Lawsuit accuses Disney of tracking children online without appropriate parental consent

The Walt Disney Company is the target of a new lawsuit, accusing the multimedia giant of allowing partners to identify and track children on the internet, in violation of the U.S. Child Online Privacy Protection Act.

The class-action lawsuit, filed in a U.S. District Court in San Francisco, alleges that gaming apps from Disney improperly collected information on children younger than 13 years old. The complaint was first discovered by SC Media.

Specifically, the complaint alleges that “Disney Princess Palace Pets” and other mobile apps contain multiple software development kits that share information with one another about users. These SDKs embed advertising in games that are designed for children, the suit asserts.

“Disney has failed to safeguard children’s personal information and ensure that third parties’ collection of data from children is lawful,” the complaint reads.

Disney issued a response to SC Media defending itself, saying the company has “a robust COPPA compliance program.”

“The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court,” a Disney spokesperson said.

At the center of the lawsuit, and very much up for debate, is what qualifies as “personally identifiable” information. Though COPPA requires consent from parents for companies to gather personally identifiable information about children, defining that information — and the improper collection of it — becomes more difficult as technology gets more sophisticated.

COPPA was enacted as a federal law in the U.S. in 1999, aiming to protect children’s privacy and safety online. In particular, the act includes restrictions on marketing to children under the age of 13.