After a two-year probe carried out by the New York Attorney General's office, Viacom, Mattel, Hasbro and JumpStart have agreed to pay a total of $835,000 in violation of the Children's Online Privacy Protection Act for tracking the online activity and collecting personal information of children under the age of 13.
While tracking user activity for marketing and advertising purposes is nearly ubiquitous on the web, COPPA has prohibited sites that are directed toward children to collect personal information, such as names and email addresses, on kids who are younger than 13 since 1998. In 2013, COPPA expanded "information" to include Internet Protocol addresses and prohibited the use of collecting cookies.
"Adults are cognitively more mature about the quid pro quo of visiting a site," said a representative from the New York Attorney General's Office. "I give up my privacy so I can read a site like CNET for free. Kids 12 and under don't have that understanding... Congress needs to protect them a little bit more."
The investigation found that sites owned by Viacom (Nick Jr. and the Nickelodeon websites); Mattel (sites associated with the Barbie, Hot Wheels, American Girl and Matchbox brands); Hasbro (which owns sites for My Little Pony, Nerf and Transformers); and JumpStart (which operates the Neopets site) allowed third-party tracking from vendors and marketers.
The companies will pay a fine towards penalties and to implement reforms. Hasbro's COPPA violations were found to be less egregious, and it will not pay any fines. Hasbro is also a participant of the FTC's Safe Harbor program, which shows a site operator is compliant with COPPA.
Reforms include scans to monitor for third-party tracking technologies, vetting third-parties' data collection practices and providing regular reports of said scans.
Editors' Note: On September 14, 2016, Jumpstart released a formal statement, attached below:
The security of our users' personal information and privacy have always been a top priority for our Company. Neopets was the only JumpStart game alleged to be in violation, which is a property we acquired in 2014. It is also the only JumpStart game that is not marketed to kids, and as such, only a very small percentage of Neopets' registered users are under the age of 13. Since acquiring Neopets two years ago, we have taken a number of steps to address privacy including switching ad providers, vetting ads, and reviewing and revising internal privacy policies. This has been an ongoing process, and we will continue to enact all possible measures to protect children and ALL our users' privacy and data for our entire portfolio of games.