The New Mexico District Court has issued an opinion and order in New Mexico Attorney General Hector Balderas’s suit against Tiny Labs, Twitter, Google, and others. A group of the defendants, the SDK Defendants, filed a motion to dismiss for failure to state a claim, and Google filed an additional motion to dismiss. SDK Defendants include Twitter, MoPub, AerServ, InMobi PTE, Applovin Corp, and ironSource USA. .While the allegations against the SDK Defendants were dismissed, the federal allegations against Google survived.
The suit concerned ads allegedly “tailor-made to match out interests” because “[t]here are companies – matchmakers of the digital age – that design computer programs to match app users with the ads most suited to them.” These companies provide software development kits (SDKs to app developers that allow the apps to collect information about the app users .
However, sometimes app users are children, which means that apps are collecting data about children. The Children’s Online Privacy Protection Act (COPPA) “prohibits app developers and ad networks from collecting certain personal information from app users who are children without first taking certain precautions.”
The court’s opinion addresses “what circumstances ad networks may be held liable under COPPA for their collection of personal information from app users who are children, in addition to how issues of preemption and state law come into play.”
Tiny Labs develops mobile games for children. The SDK Defendants sold their services to Tiny Labs to install on its app. As a result, “[w]hen a Tiny Lab app is downloaded onto a child’s device in New Mexico, the Ad Networks’ SDKs are also installed as app components. Once so embedded, while a child…plays one of the apps, the Ad Networks’ SDK collects personal information about that child and tracks the child’s online behavior to profile the child for targeted advertising.” However, “[t]his activity is invisible to the child and her parents, who simply see the given app’s game interface.” New Mexico claimed that Tiny Lab and the Ad Networks violated COPPA and New Mexico’s Unfair Practices Act (UPA) and that Google also violated UPA.
In the motions to dismiss, defendants claimed that “(1) Plaintiff has failed to adequately allege that the Ad Networks violated COPPA; (2) as a result, Plaintiff’s state law claims against the Ad Networks are preempted by COPPA; and (3) even if the state law claims were not preempted, Plaintiff has failed to adequately allege claims against the Ad Networks under either the UPA or common law. In its Motion to Dismiss, Google further argues that Plaintiff has failed to adequately allege that it violated the UPA in connection with its operation of Google Play.”
New Mexico stated that through communication with Tiny Labs, the Ad Networks would have learned that Tiny Lab apps are for children and that Google gained additional knowledge of this by reviewing the app for its app store. The court found that the complaint “does not plausibly allege actual knowledge on the part of the Ad Networks by virtue of the communications between their SDKs and their servers, but does plead factual content that allows the Court to draw the reasonable inference that Google had actual knowledge of the child-directed nature of Tiny Lab’s apps.”
The defendants argued that “[n]either an app developer not an ad network needs to obtain parental consent if it ‘collects a persistent identifier and no other personal information and such identifier is used for the sole purpose of providing support for the internal operations of the Web site or online service.’” The court disagreed because the Ad Networks “engage in targeted advertising” and Google “not only collected persistent identifiers but also ‘can receive the GPS location of the child’s device, with a street-level granular accuracy.’” This allegation survived Google’s motion to dismiss.
Google claimed it “relied on Tiny Lab’s promises to ensure COPPA compliance.” Google added that this is part of its contract with app developers, including Tiny Labs. The court states that this is not a means to dismiss the plaintiff’s COPPA violation claim.
