Path, a social networking mobile app, has agreed to enter into a settlement with the Federal Trade Commission (“FTC”) regarding charges that the company deceived consumers by collecting contact information from users’ mobile address books without notice and consent.  The agreement also resolves charges that the company violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information from children under  13 years old without parental notice and consent.  Path did not admit any liability by entering into the consent decree, which is for settlement purposes only.

The FTC alleged that the Path application included an “Add Friends” feature that allowed users to make new connections within the app.  Users were given three options when using the “Add Friends” functionality:  “Find friends from your contacts,” “Find Friends from Facebook,” or “Invite friends to join Path by email or SMS.”  Regardless of which option was chosen, Path automatically collected and stored contact information from the address book on the user’s mobile phone.  The FTC argued that this practice was contrary to representations made in the company’s privacy policy that only certain technical information, such as IP address, browser type, and site activity information, was automatically collected from the user.  Under the settlement, Path agreed to implement a comprehensive privacy program and obtain biennial, independent privacy assessments for the next twenty years. 

In addition, the FTC alleged that Path violated COPPA, which governs the online collection, use, and disclosure of personal information from children under the age of 13.  During registration, Path asked users to provide their date of birth along with personal information, such as full name and email address.  According to the FTC, approximately 3,000 users gave an under-13 birth date, which provided Path actual knowledge that the user was a child.  The FTC claimed that for these users Path did not comply with COPPA’s requirements to provide parents notice, obtain parental consent, and explain its information handling practices with respect to children in an online privacy notice.  Path agreed to pay an $800,000 civil penalty to settle the COPPA charges.     

The Path settlement is one of several recent efforts to improve mobile app developers’ privacy practices, particularly in the area of children’s privacy.  On the same day that the Path settlement was announced, the FTC released new mobile app privacy guidelines.  These guidelines follow two FTC reports analyzing whether child-directed apps are providing adequate notice about their privacy practices, and the FTC has actively enforced COPPA against mobile app developers.  In addition to the FTC’s efforts, the Department of Commerce and State Attorneys General in California and New Jersey have been focused on mobile privacy issues as well.