Attorney General Bonta, L.A. City Attorney Feldstein Soto, Announce $500,000 Settlement with Tilting Point Media for Illegally Collecting and Sharing Children’s Data (2024)

Another important action toprotectkids’ online data

OAKLAND—California Attorney General Rob Bonta, along with Los Angeles City Attorney Hydee Feldstein Soto, announced a $500,000 settlement with Tilting Point Media LLC (Tilting Point) resolving allegations that the company violated the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA) by collecting and sharing children’s data without parental consent in their popular mobile app game “SpongeBob:KrustyCook-Off.”In addition to $500,000 in civil penalties, Tilting Point must comply with injunctive terms ensuring legal data collection and disclosure, including obtaining parental consent and diligence in configuring third-party software in their mobile games.

“Businesses have a legal obligation to protect kids’ data and to comply with important state and federal privacy laws designed to protect children online. Failing to do this puts our kids at risk, leaving them vulnerable to having their personal data collected, tracked, and sold,”said Attorney General Bonta.“As children spend an increasing amount of time online, both on websites and using mobile apps, we will use every enforcement tool to ensure compliance with the law and that companiesexercise diligence with privacy law requirements. I thank the Los Angeles City Attorney’s Officefor their work on this issueand look forward tocontinuing to workcollaboratively with local, state, and federal partners toprotectchildren’s privacy.”

“The “SpongeBob: Krusty Cook-Off” game is based on some of the most beloved and recognizable characters in children’s entertainment. Tilting Point Media is alleged to have collected and shared its young players' personal data, violating consumer privacy laws and industry guidelines,”said Hydee Feldstein Soto, Los Angeles City Attorney.“Protecting our children has been a top priority for my administration. I am proud to partner with Attorney General Bonta to protect children throughout our State and am grateful to the lawyers in the Public Rights Branch in my office for initiating this action to stop data harvesting of minors.”

“SpongeBob: Krusty Cook-Off” (SpongeBob) is a popular cooking simulation game that includes both targeted advertising and in-app purchases and is directed to children under the age of 13 as well as targeted to older teens and adults.The app was first investigated by the Children’s Advertising Review Unit (CARU), a division of the Better Business BureauNational Programs that investigates potential deceptive or inappropriate data collection from children online. CARU found that the privacy and advertising practices of the SpongeBob app failed to comply with COPPA and CARU’s industry guidelines.Although Tilting Point took some corrective action, a joint investigation by the California Department of Justice and Los Angeles City Attorney’s Office found that Tilting Point was in violation of the CCPA and COPPA in connection with how the mobile app handled children’s data. Tilting Point’s age screen did not ask age in a neutral manner, meaning children were not encouraged to enter their age correctly to be directed to a child-version of the game.Additionally, Tilting Point inadvertently misconfigured third-party software development kits (SDKs), resulting in the collection and sale of kids’ data without parental consent.

In addition to paying $500,000 in civil penalties, Tilting Point media must comply with strong injunctive terms. Tilting Point must:

• Comply with the CCPA and COPPA related to children’s data in the SpongeBob game and all of its games directed to children.
• Not sell or share the personal information of consumers less than 13 years old without parental consent, and not sell or share the personal information of consumers at least 13 and less than 16 years old without the consumer’s affirmative “opt-in” consent.
• In instances where Tilting Point sells or shares the personal information of children, provide a just-in-time notice explaining what information is collected, the purpose, if the information will be sold or shared, and link to the privacy policy explaining the parental or opt-in consent required.
• Use only neutral age screens that encourage children to enter their age accurately.
• Appropriately configure third-party SDKs to comply with legal requirements related to children’s data.
• Implement and maintain a SDK governance framework to review the use and configuration of SDKs within its apps.
• Comply with laws and best practices related to advertising to minors, and minimize data collection and use from children.
• Implement and maintain a program to assess and monitor its compliance with the judgment, including annual reports to theCalifornia Department of Justice and Los Angeles City Attorney’s Office.

COPPA AND CCPA

COPPA is a federal law that requires operators of websites and online services that are either directed to children under 13, or that have actual knowledge that they are collecting personal information from children under 13, to provide notice to parents and obtain parental consent before collecting, using, or disclosing personal information from children.The CCPA is a landmark state law that secures increased privacy rights for California consumers, including the right to know how businesses collect, share, and disclose their personal information and the right to opt-out of the sale or sharing of their personal information. The CCPA imposes on businesses specific responsibilities related to children’s data, including requiring parental consent before selling or sharing personal information from children under 13 years old, and obtaining the consumer’s affirmative opt-in consent for users at least 13 and under 16 years old.

Attorney General Bonta is committed to enforcingboth COPPA and the CCPA toimprove children'sonline safety. Today's settlement represents Attorney General Bonta'sthirdenforcement action under the CCPA, and his continued priority to protect children online:

• In March, Attorney General Bonta joined abipartisan multistate letterto the Federal Trade Commission proposing updates to regulations implementing COPPA and advocating for further clarity and specification for proposed rules.
• In February, Attorney General Bontaannounceda settlementwith DoorDash, resolving allegations that the company violated the CCPA and COPPA, by sellingCalifornia customers’ personal information without providing notice or an opportunity to opt out of that sale.
• In January,Attorney GeneralBonta,Assemblymember Buffy Wicks, andSenatorNancy Skinnerintroducedthe California Children’s Data Privacy Act (AB 1949), and the ProtectingOur Kids from Social Media AddictionAct (SB 976),landmark legislation seeking to protect youth online. These two billswould, respectively,limit the harms associated with social media addiction and provide more robust protections for kids’ data privacy.
• In October 2023, Attorney General Bontaco-leda bipartisan coalition of 33attorneysgeneralinfiling a federal lawsuitagainst Meta Platforms, allegingamongother things, that Metadesigned and deployed harmful features on Instagram and Facebook thataddict children and teensto their mental and physical detriment.Thelawsuitalleges that Meta violated federal and state laws, including COPPA, California's False Advertising Law, and California’s Unfair Competition Law.
• In 2022, Attorney General Bontaannounced asettlementwith Sephora, resolving allegations that the company violated the CCPAby failing to disclose to consumers that it was selling their personal information, andfailingto process user requests to opt out of these sales.

A copy of the complaint and stipulated judgment,subject to court approval, can be foundhereandhere.

# # #