Re-Evaluate How to Monetize Gaming Apps Geared Toward Kids

Re-Evaluate How to Monetize Gaming Apps Geared Toward Kids

The following blog post, unless otherwise noted, was written by a member of Gamasutra’s community.The thoughts and opinions expressed are those of the writer and not Gamasutra or its parent company.

Facebook just settled the Federal Trade Commission’s (“FTC”) eight separate privacy-related allegations against it for $5 billion.  Equifax just settled the FTC’s claims against it arising from Equifax’s September 2017 data breach for $425 million. 

On May 25, 2018, the GDPR - a law relating to privacy in the European Union – went into effect.  In January 2020, California’s own privacy law will go into effect.  Federal privacy legislation has been proposed in the Senate and various states are also looking at passing their own state privacy laws. 

It should come as no surprise that, with this dynamic, there is growing scrutiny on the ways in which the personal information of children is handled in their digital lives.  Anyone making games or other apps geared toward children should assume that the trend in the law will be to afford children’s data more protection, not less, than you might see in the marketplace right now.

The California Constitution and Common Law Is A Source of Protection for Children’s Privacy and Interpretation of These Sources is Evolving with a Growing Expectation for Privacy

In a series of class actions, the Northern District of California was asked to determine whether the California Constitution and California’s common law could serve as the source for claims related to the alleged misuse of data derived from gaming apps for kids.  Those class actions all alleged “that the apps were used to track online behavior on a device and user-specific level, and that defendants exploited the data, without disclosure or consent, for profit.  Each of the class actions asserted claims under the California Constitution and for intrusion upon seclusion under California law. 

The complaints for each class action alleged similar facts pertaining to those to causes of action.  Generally, they alleged that a parent or child downloads and installs a gaming app onto a cell phone or other mobile device for play.  When the app is launched, it connects immediately to a server hosted by the developer and begins sending data even before the user plays the game.  The data sharing is invisible to the user.  As the user plays the game, the embedded SDK code communicates with the SDK defendant’s individual server.  The SDK code sends requests or “calls” for an ad to the server, and the user’s personal data is sent with each call.  As a result of the call, the user “may receive a single ad, but nonetheless multiple SDKs have exfiltrated to their servers the user’s Personal Data.”  The “Personal Data” could include name, gender, birthdate, geolocation information, search queries, mobile device identifier, mobile phone number, alternative email addresses, contacts, contact information, nicknames and aliases, physical address, IP address, other persistent identifiers, or other information the child might share with the app (such as photos, videos, or other audio files, all of which might include the child’s face and voice).

The court found that the plaintiffs had adequately alleged both of the California privacy claims.  The analysis was influenced by the Court’s observation that “[c]urrent privacy expectations are developing, to say the least, with respect to a key issue in these cases – whether the data subject owns and controls his or her personal information, and whether a commercial entity that secretly harvests it commits a highly offensive or egregious act.”

Privacy expectations can be influenced by many factors in society.

The Children’s Online Privacy Protection Act (“COPPA”) Is Another Source of Legal Protection for Children’s Privacy and is Undergoing Review by the FTC

On July 17, 2019, the FTC announced that “[i]n light of rapid changes in technology” it was seeking comment on the effectiveness of the COPPA Rule.  The COPPA Rule first came into action in 2000. 

Some of the questions posed by the FTC about the COPPA Rule as they pertain to games and apps include:

Does the Rule overlap or conflict with any other federal, state, or local government laws or regulations?

Has the Rule affected children’s ability to access information of their choice online? If so, how?

Has the 2013 addition, found in part (3) of the definition of “Web site or online service directed to children,” which permits those sites that do not target children as their primary audience to age screen users, resulted in stronger protections for children’s privacy? Should the Rule be more specific about the appropriate methods for determining the age of users?

What are the implications for COPPA enforcement raised by technologies such as interactive television, interactive gaming, chatbots, or other similar interactive media?

 Instructions on how to submit comments are included in the Federal Register notice, but a lawyer can also help you submit any comments.

You can have a voice in developing the laws as applied to children, as least in one instance by sending the FTC your comments (or working with your lawyer to do so).

Companies that take an aggressive stance on protecting children’s privacy may avoid disastrous consequences that those who take a “wait and see” approach may face.