In a recent development, the California Attorney General's Office (CAG) has reached a settlement with Tilting Point Media, a mobile game publisher, for alleged violations of the California Consumer Privacy Act (CCPA) and the Children's Online Privacy Protection Act (COPPA). This marks the third public enforcement action under the CCPA, signaling a heightened focus on protecting online and mobile privacy, especially for children. Alleged Violations by Tilting Point
Tilting Point was accused of collecting and sharing user data, including that of children under 13, without obtaining proper consent. The allegations included instances where the age screen did not prompt users, particularly children, to disclose their age accurately. Additionally, misconfigured third-party software development kits (SDKs) resulted in the unauthorized collection and sale of children's data without parental consent. Settlement Terms
As part of the settlement, Tilting Point has agreed to pay a $500,000 fine and adhere to the following compliance measures:
- Not share personal information of consumers under 13 without parental consent, and obtain opt-in consent for those aged between 13 and 16.
- Provide 'just-in-time notice' when sharing children's information, including details on data collection purposes and privacy policies.
- Utilize neutral age screens for accurate age disclosure by children.
- Properly configure third-party SDKs to comply with regulations on children's data.
- Establish an SDK governance framework for app reviews.
- Comply with advertising laws related to minors and limit data collection from children.
- Implement a monitoring program to track compliance and submit annual reports. Continued CCPA Enforcement
The CAG's actions against Tilting Point follow earlier settlements with DoorDash and Sephora for similar privacy violations. These cases serve as a reminder for companies to prioritize transparency, obtain parental consent, ensure online tracking consent, and review third-party relationships when dealing with user data. Key Lessons Learned
-The Tilting Point settlement underscores the importance of prioritizing transparency in data practices and obtaining verifiable parental consent for children's data.
-Companies must implement robust systems for online tracking consent and carefully review data-sharing agreements with third-party vendors. Conclusion
As data privacy regulations become increasingly stringent, companies must proactively comply with laws like the CCPA to avoid penalties and safeguard user privacy. The enforcement actions against Tilting Point and other companies highlight the growing emphasis on data protection, urging organizations to prioritize compliance with privacy laws and best practices.