The Federal Trade Commission (FTC) announced today that two companies, Yelp, Inc. and TinyCo, Inc., will settle with the commission over charges that they violated the Children's Online Privacy Protection Act (COPPA) Rule in their mobile apps.
Yelp will pay a $450,000 civil penalty while TinyCo is on the hook for a $300,000 civil penalty, according to an FTC press release. COPPA requires companies that collect information from children 13 and under to take steps to protect their young users' information. Under the rule, companies must also tell parents how their child's information will be used and then receive their consent before collecting any data.
In Yelp's case, the FTC claims that in 2009 the online review company began allowing users to register directly through its mobile app, as opposed to through its website. However, the new feature didn't adequately screen users to prevent children from registering, the FTC says in its complaint against the review company. Yelp also failed to test its registration steps to make sure the app was rejecting children's user registrations.
“From April 2009 to April 2013, both the iOS and Android versions of the Yelp App accepted registrations from users who inputted any date of birth, including dates of birth indicating the user was under the age of 13,” the complaint states.
The app also collected information automatically from users' phones, including their Mobile Device IDs, and in some cases, their precise locations. In addition to that information, children's names and emails could have been collected.
After paying its civil penalty, the settlement also requires the company to delete information collected from users who registered when they were 13 and younger, unless Yelp can prove they were actually older than 13. In one year, Yelp will have to submit a compliance report showing how it has complied with COPPA.
TinyCo collected similar information from its young users. The company's apps, which include Tiny Pets, Tiny Zoo, and Tiny Monsters, use animated characters and simple language to appeal to kids, the FTC claims.
Some of the company's apps give users an opportunity to enter their email addresses to get bonus in-game currency. The FTC alleges in its complaint that TinyCo failed to notify parents of what information was collected and how it was used. Additionally, the company didn't obtain parental consent before collecting the data.
TinyCo will pay its civil penalty and also be required to delete the collected data from its young users. Similarly to Yelp, it must also submit a compliance report in a year.