Path, a social networking mobile app, has agreed to enter into a settlement with the Federal Trade Commission (“FTC”) regarding charges that the company deceived consumers by collecting contact information from users’ mobile address books without notice and consent. The agreement also resolves charges that the company violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information from children under 13 years old without parental notice and consent. Path did not admit any liability by entering into the consent decree, which is for settlement purposes only.
In addition, the FTC alleged that Path violated COPPA, which governs the online collection, use, and disclosure of personal information from children under the age of 13. During registration, Path asked users to provide their date of birth along with personal information, such as full name and email address. According to the FTC, approximately 3,000 users gave an under-13 birth date, which provided Path actual knowledge that the user was a child. The FTC claimed that for these users Path did not comply with COPPA’s requirements to provide parents notice, obtain parental consent, and explain its information handling practices with respect to children in an online privacy notice. Path agreed to pay an $800,000 civil penalty to settle the COPPA charges.
The Path settlement is one of several recent efforts to improve mobile app developers’ privacy practices, particularly in the area of children’s privacy. On the same day that the Path settlement was announced, the FTC released new mobile app privacy guidelines. These guidelines follow two FTC reports analyzing whether child-directed apps are providing adequate notice about their privacy practices, and the FTC has actively enforced COPPA against mobile app developers. In addition to the FTC’s efforts, the Department of Commerce and State Attorneys General in California and New Jersey have been focused on mobile privacy issues as well.