring legal data collection and disclosure” in its mobile games, including parental consent and “diligence in configuring third-party software in their mobile games,” said the release.
Terms require Tilting Point to comply with COPPA and CCPA related to children’s data in all of its games directed to children, not sell or share the personal information of consumers under 13 without parental consent, and not sell or share personal information of consumers 13-16 without the consumer’s affirmative opt-in consent. In instances where Tilting Point does sell or share children’s personal information, it must provide a “just-in-time notice explaining what information is collected, the purpose, if the information will be sold or shared, and link to the privacy policy explaining the parental or opt-in consent required."
Additional terms call for Tilting Point to use only “neutral age screens that encourage children to enter their age accurately”; configure third-party software development kits (SDKs) to comply with legal requirements related to children’s data; implement and maintain an SDK governance framework to review the use and configuration of SDKs within its apps; comply with laws and best practices related to advertising to minors and minimize data collection from children; and implement a program to assess and monitor its compliance with the judgment, including annual reports to state and city jurisdictions.