Introduction
On May 22, 2019, a federal district court largely denied a facial challenge by Disney, Viacom, and several online advertising networks to claims alleging these defendants violated the privacy rights of children by collecting data through online gaming apps.
In McDonald v. Kiloo APS,1 the defendants consisted of two groups: the developers who created the gaming apps and made them available for download, and the mobile advertising and app monetization companies who provided software code inserted into the gaming apps to collect user data for advertising purposes. The defendants allegedly collected a variety of data from the children’s devices without appropriate consent, including the IP address; the specific device name; IDs for Apple and Android devices; the device’s International Mobile Equipment Identity; the timestamp at which an advertising event was recorded; and device fingerprint data (the user’s language, time zone, country, and mobile network).
The court characterized the gravamen of the complaint as the defendants working in coordination to collect and use personal data “to track, profile, and target children with targeted advertising.” According to the allegations, “[w]hen children are tracked over time and across the Internet, various activities are linked to a unique and persistent identifier to construct a profile of the user of a given device.” Plaintiffs alleged that defendants aggregate this data, as well as buy it from, and sell it to, third parties.
In evaluating the plaintiffs’ privacy claims, the court was reluctant to dismiss these claims before the parties had established an adequate factual record given the “context-specific nature of the privacy inquiry” and the fact that privacy expectations “are developing, to say the least,” with respect to data ownership, control, and collection. Consequently, the court allowed these claims to proceed past the pleading stage and into discovery. Similarly, the court held that the plaintiffs’ allegations were sufficient to state a claim under certain consumer deception and unfair competition laws.
For more information on the implications of this decision or other data privacy litigation, please contact a member of the privacy and data protection practice or internet strategy and litigation practice at Wilson Sonsini Goodrich & Rosati.
