The FTC orders WW International and Kurbo to destroy the algorithms built with unlawfully collected data.
WW International and Kurbo placed into the market a weight loss app addressed to children (as young as 8 years old) and collected personal data without the consent of the holder of parental responsibility.
From 2014 to 2019 Kurbo offered a weight-management and tracking service designed for use by children ages eight and older, teenagers, and families. Kurbo app tracks the individual food intake, activity, and weight, and also collects personal information such as names, email addresses, and birth dates.
From its launch in 2014 through February 2020, over 279,500 people used the Kurbo service. Age information entered for at least 18,600 of those users indicated they were children under the age of 13.
COPPA Rule requires that websites, apps, and online services that are child-directed or knowingly collect personal information from children notify parents and get their consent before collecting, using or disclosing personal information from children under 13.
On the notice. The App did not provide any notice to parents until November 2019, and even then did not solicit parental consent. The notice Kurbo provided on the website in November 2019 was deficient because it did not clearly and completely specify the categories of information collected from children.
On the parental consent. Kurbo did not institute a method for obtaining verifiable parental consent that was reasonably calculated to ensure that a parent was actually providing consent. Until late 2019, users could sign up for Kurbo either on the app or website by indicating that they were a parent signing up for their child or a child over the age of 13 signing up for themselves. Kurbo’s signup process encouraged younger users to falsely claim they were over the age of 13. In fact, from 2014 to 2019, hundreds of users who signed up for the app claiming to be over the age of 13 later changed their birthdates on their profiles to indicate they were really under 13.
On retention periods. Until August 2021, Kurbo kept children’s personal information indefinitely, rather than “only as long as is reasonably necessary to fulfill the purpose for which the information was collected.”
The settlement
In March 2022 the companies and the FTC settled the dispute and it was agreed that Kurbo must:
• pay a $1.500.000 penalty
• erase data collected from children under 13 for more than a year after the last time a child uses Kurbo
• destroy all personal information previously collected that did not comply with the COPPA Rule’s parental notice and consent requirements unless the companies’ obtained subsequent parental consent to retain such data.
• destroy any affected work product (algorithm) that used data illegally collected from children in violation of COPPA within 90 days. Affected Work Product means any models or algorithms developed in whole or in part using Personal Information Collected from Children through the Kurbo Program
0 comentarios