Final Judgment Released for Tilting Point’s CCPA and COPPA Violations

On June 18, 2024, California AG Rob Bonta together with LA City Attorney Hydee Feldstein Soto announced in a press release that they reached a settlement agreement with Tilting Point Media LLC following allegations that the company was in violation of both the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA) by collecting and sharing the personal information of children without obtaining parental consent through their mobile app game, SpongeBob: Krusty Cook-Off.

Launched in 2020, the game contained both ads and in-app purchases and underwent an initial investigation in September 2022 by the Children's Advertising Review Unit, who found the game to be noncompliant, allowing children under 13 years of age to consent to the privacy policy and play the game despite the fact that according to the privacy policy users had to be at least 13 years old to play the game. Following this investigation, Tilting Point took corrective actions, such as updating their age screen to direct users to two different versions of the mobile-app game, but this latest investigation found continued violations of the CCPA and COPPA, such as the same of personal information of children. 

Below we include some key points from the Complaint and the Final Judgment and Permanent Injunction, published on July 2, 2024:

• Violations of COPPA:
  • Collecting, using, and disclosing the personal information of children under the age of 13 without obtaining parental consent.
  • Insufficiently clear notices provided to parents about the data collection practices and the use of ineffective age verification methods.
• Violations of CCPA:

• Selling or sharing the personal information of children under the age of 16 without obtaining the required parental or opt-in consent.
• Insufficiently disclosing their data practices, especially regarding children's data, in their Privacy Policy.

• Unfair Advertising Practices:
  • The mobile-app game displayed advertisements that were not clearly labeled and did not provide clear exit methods.
  • Some of the ads were age-inappropriate, such as those promoting gambling apps and games about growing marijuana.
• Injunctive Relief: 

• “Comply with the CCPA and COPPA related to children’s data in the SpongeBob game and all of its games directed to children.
• Not sell or share the personal information of consumers less than 13 years old without parental consent, and not sell or share the personal information of consumers at least 13 and less than 16 years old without the consumer’s affirmative “opt-in” consent.
• In instances where Tilting Point sells or shares the personal information of children, provide a just-in-time notice explaining what information is collected, the purpose, if the information will be sold or shared, and link to the privacy policy explaining the parental or opt-in consent required.
• Use only neutral age screens that encourage children to enter their age accurately.
• Appropriately configure third-party SDKs to comply with legal requirements related to children’s data.
• Implement and maintain a SDK governance framework to review the use and configuration of SDKs within its apps.
• Comply with laws and best practices related to advertising to minors, and minimize data collection and use from children.
• Implement and maintain a program to assess and monitor its compliance with the judgment, including annual reports to the California Department of Justice and Los Angeles City Attorney’s Office.”

• Monetary penalties: 
  • A civil fine of $500,000;
  • $10,079.66 to the Los Angeles City Attorney’s Office for cost recovery.