California Attorney General Rob Bonta and Los Angeles City Attorney Hydee Feldstein Soto have announced a $500,000 settlement with Tilting Point Media LLC. The settlement resolves allegations that the company violated the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA) by collecting and sharing children’s data without parental consent through their mobile app game “SpongeBob: Krusty Cook-Off.”
In addition to paying civil penalties, Tilting Point must comply with injunctive terms ensuring legal data collection and disclosure practices. This includes obtaining parental consent and properly configuring third-party software in their mobile games.
“Businesses have a legal obligation to protect kids’ data and to comply with important state and federal privacy laws designed to protect children online. Failing to do this puts our kids at risk, leaving them vulnerable to having their personal data collected, tracked, and sold,” said Attorney General Bonta. “As children spend an increasing amount of time online, both on websites and using mobile apps, we will use every enforcement tool to ensure compliance with the law.”
“The ‘SpongeBob: Krusty Cook-Off’ game is based on some of the most beloved and recognizable characters in children’s entertainment. Tilting Point Media is alleged to have collected and shared its young players' personal data, violating consumer privacy laws,” said Hydee Feldstein Soto. “Protecting our children has been a top priority for my administration.”
The investigation was initiated by the Children’s Advertising Review Unit (CARU), which found that the privacy practices of the SpongeBob app did not comply with COPPA or CARU guidelines. Despite some corrective actions by Tilting Point, a joint investigation by the California Department of Justice and Los Angeles City Attorney’s Office concluded that Tilting Point continued to violate CCPA and COPPA regulations.
Tilting Point's age screen failed to ask age neutrally, leading children not to enter their correct age. Additionally, misconfigured third-party software development kits resulted in unauthorized data collection.
Tilting Point must now:
- Comply with CCPA and COPPA regarding children's data in all its games.
- Not sell or share personal information of users under 13 without parental consent.
- Provide clear notices about data collection practices when selling or sharing children's information.
- Use neutral age screens encouraging accurate age entry.
- Properly configure third-party SDKs according to legal requirements.
- Implement a governance framework for SDKs within its apps.
- Minimize data collection from children.
- Maintain a compliance program with annual reporting obligations.
Attorney General Bonta emphasized his commitment to enforcing COPPA and CCPA for children's online safety. This settlement represents his third enforcement action under CCPA.
In recent months, Attorney General Bonta has taken several actions related to online child protection:
- In March 2024, he joined a bipartisan letter proposing updates to COPPA regulations.
- In February 2024, he settled allegations against DoorDash for violating CCPA and COPPA.
- In January 2024, he introduced legislation aimed at protecting youth online alongside Assemblymember Buffy Wicks and Senator Nancy Skinner.
- In October 2023, he co-led a lawsuit against Meta Platforms for allegedly designing harmful features on Instagram and Facebook targeting children.
A copy of the complaint can be found here [link].