A group of toy and children's entertainment giants have been lightly fined for letting advertisers illegally track kids online.
The US Federal Trade Commission (FTC) and a group of state Attorneys General (AGs) have told Viacom, Mattel, Hasbro, and JumpStart to cough up some change for multiple violations of the Children's Online Privacy Protection Act (COPPA).
The punishment, announced by New York AG Eric Schneiderman, calls for the companies to pay an astonishing $835,000 and agree to a series of mandatory reforms on how the sites collect and store user data.
A two-year investigation by the New York AG's office dubbed "Operation Child Tracker" documented how the sites were failing to place the necessary protections (such as asking for parental permission) on sites whose primary audience is known to be children under the age of 13.
The FTC had charged that the companies – whose brands include Barbie, Nickelodeon, Hot Wheels, My Little Pony, and Nerf – had allowed third-party advertising companies to access user data for tracking, profiling, and behavioral advertising. While legal for adults, collecting and sharing such information on users under the age of 13 is a violation of COPPA.
"Federal law demands that children are off limits to the prying eyes of advertisers,” Schneiderman said.
"Operation Child Tracker revealed that some of our nation's biggest companies failed to protect kids' privacy and shield them from illegal online tracking."
This isn't the first time children's toys have created privacy problems for their young audiences. Last year, Mattel found itself subjected to criticism after its "Hello Barbie" doll was found to be recording and uploading audio from an embedded microphone.
Under the terms of the settlements, the companies will all agree to place additional oversight on their third-party advertisers, including regular scans to monitor how advertisers are collecting data and background checks for ad partners.
The sites will also be required to keep detailed accounts of how data is collected and provide that information to parents upon request. ®
Sponsored: Webcast: Simplify data protection on AWS