NY attorney general: Viacom, Mattel, Hasbro, and more violated online children’s protection act

My Little Pony’s motto is “friendship is magic.” In the real world, however, that motto translates to something like “private user data is money.”

Viacom, Mattel, Hasbro, and JumpStart — all companies that specialize in children’s toys and entertainment — have agreed to pay penalties relating to their violation of the privacy rights of minors, according to the office of New York attorney general Eric Schneiderman. The AG ran a two-year investigation called Operation Child Tracker that revealed the websites for popular brands like Barbie, Hot Wheels, NeoPets, and “dozens of others” employed software that could track the information of users who were under the age of 13. Under the Children’s Online Privacy Protection Act (COPPA), that type of data mining and sharing is illegal. And the NY AG claims it found clear evidence that the websites for these children’s properties were using games and other forms of entertainment to attract children who would then have their actions tracked and shared with third parties. Viacom, Mattel, Hasbro, and JumpStart have agreed to pay a combined fee of $835,000 as part of a settlement.

That penalty is only a minor scrape for a toy industry that was worth $84 billion worldwide in 2012. But the affected companies will likely lose out even more as the settlement requires them to abide by COPPA, which will create a void in revenues. Viacom, Hasbro, and the others were tracking the data of children to share with marketers and advertising firms that placed a high value on that kind of insight. Those companies no longer have the option to pay for that tracking info.

“Federal law demands that children are off-limits to the prying eyes of advertisers,” Attorney General Schneiderman said in a canned statement. “Operation Child Tracker revealed that some of our nation’s biggest companies failed to protect kids’ privacy and shield them from illegal online tracking. My office remains committed to protecting children online and will continue our investigation to hold accountable those who violate the law by tracking children.”

Tracking how people use the internet is a common practice that nearly every major website utilizes in some form as one part of generating revenue. Providing that data with marketers is crucial to profitability of most online organizations, and you likely agree to share your data anytime you click one of those warnings about “cookies” at the top of a page. But most websites have long agreed that 13 is the minimum age where tracking should begin, and COPPA officially cemented that best practice into law.

Under COPPA, the Federal Trade Commission and state attorneys general can all take action against companies who step over the line. In this case, the NY AG office worked closely with FTC Bureau of Consumer Protection director Jessica Rich on Operation Child Tracker. This helped surface the COPPA violations.

“These important settlement agreements are the latest illustration of just how important it is for businesses, parents, and policymakers to be more vigilant about protecting the online privacy of kids and to build in privacy by design,” Common Sense Media senior policy counsel Ariel Fox said in a statement. “We applaud Attorney General Schneiderman and the companies for working together to ensure these websites no longer enable the tracking or commercial profiling of kids and hope that the settlements will bring greater awareness about steps we should all take to make sure that the online world of children is educational, fun, and also safe.”

As part of the settlement, Viacom will pay $500,000, Mattel will pay $250,000, and JumpStart will pay $85,000. Hasbro is an FTC-approved “safe harbor” program, and it will not have to pay a penalty.