{ "topic": "coppa", "generated_at": "2026-03-27T00:38:02.816Z", "total_provisions": 417, "provisions": [ { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information (COPPA Compliance)", "category": "prohibition", "summary": "Defendants and all persons acting with them are permanently restrained from violating the COPPA Rule, including failing to provide direct parental notice, failing to post a privacy policy link, failing to obtain verifiable parental consent, and failing to maintain reasonable security procedures.", "verbatim_text": "1 A. Failing to make reasonable efforts, taking into account available technology, to ensure 2 that a parent of a child receives direct notice of Defendants’ practices with regard to the 3 collection, use, or disclosure of personal information, including notice of any material 4 change in the collection, use, or disclosure practices to which the parent has previously 5 consented;\n\nB. Failing to post a prominent and clearly labeled link to an online notice of its information 7 8 practices with regard to children, if any, on the home or landing page or screen of its Web 9 site or online service, and at each area of the Web site or online service where personal 10 information is collected;\n\nC. Failing to obtain verifiable parental consent before any collection, use, or disclosure of 12 personal information, including consent to any material change in the collection, use, or 13 disclosure practices to which the parent has previously consented; and\n\nD. Failing to establish and maintain reasonable procedures to protect the confidentiality, 15 16 security, and integrity of personal information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "II", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $650,000 is entered against Defendants jointly and severally, to be paid to the U.S. Treasury within 7 days of entry of the Order by electronic fund transfer.", "verbatim_text": "A. Judgement in the amount of six hundred fifty thousand dollars ($650,000) is entered in 22 favor of Plaintiff against Defendants, jointly and severally, as a civil penalty.\n\n24 B. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer of the 25 United States, six hundred fifty thousand dollars ($650,000), which, as Defendants 26 stipulate, their undersigned counsel holds in escrow for no purpose other than payment to 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 10 of 21 PageID #:47 1 Plaintiff. Such payment must be made within 7 days of entry of this Order by electronic 2 fund transfer in accordance with instructions previously provided by a representative of 3 Plaintiff.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "III", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to assets transferred under the Order; complaint facts may be used in future proceedings; and Defendants must submit their Taxpayer Identification Numbers to the Commission.", "verbatim_text": "A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all 7 8 assets transferred pursuant to this Order and may not seek the return of any assets.\n\n9 B. The facts alleged in the Complaint will be taken as true, without further proof, in any 10 subsequent civil litigation by or on behalf of the Commission in a proceeding to enforce 11 its rights to any payment or monetary judgement pursuant to this Order.\n\nC. The facts alleged in the Complaint establish all elements necessary to sustain an action by 13 the Commission pursuant to Section 523(a)(2)(A) of the Bankruptcy Code, 11 U.S.C. § 14 523(a)(2)(A), and this Order will have collateral estoppel effect for such purposes.\n\n16 D. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants 17 must submit to the Commission, may be used for collecting and reporting on any 18 delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "IV", "title": "Injunction Regarding Misrepresenting Data Security and Privacy Practices", "category": "prohibition", "summary": "Defendants are permanently restrained from misrepresenting, expressly or by implication, the extent to which they maintain and protect the privacy, confidentiality, security, or integrity of covered information, including their collection, use, disclosure, and deletion practices.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants, Defendants’ officers, agents, employees, 22 and attorneys, and all other persons in active concert or participation with any of them who 23 24 receive actual notice of this Order, whether acting directly or indirectly, are permanently 25 restrained and enjoined from misrepresenting, expressly or by implication, the extent to 26 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 11 of 21 PageID #:48 1 which they maintain and protect the privacy, confidentiality, security, or integrity of covered 2 information, including Defendants’ collection, use, disclosure, and deletion practices.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Prohibition" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "V", "title": "Comprehensive Data Security Program Requirement", "category": "affirmative_obligation", "summary": "Defendants must establish, implement, and maintain a comprehensive written information security program with administrative, technical, and physical safeguards, including designated personnel, risk assessments, safeguard controls, service provider oversight, and ongoing program evaluation.", "verbatim_text": "IT IS FURTHER ORDERED that Defendant must, no later than the date of service of 5 this Order, establish and implement, and thereafter maintain, a comprehensive information 6 security program that is reasonably designed to protect the security, confidentiality, and 7 8 integrity of personal information collected directly or indirectly by Defendants. The content, 9 implementation and maintenance of the program must be fully documented in writing. The 10 program must contain administrative, technical, and physical safeguards appropriate to 11 Defendants’ size and complexity, the nature and scope of Defendants’ activities, and the 12 sensitivity of the personal information, including:\n\nA. The designation of an employee or employees to coordinate and be responsible for the 14 information security program;\n\n16 B. The identification of internal and external risks to the security, confidentiality, or 17 integrity of personal information that could result in the unauthorized disclosure, misuse, 18 loss, alteration, destruction, or other compromise of such information, and assessment of 19 the sufficiency of any safeguards in place to control these risks. At a minimum, this risk 20 assessment must include consideration of risks in each area of relevant operation, 21 including: (1) employee training and management; (2) information systems, such as 22 network and software design, information processing, storage, transmission, and disposal; 23 24 and (3) prevention, detection, and response to attacks, intrusions, or other systems 25 failures;\n\n1 C. The design and implementation of reasonable safeguards to control these risks, and 2 regular testing or monitoring of the effectiveness of the safeguards’ key controls, 3 systems, and procedures;\n\nD. The development and use of reasonable steps to select and retain service providers 5 capable of appropriately safeguarding personal information they receive from 6 Defendants, and requiring service providers, by contract, to implement and maintain 7 8 appropriate safeguards; and\n\n9 E. The evaluation and adjustment of the information security program in light of the results 10 of the testing and monitoring required by sub-provision C, any changes to Defendants’ 11 operations or business arrangements, or any other circumstances that Defendants know or 12 have reason to know may have an impact on the effectiveness of the information security 13 program.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "VI", "title": "Data Security Program Assessment Requirement", "category": "assessment", "summary": "Defendants must obtain initial and biennial third-party assessments of their information security program from a qualified independent professional (CISSP, CISA, or GIAC), covering specified periods, with each assessment certifying the program's effectiveness; the initial assessment must be submitted to the FTC within 10 days of completion.", "verbatim_text": "A. The Assessments must be obtained from a qualified, objective, independent third-party 20 professional, who uses procedures and standards generally accepted in the profession. A 21 professional qualified to prepare such Assessments must be: an individual qualified as a 22 Certified Information System Security Professional (CISSP) or as a Certified Information 23 24 Systems Auditor (CISA); an individual holding Global Information Assurance 25 Certification (GIAC) from the SANS Institute; or a qualified individual or entity 26 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 13 of 21 PageID #:50 1 approved by the Associate Director for Enforcement, Bureau of Consumer Protection, 2 Federal Trade Commission.\n\nB. The reporting period for the Assessments must cover: (1) the first 180 days after the 4 issuance date of the Order for the initial Assessment, and (2) each 2-year period 5 thereafter for 20 years after issuance of the Order for the biennial Assessments.\n\nC. Each Assessment must: 7 8 a. Set forth the specific administrative, technical, and physical safeguards that 9 Defendants have implemented and maintained during the reporting period; 10 b. Explain how such safeguards are appropriate to Defendants’ size and complexity, 11 the nature and scope of Defendants’ activities, and the sensitivity of the personal 12 information collected; 13 c. Explain how the safeguards that have been implemented meet or exceed the 14 protections required by the Provision of this Order titled Comprehensive Data 15 16 Security Program Requirement; and 17 d. Certify that the security program is operating with sufficient effectiveness to 18 provide reasonable assurance that the security, confidentiality, and integrity of 19 personal information is protected and has so operated throughout the reporting 20 period.\n\nD. Each Assessment must be completed within 60 days after the end of the reporting period 22 to which the Assessment applies. Defendants must submit the initial Assessment to the 23 24 Commission within 10 days after the Assessment has been completed. Defendants must 25 retain all subsequent biennial Assessments, at least until the Order terminates. 26 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 14 of 21 PageID #:51 1 Defendants must submit any biennial Assessments to the Commission within 10 days of a 2 request from a representative of the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "VII", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt of the Order within 7 days; deliver copies of the Order to principals, officers, managers, and relevant employees within 7 days (and to future personnel before they assume responsibilities) for 5 years; and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "A. Each Defendant, within 7 days of entry of this Order, must submit to the Commission an 7 8 acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n9 B. For five (5) years after entry of this Order, Defendants must deliver a copy of this Order 10 to: (1) all principals, officers, directors, and managers and members; (2) all employees, 11 agents, and representatives having management responsibilities related to subject matter 12 covered by this Order; and (3) any business entity resulting from any change in structure 13 as set forth in the Part titled Compliance Reporting. Delivery must occur within seven 14 (7) days of entry of this Order for current personnel. For all others, delivery must occur 15 16 before they assume their responsibilities.\n\n17 C. From each individual or entity to which a Defendant delivered a copy of this Order, that 18 Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of 19 this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Order Administration" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "VIII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Each Defendant must submit a sworn annual compliance report one year after entry of the Order covering contact information, business activities, compliance status, privacy notices, parental consent methods, and security procedures; must submit compliance notices within 14 days of structural or contact changes for 10 years; and must notify the Commission of any bankruptcy filing within 14 days.", "verbatim_text": "24 A. One year after entry of this Order, each Defendant must submit a compliance report, 25 sworn under penalty of perjury. Each Defendant must: 26 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 15 of 21 PageID #:52 1 1. Identify the primary physical, postal, and email address and telephone number, as 2 designated points of contact, which representatives of the Commission and 3 Plaintiff may use to communicate with Defendant; 4 2. Identify all of that Defendant’s businesses by all of their names, telephone 5 numbers, and physical, postal, email, and Internet addresses; 6 3. Describe the activities of each business, including the goods and services offered, 7 8 the means of advertising, marketing, and sales, and involvement of any other 9 Defendant; 10 4. Describe in detail whether and how that Defendant is in compliance with each 11 section of this Order; 12 5. Provide a copy of each different version of any privacy notice posted on each 13 Web site or online service operated by that Defendant that is directed to children 14 or otherwise communicated to parents of children from whom that Defendant 15 16 collects personal information; 17 6. Provide a statement setting forth in detail any methods used to obtain verifiable 18 parental consent prior to any collection, use, and/or disclosure of personal 19 information or the methods used to avoid collecting, using, and/or disclosing 20 personal information; 21 7. Provide a statement setting forth in detail the means provided for parents to 22 review any personal information collected and to refuse to permit its further use 23 24 or maintenance; 25 8. Provide a statement setting forth in detail the procedures used to protect the 26 confidentiality, security, and integrity of personal information collected; and 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 16 of 21 PageID #:53 1 9. Provide a copy of each Order Acknowledgment obtained pursuant to this Order, 2 unless previously submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, each Defendant must submit a compliance 4 notice, sworn under penalty of perjury, within 14 days of any change in: (a) any 5 designated point of contact; or (b) the structure of any Defendant or any entity that 6 Defendant has any ownership interest in or controls directly or indirectly that may affect 7 8 compliance obligations arising under this Order including: creation, merger, sale, or 9 dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or 10 practices subject to this Order.\n\nC. Each Defendant must submit to the Commission notice of the filing of any bankruptcy 12 petition, insolvency proceeding, or similar proceeding by or against such Defendant 13 within 14 days of its filing.\n\nD. Any submission to the Commission required by this Order to be sworn under penalty of 15 16 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 17 concluding: “I declare under penalty of perjury under the laws of the United States of 18 America that the foregoing is true and correct. Executed on: _______” and supplying the 19 date, signatory’s full name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all submissions to 21 the Commission pursuant to this Order must be emailed to Debrief@ftc.gov or sent by 22 overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 23 24 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 25 NW, Washington, DC 20580. The subject line must begin: United States v. VTech 26 Electronics Limited.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "IX", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create certain records for 10 years after entry of the Order and retain each such record for 5 years, including all compliance records and submissions, consumer complaints relating to covered information collection, and copies of each materially different form or page through which covered information is collected.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants must create certain records for ten (10) 3 years after entry of this Order, and retain each such record for five (5) years. Specifically, 4 Defendants must create and retain the following records: 5 A. All records necessary to demonstrate full compliance with each provision of this Order, 6 including all submissions to the Commission;\n\n8 B. Copies of all consumer complaints relating to Defendants’ collection of covered 9 information, and any response; and\n\nC. A copy of each materially different form, page, or screen created, maintained, or 11 otherwise provided by Defendants through which covered information is collected, and a 12 copy of each materially different document containing any representation regarding 13 collection, use, and disclosure practices pertaining to covered information. Each 14 webpage copy shall be accompanied by the URL of the webpage where the material was 15 16 posted online. Electronic copies shall include all text and graphics files, audio scripts, 17 and other computer files used in presenting information on the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Recordkeeping" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "X", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through written requests for reports and documents (responded to within 14 days), depositions, direct communications with Defendants and their employees, and undercover methods; the Commission's compulsory process authority is preserved.", "verbatim_text": "A. Within fourteen (14) days of receipt of a written request from a representative of the 22 Commission or Plaintiff, each Defendant must: submit additional compliance reports or 23 24 other requested information, which must be sworn under penalty of perjury; appear for 25 depositions; and produce documents for inspection and copying. The Commission and 26 Plaintiff are also authorized to obtain discovery, without further leave of court, using any 27 28 Case: 1:18-cv-00114 Document #: 2-1 Filed: 01/08/18 Page 18 of 21 PageID #:55 1 procedure prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic 2 depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to 4 communicate directly with each Defendant. Defendants must permit representatives of 5 the Commission and Plaintiff to interview any employee or other person affiliated with 6 Defendants who has agreed to such an interview. The person interviewed may have 7 8 counsel present.\n\n9 C. The Commission and Plaintiff may use all other lawful means, including posing, through 10 its representatives as consumers, suppliers, or other individuals or entities, to Defendants 11 or any individual or entity affiliated with Defendants, without the necessity of 12 identification or prior notice. Nothing in this Order limits the Commission’s lawful use 13 of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 14 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "XI", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "17 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 18 purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Order Administration" ], "case_id": "01.18_vtech_electronics_limited", "company_name": "VTech Electronics Limited and VTech Electronics North America, LLC", "date_issued": "2018-01-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act (15 U.S.C. § 45(a)); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6502(c) and 6505(d)); Children's Online Privacy Protection Rule (16 C.F.R. Part 312)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3032-vtech-electronics-limited", "docket_number": "1:18-cv-00114" }, { "provision_number": "I", "title": "Ban on Sales to Children and Early Teens Without a Parent's Affirmative Express Consent", "category": "prohibition", "summary": "Within six months of the Effective Date, Defendants are permanently enjoined from allowing accounts associated with Children or Early Teens to spend fiat currency or cryptocurrency in-game without first obtaining Affirmative Express Consent from a parent, following Clear and Conspicuous disclosure of key material terms.", "verbatim_text": "2255 IT IS ORDERED that no later than six (6) months after the Effective Date, 2266 Defendants, Defendants’ officers, agents, employees, and all other Persons in 2277 active concert or participation with any of them, who receive actual notice of this 2288 -10- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 11 of 26 Page ID #:51 11 Order, whether acting directly or indirectly, in connection with the advertising, 22 marketing, promoting, offering for sale, or selling of any virtual currency or digital 33 content or merchandise are permanently restrained and enjoined from allowing 44 accounts associated with a Child or Early Teen user to spend fiat currency or 55 cryptocurrency in game without first obtaining the Affirmative Express Consent 66 from a Parent of that Child or Early Teen authorizing the Child or Early Teen’s 77 account to engage in fiat currency or cryptocurrency transactions. Prior to 88 obtaining the Affirmative Express Consent from a Parent of that Child or Early 99 Teen, Defendants must Clearly and Conspicuously disclose to the Parent:\n\n1100 A. The material aspects of the nature and terms of the video game;\n\n1111 B. The presence and use of paid virtual currency in order to purchase 1122 digital content or merchandise, including via a Covered Mechanism; and\n\n1133 C. The material aspects of the nature and terms of any Covered 1144 Mechanism including: 1155 1. That obtaining items of digital content or merchandise are 1166 determined by chance, require multiple purchases or attempts to 1177 purchase to guarantee receipt of a specified item, or both; 1188 2. The likelihood that a consumer will obtain particular digital 1199 content or merchandise; and 2200 3. The range of potential total costs in U.S. dollars, or applicable 2211 fiat currency, if a user used only fiat currency to acquire featured 2222 content.\n\n11 action, following a Clear and Conspicuous disclosure of items A to C listed above 22 under this Section. The following do not constitute Affirmative Express Consent: 33 1. Inferring consent from a consumer hovering over, muting, 44 pausing, closing, or otherwise failing to act on a given piece of 55 content; or 66 2. Obtaining consent through a user interface that has the effect of 77 subverting or impairing user autonomy, decision-making, or choice.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "II", "title": "Ban Against Sales of Chances via Covered Mechanism Without a Fiat Currency Direct Purchase Option", "category": "prohibition", "summary": "Within six months of the Effective Date, Defendants are permanently enjoined from offering Covered Mechanism transactions without also providing consumers a direct fiat currency purchase option, presented at the same time and clearly indicating the cost.", "verbatim_text": "1122 IT IS FURTHER ORDERED that no later than six (6) months after the 1133 Effective Date, Defendants, Defendants’ officers, agents, employees, and all other 1144 Persons in active concert or participation with any of them, who receive actual 1155 notice of this Order, whether acting directly or indirectly, in connection with the 1166 advertising, marketing, promoting, offering for sale, or selling of any digital 1177 content or merchandise via a Covered Mechanism, are permanently restrained and 1188 enjoined from failing to provide consumers a means to directly purchase with fiat 1199 currency a chance to obtain digital content or merchandise via a Covered 2200 Mechanism, without requiring consumers to purchase or exchange virtual 2211 currency. The means to purchase directly must be provided at the same time a 2222 Covered Mechanism is offered and must clearly indicate the cost to purchase using 2233 fiat currency.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "III", "title": "Prohibition Against Misrepresentations", "category": "prohibition", "summary": "Defendants are permanently enjoined from making express or implied misrepresentations about Covered Mechanisms, the likelihood of obtaining digital content, costs, or any other material fact concerning any Covered Product or Service.", "verbatim_text": "11 in connection with the advertising, marketing, promoting, offering for sale, or 22 selling of any Covered Product or Service, are permanently restrained and enjoined 33 from misrepresenting, expressly or by implication: 44 A. The in-game content offered via a Covered Mechanism;\n\n55 B. The likelihood that a consumer will obtain any particular digital 66 content, such as a playable character or digital item, by purchasing a chance to obtain 77 the content via a Covered Mechanism;\n\n88 C. The likelihood that a consumer will win a reward or advantage by 99 participating in any promotional offering or sale of any in-game content, such as a 1100 weapon or character;\n\n1111 D. The range of potential total cost in U.S. dollars, or applicable fiat 1122 currency, if a user used only fiat currency to acquire featured content via a Covered 1133 Mechanism;\n\n1144 E. The material aspects of the nature or terms of any Covered Mechanism; 1155 or\n\n1166 F. Any other fact material to consumers concerning any Covered Product 1177 or Service.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "IV", "title": "Required Disclosures for Covered Mechanisms and Multi-Tiered Virtual Currency", "category": "affirmative_obligation", "summary": "Within six months of the Effective Date, Defendants must clearly and conspicuously disclose odds and costs at points of sale for Covered Mechanisms, disclose virtual currency bundle details, and maintain an online notice on their website and game login screen with complete odds and cost information.", "verbatim_text": "11 A. Within Defendants’ video games wherever Defendants offer or make 22 available digital content or merchandise via a Covered Mechanism, Defendants must 33 Clearly and Conspicuously disclose, without requiring any additional input from the 44 consumer: 55 1. The likelihood a consumer will obtain any digital content or 66 merchandise prominently featured or depicted at the point of sale via a 77 Covered Mechanism, or in the promotion of digital content or 88 merchandise accessible by a Covered Mechanism, placed in Close 99 Proximity to the digital content or merchandise featured or depicted;\n\n1111 2. The range of potential total costs in U.S. dollars, or applicable 1122 fiat currency, if the user used only fiat currency to acquire featured 1133 digital content or merchandise via a Covered Mechanism.\n\n1144 B. At any point of sale at which Defendants make any bundle or package 1155 of virtual currency available for purchase within Defendants’ video games, 1166 Defendants must Clearly and Conspicuously disclose, without requiring any 1177 additional input from the consumer: 1188 1. The number of transactions that the bundle or package of virtual 1199 currency provides the consumer to obtain digital content or 2200 merchandise via a Covered Mechanism (such as a “Fate” in Genshin 2211 Impact’s Wish System); and\n\n2222 2. The rate of exchange in U.S. dollars or appliable fiat currency of 2233 that virtual currency for one transaction with a Covered Mechanism.\n\n2244 C. Defendants shall make easily accessible on their website and at the 2255 game login screen, an online notice containing the following information concerning 2266 the Covered Mechanisms made available within Defendants’ video games or online 2277 services: 2288 -14- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 15 of 26 Page ID #:55 11 1. Each possible featured in-game item that a consumer may 22 obtain via a Covered Mechanism, and for each featured in-game item 33 so identified, the likelihood that, the consumer will obtain that 44 featured item; and 55 2. The range of potential total costs in U.S. dollars, or applicable 66 fiat currency, if the user used only fiat currency to acquire featured in- 77 game items via a Covered Mechanism.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "V", "title": "Injunction Concerning the Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently enjoined from violating COPPA, including failing to post required privacy notices, failing to provide direct notice to parents, and failing to obtain verifiable parental consent before collecting, using, or disclosing children's personal information.", "verbatim_text": "1177 A. Failing to post a prominent and clearly labeled link to an online notice 1188 of the Operator’s information practices with regard to Children, if any, on the home 1199 or landing page or screen of its website or online service, and at each area of the 2200 website or online service where Personal Information is Collected from Children, 2211 unless the COPPA Rule (attached as Appendix A or as subsequently amended), 2222 provides an exception to providing such notice;\n\n2233 B. Failing to make reasonable efforts, taking into account available 2244 technology, to ensure that a Parent of a Child receives direct notice of the 2255 Operator’s practices with regard to the Collection, use, or Disclosure of Personal 2266 Information from Children, including notice of any material change in the 2277 Collection, use, or Disclosure practices to which the Parent has previously 2288 -15- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 16 of 26 Page ID #:56 11 consented, unless the COPPA Rule (attached as Appendix A or as subsequently 22 amended), provides an exception to providing such notice;\n\n33 C. Failing to Obtain Verifiable Parental Consent before any Collection, 44 use, or Disclosure of Personal Information from Children, including consent to any 55 material change in the Collection, use, or Disclosure practices to which the Parent 66 has previously consented, unless the COPPA Rule (attached as Appendix A or as 77 subsequently amended), provides an exception to Obtaining Verifiable Parental 88 Consent; and\n\n99 D. Violating the COPPA Rule (attached as Appendix A or as 1100 subsequently amended).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "VI", "title": "Injunction Concerning Children's Personal Information Previously Collected", "category": "affirmative_obligation", "summary": "Defendants must implement a neutral age gate within 120 days and delete personal information of users who do not provide age confirmation; suspend data activities for unidentified users after 180 days; delete all unidentified user data within one year of the Account Suspension Date; and submit sworn written statements to the Commission confirming compliance.", "verbatim_text": "1177 A. No later than one hundred and twenty (120) days after the Effective 1188 Date, implement a neutral age gate to request the user to provide age information 1199 and identify the user’s age. Defendants shall Delete all Personal Information that 2200 is associated with any user of Genshin Impact or HoYoLAB in the United States, 2211 unless: 2222 1. The user has provided age information through a neutral age 2233 gate identifying the user as age 13 or older; or 2244 2. Defendants have provided direct notice and Obtained Verifiable 2255 Parental Consent;\n\n2266 B. If the age of a particular user of an existing account is not identified 2277 2288 -16- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 17 of 26 Page ID #:57 11 within one hundred and eighty (180) days after the Effective Date (the “Account 22 Suspension Date”), Defendants shall (1) notify such user, if email address is 33 available, that their Personal Information will be deleted if they do not provide age 44 information, (2) refrain from Collecting Personal Information from that account, 55 and (3) refrain from Disclosing or using Personal Information Collected from that 66 account, except for the use of persistent identifiers to Support the Internal 77 Operations, until and unless the age of user is identified, at which point Defendants 88 shall comply with sub-Provision VI.A. If the age of a particular user of an existing\n\n99 account is still not identified within one (1) year of the Account Suspension Date, 1100 Defendants shall Delete all Personal Information Collected from that account.\n\n1111 C. Within one (1) year and one (1) month of the Account Suspension 1122 Date, provide a written statement to the Commission, sworn under penalty of 1133 perjury, that: 1144 1. Describes all processes through which Defendants provided 1155 direct notice and sought to Obtain Verifiable Parent Consent for any 1166 accounts covered by this Provision VI; 1177 2. Identifies the total number of accounts for which (i) direct notice 1188 was provided; (ii) Defendants Obtained Verifiable Parental Consent; 1199 (iii) verifiable parental consent was affirmatively declined; and (iv) no 2200 response was provided; 2211 3. Identifies the total number of accounts for which (i) the age of 2222 the user is not identified as covered by sub-Provision VI.B; and (ii) for 2233 which the Personal Information Collected from the user was deleted 2244 when the age of the user was not identified within one (1) year of the 2255 Account Suspension Date, as covered by sub-Provision VI.B. 2266 4. Describes in detail any Personal Information Defendants retain 2277 in accordance with sub-Provisions VI.D or VI.E, the basis for such 2288 -17- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 18 of 26 Page ID #:58 11 retention, and, as applicable, the specific government agency, law, 22 regulation, or court order that requires such retention; and 33 5. Confirms that all Personal Information required to be Deleted by 44 this Provision VI has been Deleted.\n\n66 D. Persistent Identifiers that Defendants are otherwise required to Delete 77 by this Provision VI need not be Deleted to the extent they are used solely for 88 Support for the Internal Operations of Genshin Impact and/or HoYoLAB; and\n\n99 E. Personal Information that Defendants are otherwise required to Delete 1100 by this Provision VI may be retained, and may be disclosed, as requested by a 1111 government agency or required by law, regulation, or court order. Within thirty (30) 1122 days after the obligation to retain any such Personal Information has ended, 1133 Defendants shall Delete such Personal Information and provide an additional written 1144 statement to the Commission, sworn under penalty of perjury, confirming that 1155 Defendants have deleted such Personal Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "VII", "title": "Monetary Judgments", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $20,000,000 is entered jointly and severally against Defendants, payable to the U.S. Treasury within 14 days of entry of the Order by electronic fund transfer.", "verbatim_text": "1188 A. Judgment in the amount of Twenty Million Dollars ($20,000,000) is 1199 entered in favor of Plaintiff against Defendants, jointly and severally, as a civil 2200 penalty.\n\n2211 B. Defendants are ordered to pay to Plaintiff, by making payment to the 2222 Treasurer of the United States, Twenty Million Dollars ($20,000,000) which, as 2233 Defendants stipulate, their undersigned counsel holds in escrow for no purpose other 2244 than payment to Plaintiff. Such payment must be made within fourteen (14) days of 2255 entry of this Order by electronic fund transfer in accordance with instructions 2266 provided by a representative of Plaintiff.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "VIII", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to assets transferred under the Order, facts in the Complaint may be taken as true in subsequent civil litigation, and Defendants must submit their Taxpayer Identification Numbers to the Commission.", "verbatim_text": "33 A. Defendants relinquish dominion and all legal and equitable right, title, 44 and interest in all assets transferred pursuant to this Order and may not seek the 55 return of any assets.\n\n66 B. The facts alleged in the Complaint will be taken as true, without 77 further proof, in any subsequent civil litigation by or on behalf of the Commission 88 including in a proceeding to enforce its rights to any payment or monetary 99 judgment pursuant to this Order, such as a nondischargeability complaint in any 1100 bankruptcy case.\n\n1111 C. Defendants acknowledge that their Taxpayer Identification Numbers 1122 (Social Security Numbers or Employer Identification Numbers), which Defendants 1133 must submit to the Commission, may be used for collecting and reporting on any 1144 delinquent amount arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Consumer Redress" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "IX", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt of the Order within 10 days, deliver copies of the Order to key personnel within 10 days (and to new personnel before they assume responsibilities), and obtain signed acknowledgments from all recipients within 30 days of delivery.", "verbatim_text": "1188 A. Each Defendant, within ten (10) days of entry of this Order, must 1199 submit to the Commission an acknowledgment of receipt of this Order, sworn 2200 under penalty of perjury.\n\n2211 B. For five (5) years after entry of this Order, each Defendant must 2222 deliver a copy of this Order to: (1) all principals, officers, directors, and LLC 2233 managers and members; (2) all employees, agents, and representatives having 2244 managerial responsibilities for conduct related to the subject matter of the Order; 2255 (3) all Persons who are paid or otherwise compensated to promote any product or 2266 service offered by Defendants; and (4) any business entity resulting from any 2277 change in structure as set forth in the Provision titled Compliance Reporting. 2288 -19- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 20 of 26 Page ID #:60 11 Delivery must occur within ten (10) days of entry of this Order for current 22 personnel. For all others, delivery must occur before they assume their 33 responsibilities.\n\n44 C. From each individual or entity to which a Defendant delivered a copy 55 of this Order, that Defendant must obtain, within thirty (30) days, a signed and 66 dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Order Administration" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "X", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Each Defendant must submit a sworn compliance report one year after entry of the Order covering contact information, business details, Covered Products/Services, and compliance status; provide sworn compliance notices within 14 days of any structural or contact changes for 10 years; notify the Commission of any bankruptcy filing within 14 days; and submit all required materials to the Commission by email or overnight courier.", "verbatim_text": "1100 A. One (1) year after entry of this Order, each Defendant must submit a 1111 compliance report, sworn under penalty of perjury: 1122 1. Each Defendant must: (a) identify the primary physical, postal, 1133 and email address and telephone number, as designated points of 1144 contact, which representatives of the Commission and Plaintiff may 1155 use to communicate with that Defendant; (b) identify all of that 1166 Defendant’s businesses by all of their names, telephone numbers, and 1177 physical, postal, email, and Internet addresses; (c) describe each 1188 Covered Product or Service, including the means of advertising, 1199 marketing, and sales and the nature, terms, and use of any Covered 2200 Mechanisms; (d) describe in detail whether and how that Defendant is 2211 in compliance with each provision of this Order; and (e) provide a 2222 copy of each Order Acknowledgment obtained pursuant to this Order, 2233 unless previously submitted to the Commission.\n\n2244 B. For ten (10) years after entry of this Order, each Defendant must 2255 submit a compliance notice, sworn under penalty of perjury, within 14 days of any 2266 change in the following: 2277 2288 -20- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 21 of 26 Page ID #:61 11 1. Each Defendant must report any change in: (a) any designated 22 point of contact; or (b) the structure of any Defendant or any entity 33 that Defendant has any ownership interest in or controls directly or 44 indirectly that may affect compliance obligations arising under this 55 Order, including: creation, merger, sale, or dissolution of the entity or 66 any subsidiary, parent, or affiliate that engages in any acts or practices 77 subject to this Order.\n\n88 C. Each Defendant must submit to the Commission notice of the filing of 99 any bankruptcy petition, insolvency proceeding, or similar proceeding by or 1100 against such Defendant within fourteen (14) days of its filing.\n\n1111 D. Any submission to the Commission required by this Order to be 1122 sworn under penalty of perjury must be true and accurate and comply with 28 1133 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under 1144 the laws of the United States of America that the foregoing is true and correct. 1155 Executed on: _____” and supplying the date, signatory’s full name, title (if 1166 applicable), and signature.\n\n1177 E. Unless otherwise directed by a Commission representative in writing, 1188 all submissions to the Commission pursuant to this Order must be emailed to 1199 DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 2200 Associate Director for Enforcement, Bureau of Consumer Protection, Federal 2211 Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The 2222 subject line must begin: “United States v. Cognosphere, LLC et al., FTC File No. 2233 2223152.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "XI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Each Defendant must create specified records for 10 years after entry of the Order and retain each record for 5 years, covering accounting revenues, personnel records, consumer complaints and refund requests, and all records necessary to demonstrate full compliance.", "verbatim_text": "2255 IT IS FURTHER ORDERED that each Defendant must create certain records 2266 for ten (10) years after entry of the Order, and retain each such record for five (5) 2277 years. Specifically, each Defendant must create and retain the following records: 2288 -21- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 22 of 26 Page ID #:62 11 A. Accounting records showing the revenues from each Covered Product 22 or Service;\n\n33 B. Personnel records showing, for each Person providing services in 44 connection with any Covered Product or Service, whether as an employee or 55 otherwise, that Person’s: name; addresses; telephone numbers; job title or 66 position; dates of service; and (if applicable) the reason for termination.\n\n77 C. Copies or records of all consumer complaints and refund requests 88 concerning the subject matter of the Order, whether received directly or through any 99 U.S. federal or state government regulatory authority; and\n\n1100 D. All records necessary to demonstrate full compliance with each 1111 provision of this Order, including all submissions to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Recordkeeping" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "XII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance by requesting additional reports, conducting depositions and discovery, communicating directly with Defendants and their personnel, and using undercover methods, all without further leave of court.", "verbatim_text": "1155 A. Within fourteen (14) days of receipt of a written request from a 1166 representative of the Commission or Plaintiff, each Defendant must: submit 1177 additional compliance reports or other requested information, which must be sworn 1188 under penalty of perjury; appear for depositions, and produce documents for 1199 inspection and copying. The Commission and Plaintiff are also authorized to 2200 obtain discovery, without further leave of court, using any of the procedures 2211 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic 2222 depositions), 31, 33, 34, 36, 45, and 69, provided that Defendants, after attempting 2233 to resolve a dispute without court action and for good cause shown, may file a 2244 motion with this Court seeking an order for one or more of the protections set forth 2255 in Rule 26(c).\n\n2266 B. For matters concerning this Order, the Commission and Plaintiff are 2277 authorized to communicate directly with each Defendant. Defendants must permit 2288 -22- Case 2:25-cv-00447 Document 3 Filed 01/17/25 Page 23 of 26 Page ID #:63 11 representatives of the Commission and Plaintiff to interview any employee or other 22 Person affiliated with any Defendant who has agreed to such an interview. The 33 Person may have counsel present.\n\n44 C. The Commission and Plaintiff may use all other lawful means, 55 including posing, through its representatives as consumers, suppliers, or other 66 individuals or entities, to Defendants or any individual or entity affiliated with 77 Defendants, without the necessity of identification or prior notice. Nothing in this 88 Order limits the Commission’s lawful use of compulsory process, pursuant to 99 Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "XIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "1111 IT IS FURTHER ORDERED that this Court retains jurisdiction of this 1122 matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Order Administration" ], "case_id": "01.25_cognosphere", "company_name": "COGNOSPHERE, LLC", "date_issued": "2025-01-15", "year": 2025, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c), 6505(d); and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. pt. 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3152-cognosphere-llc-us-v", "docket_number": "2:25-cv-447" }, { "provision_number": "6", "title": "Injunction Against COPPA Rule Violations", "category": "prohibition", "summary": "Defendant and all persons acting in concert with it are enjoined from violating any provision of the COPPA Rule.", "verbatim_text": "13 6. Defendant, and all persons in active concert or participation with any one or 14 more of them who receive actual notice of this Consent Decree by personal service or 15 otherwise, are hereby enjoined, directly or through any corporation, subsidiary, division, 16 website, or other device, from violating any provision of the Rule. A copy of the current Rule 17 is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.\n\n18 7. In the event the Rule is hereafter amended or modified, defendant’s compliance 19 with that Rule so amended or modified shall not be deemed a violation of this injunction.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "8", "title": "Prohibition Against Misrepresentations About Children's Personal Information", "category": "prohibition", "summary": "Defendant is enjoined from making any misrepresentation in a website's privacy policy or elsewhere about the collection, use, or disclosure of personal information of a child.", "verbatim_text": "20 8. Defendant, and all persons in active concert or participation with any one or 21 more of them who receive actual notice of this Consent Decree by personal service or 22 otherwise, are hereby enjoined, in connection with the operation of any website or online 23 service, from making any misrepresentation in the website’s privacy policy or elsewhere about 24 the website’s collection, use, or disclosure of personal information of a child.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "9", "title": "Consumer Education Remedy — FTC KidzPrivacy Notice", "category": "affirmative_obligation", "summary": "For five years, defendant must post a clear and conspicuous FTC KidzPrivacy notice (with hyperlink) in its privacy policy, in direct notices to parents, and at each location where personal information is collected on any child-directed website.", "verbatim_text": "26 9. For a period of five (5) years from the date of entry of this Consent Decree, 27 defendant, and its successors and assigns, in connection with the operation of any website or 28 other online service directed in whole or in part to children, shall place a clear and conspicuous CONSENT DECREE Page 2 of 9 1 notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) 2 of the Rule, 16 C.F.R. § 312.4(b); (2) within the direct notice required to be sent to parents by 3 Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its website(s) 4 where personal information is collected, which states as follows in bold typeface: 5 NOTICE: Visit www.ftc.gov/kidzprivacy for information from the Federal 6 Trade Commission about protecting children’s privacy online. 7 Where the above notice is posted on a website or delivered via email or other electronic service, 8 it shall be in the form of a hyperlink to www.ftc.gov/kidzprivacy. The Federal Trade 9 Commission may change the hyperlink/URL upon thirty (30) days prior written notice to 10 defendant, its successors or assigns.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "10", "title": "Civil Penalty — Payment of $10,000", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $10,000 to the United States pursuant to the FTC Act.", "verbatim_text": "12 10. Defendant, and its successors and assigns, shall pay to plaintiff a civil penalty, 13 pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. 14 § 45(m)(1)(A), in the amount of ten thousand dollars ($10,000).\n\n15 11. Defendant shall make the payment required by Paragraph 10 on the date of entry 16 of this Consent Decree by certified or cashier’s check made payable to the Treasurer of the 17 United States and delivered to: The Office of Consumer Litigation, Civil Division, U.S. 18 Department of Justice, Washington, D.C. 20530, for appropriate disposition.\n\n19 12. In the event of any default in payment, which default continues for ten (10) days 20 beyond the due date of payment, the entire unpaid penalty, together with interest, as computed 21 pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately 22 become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "13", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected from children through the Kids Club portion of www.jollytime.com from April 21, 2000 through the date of entry of this Consent Decree.", "verbatim_text": "24 13. Defendant, and its successors and assigns, shall delete all personal information 25 collected from every child through the Kids Club portion of www.jollytime.com at any time 26 from April 21, 2000 through the date of entry of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "14", "title": "Distribution of Consent Decree and Compliance Guide to Current Personnel", "category": "acknowledgment", "summary": "Within 30 days of entry, defendant must provide a copy of the Consent Decree and the FTC compliance guide to all current principals, officers, directors, managers, and relevant employees, and obtain signed acknowledgments; defendant must then submit a signed statement to the Commission within 10 days of completing this.", "verbatim_text": "27 14. Defendant, and its successors and assigns, within thirty (30) days from the date 28 of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal CONSENT DECREE Page 3 of 9 1 Trade Commission compliance guide entitled How to Comply with the Children’s Online 2 Privacy Protection Rule (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) 3 to each of its current principals, officers, directors, and managers, and to all current employees, 4 agents, and representatives having responsibilities related to the operation of any website or 5 online service subject to this Consent Decree, and secure from each such person a signed 6 statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, 7 and shall, within ten (10) days of complying with this paragraph, submit to the Commission a 8 signed statement setting forth the fact and manner of defendant’s compliance, including the 9 name and title of each person to whom a copy of the Consent Decree and compliance guide has 10 been provided. For the purposes of complying with this Paragraph, defendant shall be 11 permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 10 above) from 12 the copy of the Consent Decree provided to any such person.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "15", "title": "Distribution of Consent Decree and Compliance Guide to Future Personnel", "category": "acknowledgment", "summary": "For five years, defendant must provide the Consent Decree and compliance guide to all future principals, officers, directors, managers, and relevant employees within 30 days of them assuming their positions, secure signed dated acknowledgments, and maintain copies for FTC inspection upon request.", "verbatim_text": "13 15. For a period of five (5) years from the date of entry of this Consent Decree, 14 defendant, and its successors and assigns, shall provide a copy of this Consent Decree and the 15 compliance guide to each of its future principals, officers, directors, and managers, and to all 16 future employees, agents, and representatives having responsibilities related to the operation of 17 any website or online service subject to this Consent Decree, and secure from each such person 18 a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the 19 compliance guide, within thirty (30) days after the person assumes such position or 20 responsibilities. Defendant shall maintain copies of the signed statements, as well as other 21 information regarding the fact and manner of its compliance, including the name and title of 22 each person to whom a copy of the Consent Decree and compliance guide has been provided 23 and, upon request, shall make the statements and other information available to the Federal 24 Trade Commission. For the purposes of complying with this Paragraph, defendant shall be 25 permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 10 above) from 26 the copy of the Consent Decree provided to any such person.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "16", "title": "Compliance Reporting to Commission", "category": "compliance_reporting", "summary": "Within 60 days of entry, and at such other times as the FTC requires, defendant must file a detailed written compliance report with the Commission covering its Kids Club registration process, privacy notices, parental notices, consent methods, parental review mechanisms, necessity of data collected, and data security procedures.", "verbatim_text": "27 16. Within sixty (60) days after entry of this Consent Decree, and at such other times 28 as the Federal Trade Commission may require, defendant, and its successors and assigns, shall CONSENT DECREE Page 4 of 9 1 file with the Commission a written report, setting forth in detail the manner and form in which 2 it has complied and is complying with this Consent Decree. This report shall include but not be 3 limited to: 4 a. a statement setting forth in detail the process by which 5 www.jollytime.com registers visitors to its “Kids Club,” and a copy of 6 each different screen or page providing or collecting registration 7 information; 8 b. a copy of each different privacy notice on the website; 9 c. a statement setting forth in detail each place where the privacy notice on 10 the website is located and a copy of each screen or page on which the 11 website collects personal information; 12 d. a copy of each different privacy notice to parents; 13 e. a statement setting forth in detail when and how notices to parents are 14 provided; 15 f. a statement setting forth in detail the methods used to obtain verifiable 16 parental consent prior to any collection, use, and/or disclosure of 17 personal information from children; 18 g. a statement setting forth in detail the means provided for parents to 19 review the personal information collected from their children and to 20 refuse to permit its further use or maintenance; 21 h. a statement setting forth in detail why each type of information collected 22 is reasonably necessary for the provision of the particular related activity; 23 and 24 i. a statement setting forth in detail the procedures used to protect the 25 confidentiality, security, and integrity of personal information collected 26 from children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "17", "title": "Recordkeeping — Compliance Documentation", "category": "recordkeeping", "summary": "For five years, defendant must maintain and make available to the FTC within 14 days of a written request all documents demonstrating compliance, including copies of information collection forms, web pages, screens, and representations about data practices, with specified retention limitations.", "verbatim_text": "27 17. For a period of five (5) years from the date of entry of this Consent Decree, 28 defendant, and its successors and assigns, shall maintain and make available to the Federal CONSENT DECREE Page 5 of 9 1 Trade Commission for inspection and copying within fourteen (14) days of the date of receipt 2 of a written request, a print or electronic copy in HTML format of all documents demonstrating 3 compliance with the terms and provisions of this Consent Decree, including, but not limited to, 4 a sample copy of every different information collection form, web page, or screen, and a sample 5 copy of each different document containing any representation regarding defendant’s collection, 6 use, and disclosure practices pertaining to personal information of a child. Each web page copy 7 shall be accompanied by the URL of the Web page where the material was posted online. 8 Electronic copies shall include all text and graphics files, audio scripts, and other computer files 9 used in presenting information on the Internet. Provided, however, that defendant shall not be 10 required by this paragraph to retain a document for longer than two (2) years after the document 11 is created; or retain a print or electronic copy of any amended web page or screen to the extent 12 that the amendment does not affect defendant’s compliance obligations under this Consent 13 Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "18", "title": "Notice of Business Changes Affecting Compliance", "category": "compliance_reporting", "summary": "For twenty years, defendant must notify the Commission at least 30 days before any business change that may affect compliance obligations, including mergers, dissolutions, name changes, bankruptcy filings, or changes in corporate structure.", "verbatim_text": "14 18. For a period of twenty (20) years from the date of entry of this Consent Decree, 15 defendant, and its successors and assigns, shall notify the Commission at least thirty (30) days 16 prior to any change in its business that may affect compliance obligations arising under this 17 Consent Decree, including, but not limited to, any merger, incorporation, dissolution, 18 assignment, sale or other action that would result in the emergence of a successor corporation; 19 the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a 20 bankruptcy petition; or a change in the corporate name or address. Provided, however, that, 21 with respect to any proposed change in the corporation about which defendant, its successors 22 and assigns, learn less than thirty (30) days prior to the date such action is to take place, it shall 23 notify the Commission as soon as is practicable after obtaining such knowledge.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "19", "title": "Taxpayer Identification Number", "category": "affirmative_obligation", "summary": "Defendant must furnish its taxpayer identifying number to the FTC pursuant to 31 U.S.C. § 7701 for use in collecting and reporting on any delinquent amounts.", "verbatim_text": "24 19. Defendant is hereby required, in accordance with 31 U.S.C. § 7701, to furnish to 25 the Federal Trade Commission its taxpayer identifying number (social security number or 26 employer identification number), which shall be used for purposes of collecting and reporting 27 on any delinquent amount arising out of its relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "20", "title": "Address for Reports, Submissions, and Notices", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 14–19 must be sent by certified mail to the FTC's Western Region–San Francisco office.", "verbatim_text": "28 20. All reports, submissions, and notices required by Paragraphs 14 - 19 of this CONSENT DECREE Page 6 of 9 1 Consent Decree shall be sent by certified mail to: 2 Regional Director Western Region-San Francisco 3 Federal Trade Commission 901 Market Street, Suite 570 4 San Francisco, CA 94103 Attention: United States v. American Pop Corn Company", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "21", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction over this matter to enable any party to apply for further orders necessary for interpretation, modification, enforcement, or punishment of violations of the Consent Decree.", "verbatim_text": "21. This Court shall retain jurisdiction of this matter for the purposes of enabling 7 any of the parties to this Consent Decree to apply to the Court at any time for such further 8 orders or directives as may be necessary or appropriate for the interpretation or modification of 9 this Consent Decree, for the enforcement of compliance therewith, or for the punishment of 10 violations thereof.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.02_american_pop_corn_company", "company_name": "American Pop Corn Company", "date_issued": "2002-02-15", "year": 2002, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3026-american-pop-corn-company", "docket_number": "C02-4008DEO" }, { "provision_number": "5", "title": "Permanent Injunction Against COPPA Rule Violations", "category": "prohibition", "summary": "Defendant, its successors, assigns, officers, agents, and employees are permanently enjoined from violating any provision of the COPPA Rule in connection with any of defendant's websites or online services.", "verbatim_text": "5. Defendant, its successors and assigns, and its officers, agents, 25 representatives, and employees, and all persons in active concert or participation 26 with any one or more of them who receive actual notice of this Consent Decree by 27 28 Consent Decree Page 2 of 11 1 personal service or otherwise, are hereby enjoined, directly or through any 2 corporation, subsidiary, division, website, or other device, from violating any 3 provision of the Rule in connection with any of defendant’s websites or online services. A copy of the current Rule is attached hereto as “Appendix A” and 4 incorporated herein as if fully set forth verbatim.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "6", "title": "Effect of Future Rule Amendments", "category": "prohibition", "summary": "If the Rule is amended or modified in the future, compliance with the amended Rule will not be deemed a violation of the injunction.", "verbatim_text": "6. In the event the Rule is hereafter amended or modified, defendant’s 6 compliance with the Rule as amended or modified shall not be deemed a violation 7 of this injunction.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "7", "title": "Consumer Education Remedy – FTC KidzPrivacy Notice", "category": "affirmative_obligation", "summary": "For five years, defendant must post a clear and conspicuous bold notice directing visitors to the FTC's KidzPrivacy website in its privacy policy, parental direct notices, and at each personal information collection point on its children's websites.", "verbatim_text": "7. For a period of five (5) years from the date of entry of this Consent 10 Decree, defendant, and its successors and assigns, in connection with the operation 11 of any website or other online service directed to children or through which it, with 12 actual knowledge, collects, uses, and/or discloses personal information from 13 children, shall place a clear and conspicuous notice (1) within the privacy policy 14 required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. 15 § 312.4(b); (2) within the direct notice required to be sent to parents by Section 16 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its 17 website(s) where personal information is collected, which states as follows in bold 18 typeface: 19 NOTICE: Visit www.ftc.gov/kidzprivacy for information from the 20 Federal Trade Commission about protecting children’s 21 privacy online. 22 Where the above notice is posted on a website or delivered via email or other 23 electronic service, it shall be in the form of a hyperlink to the above-referenced 24 URL. The Federal Trade Commission may change the hyperlink/URL upon thirty 25 (30) days prior written notice to defendant, its successors or assigns.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "8", "title": "Civil Penalty Payment", "category": "affirmative_obligation", "summary": "Defendant must pay a $400,000 civil penalty within five days of entry of the Consent Decree via electronic fund transfer.", "verbatim_text": "2 8. Defendant, and its successors and assigns, shall pay to plaintiff a civil 3 penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of four hundred thousand dollars ($400,000), 4 due and payable within five (5) days following entry of this Consent Decree. 5 Unless otherwise directed, payment shall be made by electronic fund transfer in 6 accordance with procedures specified by the Office of Consumer Litigation, Civil 7 Division, U.S. Department of Justice, Washington, D.C. 20530.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "9", "title": "Default Interest on Civil Penalty", "category": "affirmative_obligation", "summary": "If defendant defaults on the civil penalty payment for more than ten days, the full unpaid amount plus statutory interest becomes immediately due.", "verbatim_text": "9. In the event of any default in payment, which default continues for ten 9 (10) days beyond the due date of payment, the entire unpaid penalty, together with 10 interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the 11 date of payment, shall immediately become due and payable.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "10", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Within ten days of entry, defendant must delete all personal information collected from children through its websites from April 21, 2000 through the date of entry.", "verbatim_text": "10. Defendant, and its successors and assigns, within ten (10) days from 14 the date of entry of this Consent Decree, shall delete all personal information 15 collected from every child through its websites at any time from April 21, 2000 16 through the date of entry of this Consent Decree.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "11", "title": "Distribution of Consent Decree to Current Personnel", "category": "acknowledgment", "summary": "Within thirty days of entry, defendant must distribute copies of the Consent Decree and the FTC compliance guide to all current officers, directors, and employees with website responsibilities, obtain signed acknowledgments, and submit a compliance statement to the Commission within fifteen days thereafter.", "verbatim_text": "11. Defendant, and its successors and assigns, within thirty (30) days from 18 the date of entry of this Consent Decree, shall provide a copy of this Consent 19 Decree and the Federal Trade Commission compliance guide entitled How to 20 Comply with the Children’s Online Privacy Protection Rule (Nov. 1999) 21 (“compliance guide”) (attached hereto as “Appendix B”) to each of its current 22 officers, directors, employees, agents, and representatives having responsibilities 23 related to the operation of any website or online service subject to this Consent 24 Decree, and secure a signed statement or return email from each such person 25 26 27 28 Consent Decree Page 4 of 11 1 certifying his or her receipt of a copy of this Consent Decree and the compliance 2 guide. Defendant shall, within fifteen (15) days of complying with this paragraph, 3 submit to the Commission a signed statement setting forth the fact and manner of defendant’s compliance, including the name and title of each person to whom a 4 copy of the Consent Decree and compliance guide has been provided.\n\n2 guide. Defendant shall, within fifteen (15) days of complying with this paragraph, 3 submit to the Commission a signed statement setting forth the fact and manner of defendant’s compliance, including the name and title of each person to whom a 4 copy of the Consent Decree and compliance guide has been provided.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "12", "title": "Distribution of Consent Decree to Future Personnel", "category": "acknowledgment", "summary": "For five years, defendant must provide the Consent Decree and compliance guide to future officers, directors, and employees with website responsibilities within thirty days of them assuming such roles, obtain signed acknowledgments, and maintain copies available to the FTC upon request.", "verbatim_text": "12. For a period of five (5) years from the date of entry of this Consent 6 Decree, defendant, and its successors and assigns, shall provide a copy of this 7 Consent Decree and the compliance guide to each of its future officers, directors, 8 employees, agents, and representatives having responsibilities related to the 9 operation of any website or online service subject to this Consent Decree, and 10 secure a signed statement or return email from each such person certifying his or 11 her receipt of a copy of this Consent Decree and the compliance guide, within 12 thirty (30) days after the person assumes such position or responsibilities.\n\nDefendant shall maintain copies of the signed statements, as well as other 14 information regarding the fact and manner of its compliance, including the name 15 and title of each person to whom a copy of the Consent Decree and compliance 16 guide has been provided and, upon request, shall make the statements and other 17 information available to the Federal Trade Commission.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "13", "title": "Compliance Reporting to the FTC", "category": "compliance_reporting", "summary": "Within sixty days of entry, and at other times as required by the FTC, defendant must file a detailed written compliance report covering its website registration processes, privacy notices, parental consent methods, parental review procedures, necessity of data collected, and security procedures.", "verbatim_text": "13. Within sixty (60) days from the date of entry of this Consent Decree, 19 and at such other times as the Federal Trade Commission may reasonably require, 20 defendant, and its successors and assigns, shall file with the Commission a written 21 report, setting forth in detail the manner and form in which it has complied and is 22 complying with this Consent Decree. The report shall include but not be limited 23 to: 24 a. a statement setting forth in detail the criteria and process 25 through which any of its websites registers visitors online for 26 27 28 Consent Decree Page 5 of 11 1 any activity requiring the submission of personal information, 2 and a copy of each different screen or page providing 3 registration information or collecting personal information; b. a copy of the home page(s) for each of its websites and a copy 4 of each different privacy notice posted on any of its websites; 5 c. a copy of each different privacy notice sent to parents of 6 children from whom defendant seeks to collect personal 7 information; 8 d. a statement setting forth in detail when and how each such 9 notice to parents is provided; 10 e. a statement setting forth in detail the methods used to obtain 11 verifiable parental consent prior to any collection, use, and/or 12 disclosure of personal information from children; 13 f. a statement setting forth in detail the means provided for 14 parents to review the personal information collected from their 15 children and to refuse to permit its further use or maintenance; 16 g. a statement setting forth in detail why each type of information 17 collected from children is reasonably necessary for the 18 provision of the particular related activity; and 19 h. a statement setting forth in detail the procedures used to protect 20 the confidentiality, security, and integrity of personal 21 information collected from children.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "14", "title": "Recordkeeping – Compliance Documents", "category": "recordkeeping", "summary": "For five years, defendant must maintain print or electronic copies of documents demonstrating compliance and make them available to the FTC within fourteen days of a written request, though no document need be kept longer than two years after creation.", "verbatim_text": "1 14. For a period of five (5) years from the date of entry of this Consent 2 Decree, defendant, and its successors and assigns, shall maintain, and make 3 available to the Federal Trade Commission for inspection and copying within fourteen (14) days of the date of receipt of a written request, a print or electronic 4 copy in HTML format of documents sufficient to demonstrate compliance with the 5 terms and provisions of this Consent Decree, including for example, a sample copy 6 of every different form, web page, or screen through which personal information is 7 collected, and a sample copy of each different privacy policy containing any 8 representation regarding defendant’s collection, use, and disclosure practices 9 pertaining to the personal information of a child. Each document shall be 10 accompanied by the URL of the web page where the material was posted online. 11 Electronic copies shall include all text and graphics files, audio scripts, and other 12 computer files used in presenting information on the Internet. Provided, however, 13 that defendant shall not be required to retain any document for longer than two (2) 14 years after the document was created, or to retain a print or electronic copy of any 15 amended web page or screen to the extent that the amendment does not affect 16 defendant’s compliance obligations under this Consent Decree.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "15", "title": "Notice of Business Changes", "category": "compliance_reporting", "summary": "For five years, defendant must notify the FTC at least thirty days before any business change that may affect its compliance obligations, including mergers, dissolutions, sales, creation or dissolution of affiliates, bankruptcy filings, or changes in corporate name or principal place of business.", "verbatim_text": "15. For a period of five (5) years from the date of entry of this Consent 18 Decree, defendant, and its successors and assigns, shall notify the Commission at 19 least thirty (30) days prior to any change in its business that may affect compliance 20 obligations arising under this Consent Decree, including, but not limited to, any 21 merger, incorporation, dissolution, assignment, sale, or other action that would 22 result in a successor corporation; the creation or dissolution of any parent, 23 subsidiary, or affiliate that controls or is controlled by defendant; the filing of a 24 bankruptcy petition; or a change in the corporate name or principal place of 25 business. Provided, however, that, with respect to any proposed change in the 26 27 28 Consent Decree Page 7 of 11 1 corporation about which defendant, or its successors and assigns, learn less than 2 thirty (30) days prior to the date such action is to take place, it shall notify the 3 Commission as soon as is practicable after obtaining such knowledge.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "16", "title": "Taxpayer Identification Number", "category": "affirmative_obligation", "summary": "Defendant must furnish its taxpayer identifying number to the FTC as required by 31 U.S.C. § 7701 for purposes of collecting and reporting on any delinquent amounts.", "verbatim_text": "16. Defendant is hereby required, in accordance with 31 U.S.C. § 7701, to 4 furnish to the Federal Trade Commission its taxpayer identifying number (social 5 security number or employer identification number), which shall be used for 6 purposes of collecting and reporting on any delinquent amount arising out of its 7 relationship with the government.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "17", "title": "Submission Address for Reports and Notices", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 11–16 must be sent by certified mail to the FTC's Associate Director of Advertising Practices and to defendant's designated contact.", "verbatim_text": "17. All reports, submissions, and notices required by Paragraphs 11 - 16 9 of this Consent Decree shall be sent by certified mail to: 10 For the Federal Trade Commission: 11 Associate Director, Division of Advertising Practices 12 Federal Trade Commission 600 Pennsylvania Ave., NW 13 Washington, D.C. 20580 Attention: United States v. UMG Recordings, Inc. 14 For UMG Recordings, Inc.: 15 UMG Recordings, Inc. 16 2220 Colorado Boulevard Santa Monica, California 90404 17 Attention: Executive Vice President, Business and Legal Affairs", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "18", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction to issue further orders for interpretation, modification, enforcement, or punishment of violations of the Consent Decree.", "verbatim_text": "19 18. This Court shall retain jurisdiction of this matter for the purposes of 20 enabling any of the parties to this Consent Decree to apply to the Court at any time 21 for such further orders or directives as may be necessary or appropriate for the 22 23 24 25 26 27 28 Consent Decree Page 8 of 11 1 interpretation or modification of this Consent Decree, for the enforcement of 2 compliance therewith, or for the punishment of violations thereof.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.04_umg_recordings_us", "company_name": "UMG Recordings, Inc.", "date_issued": "2004-02-15", "year": 2004, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/umg-recordings-inc-corporation-us", "docket_number": "CV-04-1050 JFW (Ex)" }, { "provision_number": "I", "title": "Injunction Regarding Collection of Information from Children Online", "category": "prohibition", "summary": "Defendant is permanently restrained from violating COPPA requirements regarding notice to parents, verifiable parental consent, and other Rule provisions when operating websites or online services directed to children.", "verbatim_text": "A. Failing to provide sufficient notice of the information Defendant collects online 3 from children, how it uses such information, its disclosure practices, and all other 4 content, as required by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b);\n\n6 B. Failing to provide direct notice to parents of what information Defendant collects 7 online from children, how it uses such information, its disclosure practices, and 8 all other required content, as required by Section 312.4(c) of the Rule, 16 C.F.R. 9 § 312.4(c);\n\n11 C. Failing to obtain verifiable parental consent before any collection, use, and/or 12 disclosure of personal information from children, as required by Section 312.5 of 13 the Rule, 16 C.F.R. § 312.5(a)(1); or\n\nD. Violating any other provision of the Rule, 16 C.F.R. Part 312, and as the Rule 15 may hereafter be amended. A copy of the Rule is attached hereto as “Appendix 16 17 A” and incorporated herein as if fully set forth verbatim.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "II", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected from children prior to entry of this Order and is prohibited from disclosing, using, or benefitting from such information.", "verbatim_text": "A. Disclosing, using, or benefitting from Personal information collected from 25 Children which Defendant obtained prior to entry of this Order; and\n\nB. Failing to destroy such Personal information in all forms in its possession, 27 28 custody, or control within ten (10) days after entry of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "III", "title": "Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $800,000 to the United States within 5 days of entry of this Order.", "verbatim_text": "6 18. IT IS FURTHER ORDERED that Defendant shall pay to Plaintiff a civil penalty, 7 pursuant to Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. § 45(m)(1)(A), in the amount 8 of eight hundred thousand dollars ($800,000), due and payable within five (5) days of 9 receipt of notice of the entry of this Order. Unless otherwise directed, payment shall be 10 11 made by electronic fund transfer in accordance with procedures specified by the 12 Consumer Protection Branch, Civil Division, U.S. Department of Justice, Washington, 13 DC 20530.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "IV", "title": "Injunction Regarding Privacy of Consumer Information", "category": "prohibition", "summary": "Defendant is permanently restrained from misrepresenting privacy practices, must disclose and obtain consent before accessing mobile device address books, and must establish and maintain a comprehensive privacy program.", "verbatim_text": "22. IT IS FURTHER ORDERED that Defendant acting directly or through any 3 corporation, subsidiary, limited liability company, division, or other device, in 4 connection with the advertising, marketing, promotion, offering for sale, or sale of any 5 6 product or service, in or affecting commerce, is permanently restrained and enjoined 7 from misrepresenting in any manner, expressly or by implication, the extent to which it 8 maintains and protects the privacy and confidentiality of covered information.\n\n23. IT IS FURTHER ORDERED that Defendant, acting directly or through any 10 11 corporation, subsidiary, limited liability company, division, or other device, in 12 connection with the advertising, marketing, promotion, offering for sale, or sale of any 13 product or service, in or affecting commerce, prior to any access or collection of 14 information in the user’s mobile device contacts or address book, shall: 15 A. Clearly and prominently disclose to the user, separate and apart from any 16 17 “privacy policy,” “terms of use,” “blog,” “statement of values” page, or other 18 similar document, the categories of information from the user’s mobile device 19 that will be accessed and/or collected; and\n\nB. Obtain the user’s affirmative express consent to access or collect such 21 22 information.\n\n24. IT IS FURTHER ORDERED that Defendant, acting directly or through any 24 corporation, subsidiary, limited liability company, division, or other device, in 25 connection with the advertising, marketing, promotion, offering for sale, or sale of any 26 product or service, in or affecting commerce, shall, no later than the date of service of 27 28 this order, establish and implement, and thereafter maintain, a comprehensive privacy Consent Decree Page 12 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page13 of 25 1 program that is reasonably designed to: (1) address privacy risks related to the 2 development and management of new and existing products and services for consumers; 3 and (2) protect the privacy and confidentiality of covered information. Such program, 4 the content and implementation of which must be documented in writing, shall contain 5 6 privacy controls and procedures appropriate to respondent’s size and complexity, the 7 nature and scope of respondent’s activities, and the sensitivity of the covered 8 information, including: 9\n\nA. The designation of an employee or employees to coordinate and be responsible 10 11 for the privacy program;\n\nB. The identification of reasonably foreseeable, material risks, both internal and 13 external, that could result in the respondent’s unauthorized collection, use, or 14 disclosure of covered information, and an assessment of the sufficiency of any 15 safeguards in place to control these risks. At a minimum, this privacy risk 16 17 assessment should include consideration of risks in each area of relevant 18 operation, including, but not limited to: (1) employee training and management, 19 including training on the requirements of this order; and (2) product design, 20 development, and research;\n\n22 C. The design and implementation of reasonable privacy controls and procedures to 23 address the risks identified through the privacy risk assessment, and regular 24 testing or monitoring of the effectiveness of those privacy controls and 25 procedures;\n\nD. The development and use of reasonable steps to select and retain service 27 28 providers capable of appropriately protecting the privacy of covered information Consent Decree Page 13 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page14 of 25 1 they receive from respondent, and requiring service providers by contract to 2 implement and maintain appropriate privacy protections;\n\nE. The evaluation and adjustment of respondent’s privacy program in 4 light of the results of the testing and monitoring required by subpart C, any 5 6 material changes to respondent’s operations or business arrangements, or any 7 other circumstances that respondent knows or has reason to know may have a 8 material impact on the effectiveness of its privacy program.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "V", "title": "Third-Party Privacy Assessments", "category": "assessment", "summary": "Defendant must obtain initial and biennial privacy assessments from qualified independent third-party professionals for twenty years.", "verbatim_text": "25. IT IS FURTHER ORDERED that, in connection with its compliance with Paragraph 24 10 11 of this order, Defendant shall obtain initial and biennial assessments and reports 12 (“Assessments”) from a qualified, objective, independent third-party professional, who 13 uses procedures and standards generally accepted in the profession. The reporting period 14 for the Assessments shall cover: (1) the first year after service of the Order for the initial 15 Assessment; and (2) each two (2) year period thereafter for twenty (20) years after 16 17 service of the Order for the biennial Assessments.\n\nA. Each Assessment shall: 19 1. Set forth the specific privacy controls that Defendant has implemented and 20 maintained during the reporting period; 21 22 2. Explain how such privacy controls are appropriate to Defendant’s size and 23 complexity, the nature and scope of Defendant’s activities, and the 24 sensitivity of the covered information collected from or about consumers; 25 3. Explain how the privacy controls that have been implemented meet or 26 exceed the protections required by Paragraph 24 of this Order; and 27 28 4. Certify that Defendant’s privacy program is operating with sufficient Consent Decree Page 14 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page15 of 25 1 effectiveness to provide reasonable assurance to protect the privacy of 2 covered information and that the program has so operated throughout the 3 reporting period.\n\nB. Each Assessment shall be prepared and completed within sixty (60) days after the 5 6 end of the reporting period to which the Assessment applies by a person that has a 7 minimum of three (3) years of experience in the field of privacy and data 8 protection. All persons conducting such Assessments and preparing such reports 9 shall be approved by the Associate Director for Enforcement, Bureau of 10 11 Consumer Protection, Federal Trade Commission, 600 Pennsylvania Ave. NW, 12 Washington, D.C. 20580, in his or her sole discretion.\n\nC. Defendant shall provide the initial Assessment by overnight courier (not the U.S. 14 Postal Service) to the Associate Director for Enforcement, Bureau of Consumer 15 Protection, Federal Trade Commission, 600 Pennsylvania Ave. NW, Washington, 16 17 D.C. 20580, or by email to Debrief@ftc.gov, within ten (10) days after the\n\nAssessment has been prepared. All subsequent biennial Assessments shall be 19 retained by Defendant until the order is terminated and provided to the Associate 20 Director for Enforcement within ten (10) days of request.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "VI", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain acknowledgments of receipt of this Order from itself, its personnel, and business entities resulting from structural changes.", "verbatim_text": "A. Defendant, within seven (7) days of entry of this Order, must submit to the 26 Commission an acknowledgment of receipt of this Order sworn under penalty of 27 28 perjury.\n\n1 B. For five (5) years after entry of this Order, Defendant must deliver a copy of this 2 Order to: (1) all principals, officers, directors, and managers; (2) all employees, 3 agents, and representatives having supervisory responsibilities relating to the 4 collection, retention, storage, or security of covered information and all 5 6 employees, agents, and representatives having supervisory responsibilities related 7 to the operation of any website or online service subject to this Order; and (3) any 8 business entity resulting from any change in structure as set forth in the Section 9 titled “Compliance Reporting.” Delivery must occur within seven (7) days of 10 11 entry of this Order for current personnel. To all others, delivery must occur 12 before they assume their responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this 14 Order, that Defendant must obtain, within thirty (30) days, a signed and dated 15 acknowledgment of receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "VII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit compliance reports and notices to the Commission at specified intervals and upon certain events.", "verbatim_text": "A. One hundred eighty (180) days after the date of entry of this Order, Defendant 21 22 must submit a compliance report, sworn under penalty of perjury. This report 23 must: 24 1. Designate at least one telephone number and an email, physical, and 25 postal address as points of contact, which representatives of the 26 Commission may use to communicate with Defendant; 27 28 2. Identify all of Defendant’s businesses by all of their names, telephone Consent Decree Page 16 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page17 of 25 1 numbers, and physical, postal, email, and Internet addresses; 2 3. Describe the activities of each business, including the products and 3 services offered and the means of advertising, marketing, and sales; 4 4. Describe in detail whether and how Defendant is in compliance with each 5 6 Section of this Order; 7 5. Provide a statement setting forth in detail the criteria and process through 8 which Defendant’s websites or online services register visitors online for 9 any activity requiring the submission of covered information, and a copy 10 11 of each different version of screen or page providing or collecting 12 registration information; 13 6. Provide a copy of each different version of any privacy notice posted on 14 each website or online service operated by Defendant; 15 7. Provide a statement setting forth in detail each place where the privacy 16 17 notice on any such website or online service is located and a copy of each 18 different version of screen or page on which such website or online 19 service collects covered information; 20 8. Provide a copy of each different version of any privacy notice sent to 21 22 parents of children that register on each website or online service; 23 9. Provide a statement setting forth in detail when and how each such notice 24 to parents is provided; 25 10. Provide a statement setting forth in detail the methods used to obtain 26 verifiable parental consent prior to any collection, use, and/or disclosure 27 28 of personal information from children, as defined by Definition K (Section Consent Decree Page 17 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page18 of 25 1 1302(8) of COPPA, 15 U.S.C. § 6501(8)); 2 11. Provide a statement setting forth in detail the means provided for parents 3 to review the personal information, as defined by Definition K (Section 4 1302(8) of COPPA, 15 U.S.C. § 6501(8)), collected from their children 5 6 and to refuse to permit its further use or maintenance; 7 12. Provide a statement setting forth in detail why each type of information 8 collected from a child is reasonably necessary for the provision of the 9 particular related activity; 10 11 13. Provide a statement setting forth in detail the procedures used to protect 12 the confidentiality, security, and integrity of personal information, as 13 defined by Definition K (Section 1302(8) of COPPA, 15 U.S.C. § 14 6501(8)), collected from children; and 15 14. Provide a copy of each Order Acknowledgement obtained pursuant to this 16 17 Order, unless previously submitted to the Commission.\n\nB. For twenty (20) years following entry of this Order, Defendant must submit a 19 compliance notice, sworn under penalty of perjury, within fourteen (14) days of 20 any change in the following: (1) any designated point of contact; or (2) the 21 22 structure of Defendant or any entity that Defendant has any ownership interest in 23 or directly or indirectly controls that may affect compliance obligations arising 24 under this Order, including: creation, merger, sale, or dissolution of the entity or 25 any subsidiary, parent, or affiliate that engages in any acts or practices subject to 26 this Order.\n\n28 C. Defendant must submit to the Commission notice of the filing of any bankruptcy Consent Decree Page 18 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page19 of 25 1 petition, insolvency proceeding, or any similar proceeding by or against 2 Defendant within fourteen (14) days of its filing.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "VIII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain specified records for twenty years after entry of the Order, with each record retained for five years unless otherwise specified.", "verbatim_text": "A. Accounting records showing the revenues from all goods or services sold, all 25 costs incurred in generating those revenues, and the resulting net profit or loss;\n\nB. Personnel records showing, for each person providing services, whether as an 27 28 employee or otherwise, that person’s: name, addresses, and telephone numbers; Consent Decree Page 19 of 25 Case3:13-cv-00448-RS Document8 Filed02/08/13 Page20 of 25 1 job title or position; dates of service; and, if applicable, the reason for 2 termination;\n\nC. All records necessary to demonstrate full compliance with each provision of this 4 Order, including all submissions to the Commission;\n\n6 D. A copy of all complaints submitted by consumers to Defendant regarding its 7 information security practices or its practices relating to the collection or retention 8 of covered information. Provided, however, that Defendant shall not be required 9 to retain any complaint for longer than three (3) years after it was submitted; and\n\n11 E. A sample copy of every materially different form, page, or screen created, 12 maintained, or otherwise provided by Defendant through which Defendant 13 collects covered information, and a sample copy of each materially different 14 document containing any representation regarding Defendant’s collection, use, 15 and disclosure practices pertaining to personal information of a child, as defined 16 17 by Definition A (Section 1302(1) of COPPA, 15 U.S.C. § 6501(1)). Each web 18 page copy shall be accompanied by the URL of the web page where the material 19 was posted online. Electronic copies shall include all text and graphics files, 20 audio scripts, and other computer files used in presenting information on the 21 22 Internet. Provided, however, that Defendant shall not be required to retain any 23 document for longer than two (2) years after the document was created, or to 24 retain a print or electronic copy of any amended web page or screen to the extent 25 that the amendment does not affect Defendant’s compliance obligations under 26 this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "IX", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission is authorized to monitor Defendant's compliance through various means including document requests, depositions, interviews, and undercover activities.", "verbatim_text": "A. Within fourteen (14) days of receipt of a written request from a representative of 5 6 the Commission, Defendant must: submit additional compliance reports or other 7 requested information, which must be sworn under penalty of perjury; appear for 8 depositions; and produce documents, for inspection and copying. The 9 Commission is also authorized to obtain discovery, without further leave of 10 11 Court, using any of the procedures prescribed by Federal Rules of Civil Procedure 12 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69. 13 B. For matters concerning this Order, the Commission is authorized to communicate 14\n\nB. For matters concerning this Order, the Commission is authorized to communicate 14 directly with Defendant. Defendant must permit representatives of the 15 Commission to interview any employee or other person affiliated with any 16 17 Defendant who has agreed to such an interview. The person interviewed may 18 have counsel present.\n\nC. The Commission may use all other lawful means, including posing, through its 20 representatives, as consumers, suppliers, or other individuals or entities, to 21 22 Defendant or any individual or entity affiliated with Defendant, without the 23 necessity of identification or prior notice. Nothing in this Order limits the 24 Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of 25 the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "X", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "30. IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for the 3 purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.13_path", "company_name": "Path, Inc.", "date_issued": "2013-02-15", "year": 2013, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/122-3158-path-inc", "docket_number": "C-3:13-cv-00448-RS" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained and enjoined from failing to provide parental notice, failing to post a prominent privacy notice link, failing to obtain verifiable parental consent, and from violating the COPPA Rule.", "verbatim_text": "A. failing to make reasonable efforts, taking into account available technology, to 1 2 ensure that a parent of a child receives direct notice of Defendants’ practices with regard to the 3 collection, use, or disclosure of personal information from children, including notice of any 4 material change in the collection, use, or disclosure practices to which the parent has previously 5 consented;\n\nB. failing to post a prominent and clearly labeled link to an online notice of its 7 8 information practices with regard to children on the home or landing page or screen of its 9 website or online service, and at each area of the website or online service where personal 10 information is collected from children;\n\nC. failing to obtain verifiable parental consent before any collection, use, or 12 disclosure of personal information from children, including consent to any material change in the 13 14 collection, use, or disclosure practices to which the parent has previously consented; and\n\n15 D. violating the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, a 16 copy of which is attached hereto as Appendix A.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "II", "title": "Injunction Concerning Deletion of Children's Personal Information", "category": "prohibition", "summary": "Defendant is permanently restrained from disclosing, using, or benefiting from children's personal information obtained prior to entry of this Order, and must destroy all such information within ten days of entry.", "verbatim_text": "23 A. disclosing, using, or benefiting from children’s personal information which 24 Defendant obtained prior to entry of this Order; and\n\nB. failing to destroy children’s personal information that is in their possession, 26 custody, or control within ten (10) days after entry of this Order. Provided, however, that such 27 28 Page 8 of 17 CCaassee 22::1188--ccvv--0000119999--JJAADD--PPAALL DDooccuummeenntt 24 FFiilleedd 0022//0152//1188 PPaaggee 99 ooff 1177 personal information need not be disposed of, and may be disclosed, to the extent requested by a 1 2 government agency or required by law, regulation, or court order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition", "Data Deletion" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $500,000 is entered against Defendant, with $235,000 due within 90 days; the remainder is suspended contingent on the accuracy of Defendant's financial representations.", "verbatim_text": "A. Judgment in the amount of Five Hundred Thousand Dollars ($500,000) is entered 6 in favor of Plaintiff against Defendant as a civil penalty.\n\n8 B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of 9 the United States, Two Hundred Thirty-Five Thousand Dollars ($235,000). Such payment must 10 be made within ninety (90) days of entry of the Order, unless otherwise agreed to by counsel for 11 the Commission, by electronic fund transfer in accordance with instructions previously provided 12 by a representative of Plaintiff. Upon such payment, the remainder of the judgment is 13 14 suspended, subject to the Subsections below.\n\n15 C. The Commission and Plaintiff’s agreement to the suspension of part of the 16 judgment is expressly premised upon the truthfulness, accuracy, and completeness of the 17 following sworn financial statements and related documents (collectively, “financial 18 representations”) submitted to the Commission, namely: 19 20 1. the Financial Statement of Defendant Prime Sites, Inc. signed by Ami 21 Shafrir, President, on September 29, 2017, including the attachments; and 22 2. the Financial Statement of Defendant’s President signed on September 30, 23 2017, and submitted to Commission counsel, including the attachments.\n\nD. The suspension of the judgment will be lifted if, upon motion by the Commission 25 26 or Plaintiff, the Court finds that Defendant or Defendant’s President failed to disclose any 27 28 Page 9 of 17 CCaassee 22::1188--ccvv--0000119999--JJAADD--PPAALL DDooccuummeenntt 24 FFiilleedd 0022//0152//1188 PPaaggee 1100 ooff 1177 material asset, materially misstated the value of any asset, or made any other material 1 2 misstatement or omission in the financial representations identified above.\n\n3 E. If the suspension of the judgment is lifted, the judgment becomes immediately 4 due in the amount specified in Subsection A above (which the parties stipulate only for purposes 5 of this Section represents the amount of the civil penalty for the violations alleged in the 6 Complaint), less any payment previously made pursuant to this Section, plus interest computed 7 8 from the date of entry of this Order.\n\n9 F. Defendant relinquishes dominion and all legal and equitable right, title, and 10 interest in all assets transferred pursuant to this Order and may not seek the return of any assets.\n\nG. The facts alleged in the Complaint will be taken as true, without further proof, in 12 any subsequent civil litigation by or on behalf of the Commission, including in a proceeding to 13 14 enforce its rights to any payment or monetary judgment pursuant to this Order.\n\n15 H. Defendant agrees that the judgment represents a civil penalty owed to the 16 government of the United States and is not compensation for actual pecuniary loss.\n\nI. Defendant acknowledges that its Employer Identification Numbers, which 18 Defendant previously submitted to the Commission, may be used for collecting and reporting on 19 20 any delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "IV", "title": "Prohibition Against Misrepresentations", "category": "prohibition", "summary": "Defendant is permanently enjoined from misrepresenting material facts about talent casting opportunities, consumer selection for roles, and practices regarding children's personal information or any goods or services.", "verbatim_text": "A. that consumers have been specifically chosen for a role in an upcoming motion 1 2 picture;\n\n3 B. that consumers have been the subject of interest from casting directors;\n\nC. any fact material to Defendant’s practices with respect to personal information 5 collected from children, including Defendant’s collection, use, and disclosure practices; or\n\nD. any other fact material to consumers concerning any good or service, such as: the 7 8 total costs; any material restrictions, limitations, or conditions; or any material aspect of its 9 nature or central characteristics.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "V", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit a sworn acknowledgment of receipt of this Order within 7 days, deliver copies to relevant personnel within 7 days (and before new personnel assume responsibilities), and obtain signed acknowledgments from all recipients within 30 days.", "verbatim_text": "14 A. Defendant, within 7 days of entry of this Order, must submit to the Commission 15 an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For 5 years after entry of this Order, Defendant must deliver a copy of this Order 17 to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees, 18 agents, and representatives who participate in the collection, retention, storage, or security of 19 20 personal information from children, if any, or who have responsibilities related to the operation 21 of any website or online service through which Defendant collects personal information from 22 users; and (3) any business entity resulting from any change in structure as set forth in the 23 Section titled Compliance Reporting. Delivery must occur within 7 days of entry of this Order 24 for current personnel. For all others, delivery must occur before they assume their 25 26 responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this 1 2 Order, that Defendant must obtain, within 30 days, a signed and dated acknowledgment of 3 receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "VI", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit a sworn annual compliance report one year after entry of the Order detailing business activities, COPPA compliance, privacy notices, and parental consent methods, and must submit timely notices of structural changes, bankruptcy filings, and changes in contact information for 20 years.", "verbatim_text": "8 A. One year after entry of this Order, Defendant must submit a compliance report, 9 sworn under penalty of perjury. In such report, Defendant must: 10 1. identify the primary physical, postal, and email address and telephone 11 number, as designated points of contact, which representatives of the Commission and Plaintiff 12 may use to communicate with Defendant; 13 14 2. identify all of Defendant’s businesses by all of their names, telephone 15 numbers, and physical, postal, email, and Internet addresses; 16 3. describe the activities of each business, including the goods and services 17 offered, the means of advertising, marketing, and sales; 18 4. describe in detail whether and how Defendant is in compliance with each 19 20 Section of this Order; 21 5. provide a copy of each different version of any privacy notice posted on 22 each website or online service operated by Defendants or sent to parents of children that register 23 on each website or online service; 24 6. describe in detail the methods used to obtain verifiable parental consent 25 26 prior to any collection, use, and/or disclosure of personal information from children through any 27 website or online service; 28 Page 12 of 17 CCaassee 22::1188--ccvv--0000119999--JJAADD--PPAALL DDooccuummeenntt 24 FFiilleedd 0022//0152//1188 PPaaggee 1133 ooff 1177 7. describe in detail the means provided for parents to review the personal 1 2 information collected from their children and to refuse to permit its further use or maintenance; 3 and 4 8. provide a copy of each Order Acknowledgment obtained pursuant to this 5 Order, unless previously submitted to the Commission.\n\nB. For 20 years after entry of this Order, Defendant must submit a compliance 7 8 notice, sworn under penalty of perjury, within 14 days of any change in: (1) any designated 9 point of contact; or (2) the structure of Defendant or any entity that Defendant has any ownership 10 interest in or controls directly or indirectly that may affect compliance obligations arising under 11 this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, 12 parent, or affiliate that engages in any acts or practices subject to this Order.\n\n14 C. Defendant must submit to the Commission notice of the filing of any bankruptcy 15 petition, insolvency proceeding, or similar proceeding by or against such Defendant within 14 16 days of its filing.\n\nD. Any submission to the Commission required by this Order to be sworn under 18 penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 19 20 concluding: “I declare under penalty of perjury under the laws of the United States of America 21 that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s 22 full name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all 24 submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or 25 26 sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 27 28 Page 13 of 17 CCaassee 22::1188--ccvv--0000119999--JJAADD--PPAALL DDooccuummeenntt 24 FFiilleedd 0022//0152//1188 PPaaggee 1144 ooff 1177 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 1 2 Washington, DC 20580. The subject line must begin: FTC v. Prime Sites, Inc., X______.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "VII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create specified records for 20 years after entry of the Order and retain each record for 5 years, including accounting records, personnel records, compliance records, consumer complaints, privacy-related web pages, and marketing materials.", "verbatim_text": "IT IS FURTHER ORDERED that Defendant must create certain records for 20 years 5 after entry of the Order, and retain each such record for 5 years. Specifically, Defendant must 6 create and retain the following records: 7 8 A. accounting records showing the revenues from all goods or services sold;\n\n9 B. personnel records showing, for each person providing services, whether as an 10 employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; 11 dates of service; and (if applicable) the reason for termination;\n\nC. all records necessary to demonstrate full compliance with each provision of this 13 14 Order, including all submissions to the Commission;\n\n15 D. records of all consumer complaints and refund requests, whether received directly 16 or indirectly, such as through a third party, and any response;\n\nE. a copy of each materially different form, page, or screen created, maintained, or 18 otherwise provided by Defendant through which personal information is collected through any 19 20 website or online service, and a copy of each materially different document containing any 21 representation regarding collection, use, and disclosure practices pertaining to personal 22 information collected through such website or online service. Each webpage copy shall be 23 accompanied by the URL of the webpage where the material was posted online. Electronic 24 copies shall include all text and graphics files, audio scripts, and other computer files used in 25 26 presenting information on the Internet.\n\nF. a copy of each unique advertisement, other marketing material, telemarketing 1 2 script, or other representation made in connection with promoting or offering for sale of any 3 good or service.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "VIII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through written requests for reports and documents (due within 14 days), depositions, direct communications, employee interviews, and other lawful investigative means.", "verbatim_text": "8 A. Within fourteen (14) days of receipt of a written request from a representative of 9 the Commission or Plaintiff, Defendant must: submit additional compliance reports or other 10 requested information, which must be sworn under penalty of perjury; appear for depositions; 11 and produce documents for inspection and copying. The Commission and Plaintiff are also 12 authorized to obtain discovery, without further leave of court, using any of the procedures 13 14 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 15 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized 17 to communicate directly with Defendant. Defendant must permit representatives of the 18 Commission and Plaintiff to interview any employee or other person affiliated with Defendant 19 20 who has agreed to such an interview. The person interviewed may have counsel present.\n\n21 C. The Commission and Plaintiff may use all other lawful means, including posing, 22 through its representatives as consumers, suppliers, or other individuals or entities, to Defendants 23 or any individual or entity affiliated with Defendants, without the necessity of identification or 24 prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 25 26 pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.18_prime_sites", "company_name": "Prime Sites, Inc.", "date_issued": "2018-02-15", "year": 2018, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/162-3218-prime-sites-inc-explore-talent", "docket_number": "2:18-cv-199" }, { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently restrained and enjoined from violating the COPPA Rule, including failing to provide direct notice to parents, failing to post a privacy policy link, failing to obtain verifiable parental consent, failing to delete children's personal information upon parental request, and retaining personal information longer than necessary.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available technology, to 14 ensure that a parent of a child receives direct notice of Defendants’ practices 15 with regard to the collection, use, or disclosure of personal information from 16 children, including notice of any material change in the collection, use, or 17 disclosure practices to which the parent has previously consented;\n\nB. Failing to post a prominent and clearly labeled link to an online notice of its 19 information practices with regard to children, if any, on the home or landing 20 page or screen of its Web site or online service, and at each area of the Web site 21 or online service where personal information is collected from children;\n\nC. Failing to obtain verifiable parental consent before any collection, use, or 23 disclosure of personal information from children, including consent to any 24 material change in the collection, use, or disclosure practices to which the 25 parent has previously consented;\n\nD. Failing to delete a child’s personal information at the request of a parent; and\n\nE. Retaining personal information for longer than is reasonably necessary to fulfill 28 8 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 9 of 25 Page ID #:20 1 the purpose for which the information was collected.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "II", "title": "Deletion of Children's Personal Information and Treatment of Accounts Existing at Time of Entry of This Order", "category": "affirmative_obligation", "summary": "Defendants must destroy all personal information associated with user accounts existing at time of Order entry, with specific procedures for different user categories, and submit a supplemental compliance report within 15 months.", "verbatim_text": "9 A. Destroy all personal information, in all forms in their possession, custody, or 10 control, that is associated with user accounts existing at the time of entry of this 11 Order; or\n\n15 1. For users of accounts existing at the time of entry of this Order who 16 identify as under age 13, Defendants shall destroy such users’ personal 17 information, except that Defendants may, with the affirmative consent of 18 the user, transfer the user’s videos to the user’s device and allow such 19 user to retain their username, so long as that username does not function 20 in the same manner as online contact information.\n\n21 2. For users of accounts existing at the time of entry of this Order who 22 identify as age 13 or over who were under age 13 at the time Defendants 23 collected personal information, Defendants shall destroy such personal 24 information, except that Defendants may, with the affirmative consent of 25 the user, transfer the user’s videos to the user’s device and retain the 26 user’s registration information.\n\n27 3. If the age of a particular user of an existing account is not identified 28 within forty-five 45 days after entry of the Order, Defendants shall, 9 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 10 of 25 Page ID #:21 1 within forty-five (45) days of entry of the Order: (a) remove such user’s 2 personal information from Defendants’ Web sites and online services; (b) 3 refrain from disclosing or using personal information that has been 4 removed from their Web sites and online services; and (c) destroy such 5 personal information within 12 months after entry of the Order. If the 6 age of a particular user whose information has been removed is identified 7 within 12 months after entry of the Order, Defendants shall comply with 8 Section B(1) and B(2).\n\n15 C. To the extent not covered in its compliance report, Defendants must submit a 16 supplemental report, sworn under penalty of perjury, discussing whether and 17 how Defendants are in compliance with this provision, within 15 months of 18 entry of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $5,700,000 is entered against Defendants jointly and severally, to be paid to the U.S. Treasury within 7 days of Order entry by electronic fund transfer.", "verbatim_text": "25 A. Judgement in the amount of $5,700,000.00 is entered in favor of Plaintiff 26 against Defendants, jointly and severally, as a civil penalty.\n\n27 B. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer 28 of the United States, $5,700,000.00, which, as Defendants stipulate, their 10 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 11 of 25 Page ID #:22 1 undersigned counsel holds in escrow for no purpose other than payment to 2 Plaintiff. Such payment must be made within 7 days of entry of this Order by 3 electronic fund transfer in accordance with instructions previously provided by 4 a representative of Plaintiff.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "IV", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to transferred assets, the Complaint's facts are taken as true in future proceedings, and Defendants must submit their Taxpayer Identification Numbers to the Commission.", "verbatim_text": "7 A. Defendants relinquish dominion and all legal and equitable right, title, and 8 interest in all assets transferred pursuant to this Order and may not seek the 9 return of any assets.\n\n10 B. The facts alleged in the Complaint will be taken as true, without further proof, 11 in any subsequent civil litigation by or on behalf of the Commission, including 12 in a proceeding to enforce its rights to any payment or monetary judgement 13 pursuant to this Order.\n\n14 C. The facts alleged in the Complaint establish all elements necessary to sustain an 15 action by the Commission pursuant to Section 523(a)(2)(A) of the Bankruptcy 16 Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel 17 effect for such purposes.\n\n18 D. Defendants acknowledge that their Taxpayer Identification Numbers, which 19 Defendants must submit to the Commission, may be used for collecting and 20 reporting on any delinquent amount arising out of this Order, in accordance 21 with 31 U.S.C. §7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "V", "title": "Informational Relief", "category": "compliance_reporting", "summary": "Defendants must submit sworn reports summarizing compliance with the deletion obligations under Part II: one within 90 days of Order entry, and if applicable, another within 15 months of Order entry.", "verbatim_text": "24 1. Defendants must submit a report within ninety (90) days of the entry of this 25 Order summarizing their compliance with Section II of this Order; and\n\n26 2. If Defendants elect to operate any Web site or online service that is directed 27 to children but that does not target children as the primary audience, 28 Defendants must submit a report within fifteen (15) months of the entry of 11 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 12 of 25 Page ID #:23 1 this Order summarizing their compliance with Section II.B. of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "VI", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendants must submit a sworn acknowledgment of receipt of this Order within 7 days, deliver copies of the Order to principals, relevant employees, and successor entities within 5 years, and obtain signed acknowledgments from recipients within 30 days of delivery.", "verbatim_text": "5 A. Each Defendant, within 7 days of entry of this Order, must submit to the 6 Commission an acknowledgment of receipt of this Order sworn under penalty 7 of perjury.\n\n8 B. For five (5) years after entry of this Order, Defendants must deliver a copy of 9 this Order to: (1) all principals, officers, directors, and LLC managers and 10 members; (2) all employees, agents, and representatives having managerial 11 responsibilities for the collection, use, maintenance, or disclosure of personal 12 information or the operation of any of Defendants’ Web sites or online 13 services; and (3) any business entity resulting from any change in structure as 14 set forth in the Part titled Compliance Reporting. Delivery must occur within 15 seven (7) days of entry of this Order for current personnel. For all others, 16 delivery must occur before they assume their responsibilities.\n\n17 C. From each individual or entity to which a Defendant delivered a copy of this 18 Order, that Defendant must obtain, within 30 days, a signed and dated 19 acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "VII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn annual compliance report one year after Order entry, notify the Commission of structural or contact changes within 14 days for 10 years, notify of any bankruptcy filing within 14 days, and submit all required reports by email or overnight courier.", "verbatim_text": "23 A. One year after entry of this Order, each Defendant must submit a compliance 24 report, sworn under penalty of perjury. Each Defendant must: 25 1. Identify the primary physical, postal, and email address and telephone 26 number, as designated points of contact, which representatives of the 27 Commission and Plaintiff may use to communicate with Defendant; 28 2. Identify all of that Defendant’s businesses by all of their names, telephone 12 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 13 of 25 Page ID #:24 1 numbers, and physical, postal, email, and Internet addresses; 2 3. Describe the activities of each business, including the goods and services 3 offered, the means of advertising, marketing, and sales, and involvement of 4 any other Defendant; 5 4. Describe in detail whether and how that Defendant is in compliance with 6 each section of this Order; 7 5. Provide a copy of each different version of any privacy notice posted on 8 each Web site or online service operated by that Defendant or otherwise 9 communicated to parents of children from whom that Defendant collects 10 personal information; 11 6. Provide a statement setting forth in detail any methods used to obtain 12 verifiable parental consent prior to any collection, use, and/or disclosure of 13 personal information from children or the methods used to avoid collecting, 14 using, and/or disclosing personal information from children; 15 7. Provide a statement setting forth in detail the means provided for parents to 16 review any personal information collected from their children and to refuse 17 to permit its further use or maintenance; 18 8. Provide a statement setting forth in detail why each type of information 19 collected from a child is reasonably necessary for the provision of the 20 particular related activity; 21 9. Provide a statement setting forth in detail the procedures used to protect the 22 confidentiality, security, and integrity of personal information collected from 23 children; and 24 10. Provide a copy of each Order Acknowledgment obtained pursuant to this 25 Order, unless previously submitted to the Commission.\n\n26 B. For ten (10) years after entry of this Order, each Defendant must submit a 27 compliance notice, sworn under penalty of perjury, within 14 days of any 28 change in: (a) any designated point of contact; or (b) the structure of any 13 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 14 of 25 Page ID #:25 1 Defendant or any entity that Defendant has any ownership interest in or 2 controls directly or indirectly that may affect compliance obligations arising 3 under this Order including: creation, merger, sale, or dissolution of the entity 4 or any subsidiary, parent, or affiliate that engages in any acts or practices 5 subject to this Order.\n\n6 C. Each Defendant must submit to the Commission notice of the filing of any 7 bankruptcy petition, insolvency proceeding, or similar proceeding by or 8 against such Defendant within 14 days of its filing.\n\n9 D. Any submission to the Commission required by this Order to be sworn under 10 penalty of perjury must be true and accurate and comply with 28 U.S.C. § 11 1746, such as by concluding: “I declare under penalty of perjury under the 12 laws of the United States of America that the foregoing is true and correct. 13 Executed on: _______” and supplying the date, signatory’s full name, title (if 14 applicable), and signature.\n\n15 E. Unless otherwise directed by a Commission representative in writing, all 16 submissions to the Commission pursuant to this Order must be emailed to 17 Debrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 18 Associate Director for Enforcement, Bureau of Consumer Protection, Federal 19 Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. 20 The subject line must begin: United States v. Musical.ly, et al.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "VIII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create certain records for 10 years after Order entry and retain each such record for 5 years, including all compliance records, consumer complaints and responses, and copies of all forms or screens through which personal information is collected from children.", "verbatim_text": "22 IT IS FURTHER ORDERED that Defendants must create certain records for 10 23 years after entry of this Order, and retain each such record for 5 years. Specifically, 24 Defendants must create and retain the following records: 25 A. All records necessary to demonstrate full compliance with each provision of 26 this Order, including all submissions to the Commission;\n\n27 B. Copies of all consumer complaints relating to Defendants’ information 28 practices, including its collection, use, maintenance, or disclosure of personal 14 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 15 of 25 Page ID #:26 1 information, and any response; and\n\n2 C. A copy of each materially different form, page, or screen created, maintained, 3 or otherwise provided by Defendants through which personal information is 4 collected from a child, and a copy of each materially different document 5 containing any representation regarding collection, use, maintenance or 6 disclosure practices pertaining to personal information from children. Each 7 webpage copy shall be accompanied by the URL of the webpage where the 8 material was posted online. Electronic copies shall include all text and graphics 9 files, audio scripts, and other computer files used in presenting information on 10 the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "IX", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through document requests, depositions, discovery, direct communications, employee interviews, and all other lawful means including undercover methods.", "verbatim_text": "14 A. Within 14 days of receipt of a written request from a representative of the 15 Commission or Plaintiff, each Defendant must: submit additional compliance 16 reports or other requested information, which must be sworn under penalty of 17 perjury; appear for depositions; and produce documents for inspection and 18 copying. The Commission and Plaintiff are also authorized to obtain discovery, 19 without further leave of court, using any procedure prescribed by Federal Rules 20 of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, 21 and 69.\n\n22 B. For matters concerning this Order, the Commission and Plaintiff are authorized 23 to communicate directly with each Defendant. Defendants must permit 24 representatives of the Commission and Plaintiff to interview any employee or 25 other person affiliated with Defendants who has agreed to such an interview. 26 The person interviewed may have counsel present.\n\n27 C. The Commission and Plaintiff may use all other lawful means, including 28 posing, through its representatives as consumers, suppliers, or other individuals 15 Case 2:19-cv-01439 Document 1-1 Filed 02/27/19 Page 16 of 25 Page ID #:27 1 or entities, to Defendants or any individual or entity affiliated with Defendants, 2 without the necessity of identification or prior notice. Nothing in this Order 3 limits the Commission’s lawful use of compulsory process, pursuant to Sections 4 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "X", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "6 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter 7 for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.19_musical.ly", "company_name": "Musical.ly", "date_issued": "2019-02-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a), and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3004-musically-inc", "docket_number": "2:19-cv-1439" }, { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant and related parties are permanently enjoined from violating COPPA requirements, including failing to provide parental notice, failing to obtain verifiable parental consent, failing to delete children's information upon parental request, and retaining children's data longer than necessary.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available technology, to ensure that a Parent of a Child receives direct notice of the Operator's practices with regard to the Collection, use, or Disclosure of Personal Information from Children, including notice of any material 14 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 14 of 45 hange in the Collection, use, or Disclosure practices to which the Parent ,i~has previously consented, unless the COPPA Rule (attached as Appb1dix A), provides an exception to providing such notice;\n\nB. Failing to post a prominent and clearly labeled link to an online notice of the Operator's information practices with regard to Children, if any, on the home or landing page or screen of its website or online service, and at each area of the website or online service where Personal Information is Collected from Children, unless the COPPA Rule (attached as Appendix A), provides an exception to providing such notice;\n\nC. Failing to Obtain Verifiable Parental Consent before any Collection, use, or Disclosure of Personal Information from Children, including consent to any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented, unless the COPPA Rule (attached as Appendix A), provides an exception to Obtaining Verifiable Parental Consent;\n\nD. Failing to Delete a Child's Personal Information at the request of a Parent;\n\nE. Retaining a Child's Personal Information for longer than is reasonably necessary to fulfill the purpose for which the information was Collected;\n\nF. Violating the COPPA Rule (attached as Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "II", "title": "Injunction Concerning Children's Personal Information Previously Collected", "category": "affirmative_obligation", "summary": "Defendant must delete all Personal Information associated with Fortnite users as of the Compliance Date (unless exceptions apply) and submit a sworn written statement to the Commission confirming the deletions and describing any retained information.", "verbatim_text": "A. Within sixty (60) days of the Compliance Date, Delete all Personal Information that is associated, at the time of the Compliance Date, with any Fortnite user, unless: 1. the user has provided age information through a neutral age gate identifying the user as age 13 or older; or 2. Defendant has provided direct notice and Obtained Verifiable Parental Consent; and\n\nB. Within ninety (90) days of the Compliance Date, provide a written statement to the Commission, sworn under penalty of perjury, that: 1. Describes all processes through which Defendant provided direct notice and sought to Obtain Verifiable Parental consent for any accounts covered by this Provision II; 2. Identifies the total number of accounts for which (i) direct notice was provided; (ii) Defendant Obtained Verifiable Parental Consent; (iii) verifiable parental consent was affirmatively declined; and (iv) no response was provided; 16 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 16 of 45 Describes in detail any Personal Infonnation Defendant retains in accordance with sub-Provisions II.C or II.D, tht'' asis for such retention, and, as applicable, the specific government agency, law, regulation, or court order that requires such retention; and 4. Confirms that all Personal Information required to be Deleted by this Provision II has been Deleted.\n\nC. Persistent Identifiers that Defendant is otherwise required to Delete by this Provision II need not be Deleted to the extent they are used solely for Support for the Internal Operations of the Website or Online Service; and\n\nD. Personal Information that Defendant is otherwise required to Delete by this Provision II may be retained, and may be disclosed, as requested by a government agency or required by law, regulation, or court order. Within thirty (30) days after the obligation to retain any such Personal Information has ended, Defendant shall Delete such Personal Information and provide an additional written statement to the Commission, sworn under penalty of perjury, confirming that Defendant has Deleted such Personal Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "III", "title": "Default Privacy Settings for Children and Teens", "category": "prohibition", "summary": "Defendant is permanently enjoined from disclosing or enabling disclosure of a Child's or Teen's Covered Information to other users, or enabling a Child or Teen to converse with other users, unless the applicable parent or Teen has provided Affirmative Express Consent through an easily-located Privacy Setting.", "verbatim_text": ", in connection with any Covered Product or Service, are permanently restrained and enjoined from disclosing a Child's or Tee·w 1 --:-overed Information to, enabling a Child or Teen to disclose their Covered Information to, or enabling a Child or Teen to converse with or be party to conversations between or among, any other user of the Covered Product or Service, unless: A. For a Child user, the Child's Parent has provided, and not withdrawn, their Affirmative Express Consent through an easily-located Privacy Setting; and\n\nB. For a Teen user, the Teen (or the Teen's Parent) has provided, and not withdrawn, their Affirmative Express Consent through an easily-located Privacy Setting.\n\nC. Each Clear and Conspicuous disclosure required pursuant to sub-Provisions III.A. and III.B. must identify: (1) each type of Covered Information that will be disclosed; (2) each category of Persons to which each type of Covered Information will be disclosed; (3) each type of communication the Child or Teen will be able to make or receive; and (4) each category of Persons to, or from which, the Child or Teen will be able to make, or receive, each type of communication.\n\n1. Any user of any Covered Product or Service that is a Website or Online Service Directed to Children must be deemed a Child, provided, however, that for any such Covered Product or Service that does not target Children as its primary audience, Defendant may collect age 18 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 18 of 45 from users before collecting any other Covered Information ., ·' and treat eat.,· ser accordingly unless and until Defendant has actual knowledge that the user is a Child or Teen;\n\n3. To the extent that a display name of a Child or Teen is disclosed in a multiuser game or other interactive multiuser experience to identify participating users, such display name will not be considered Covered Information. Provided, however, Defendant must describe: (i) in a direct notice to parents, any such disclosure of a Child's display name; and (ii) in Defendant's privacy policy, any such disclosure of a Child's or Teen's display name.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Deceptive Design / Dark Patterns" ], "remedy_types": [ "Prohibition" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "IV", "title": "Mandated Privacy Program", "category": "affirmative_obligation", "summary": "Each Covered Business must establish, implement, and maintain a comprehensive written Privacy Program that includes risk assessments, safeguards, employee training, service provider oversight, and annual evaluations.", "verbatim_text": "Document in writing the content, implementation, and maintenance of the fivacy Program;·\n\nB. Provide the written program and any evaluations thereof or updates thereto to its board of directors or governing body, or if no such board or equivalent governing body exists, to a senior officer responsible for the Privacy Program at least once every twelve (12) months;\n\nC. Designate a qualified employee or employees to coordinate and be responsible for the Privacy Program;\n\nD. Assess and document, at least once every twelve (12) months, internal and external risks to the privacy of Covered Information that could result in the unauthorized collection, maintenance, use, or disclosure of, or provision of access to, Covered Information;\n\nE. Design, implement, maintain, and document safeguards that control for the material internal and external risks the Covered Business identifies to the privacy of Covered Information identified in response to sub-Provision IV.D. Each safeguard must be based on the volume and sensitivity of the Covered Information that is at risk, and the likelihood that the risk could be realized and result in the unauthorized collection, maintenance, use, or disclosure of, or provision of access to, Covered Information. Such safeguards must include: 1. Policies, procedures, and technical measures to comply with COPPA and the COPP A Rule; 20 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 20 of 45 Policies, procedures, and technical measures to comply with Provision III; 3. Regular COPPA Rule training on at least an annual basis for all employees and contractors providing services to the Covered Business whose responsibilities include any of the following: (a) access to Covered Information; (b) Covered Products or Services design, engineering, or implementation; or ( c) Privacy Settings design, engineering, or implementation; and 4. Regular privacy training programs for all employees and contractors providing services to the Covered Business, updated on at least an annual basis to address any identified material internal or external risks and safeguards implemented pursuant to this Order;\n\nF. Assess, at least once every twelve (12) months, the sufficiency of any safeguards in place to address the internal and external risks to the privacy of Covered Information, and modify the Privacy Program as needed based on the results;\n\nG. Test and monitor the effectiveness of the safeguards at least once every twelve (12) months, and modify the Privacy Program as needed based on the results;\n\nH. Select and retain service providers capable of safeguarding Covered Information they access through or receive from the Covered Business, and contractually require service providers to implement and maintain 21 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 21 of 45 sufficient to address the internal and external risks to the privacy of Covered Information; and\n\nI. Evaluate and adjust the Privacy Program in light of any changes to the Covered Business's operations or business arrangements, new or more efficient technological or operational methods to control for the risks identified in sub-Provision IV.D of this Order, or any other circumstances that the Covered Business knows or has reason to know may have an impact on the effectiveness of the Privacy Program or any of its individual safeguards. At a minimum, the Covered Business must evaluate the Privacy Program at least once every twelve ( 12) months and modify the Privacy Program as needed based on the results.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "V", "title": "Privacy Assessments by a Third Party", "category": "assessment", "summary": "Defendant must obtain initial and biennial assessments of its Privacy Program from a qualified, independent third-party Assessor approved by the FTC's Associate Director for Enforcement, and submit or retain those assessments as specified.", "verbatim_text": "A. The Assessment must be obtained from a qualified, objective, independent third-party professional (\"Assessor\"), who: (1) uses procedures and standards generally accepted in the profession; (2) conducts an independent review of the Privacy Program; (3) retains all documents relevant to each Assessment for five (5) years after completion of such Assessment; and (4) will provide such documents to the Commission within ten ( 10) days of receipt of a written request from a representative of the Commission. The 22 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 22 of 45 may not withhold any documents from the Conunission on the basis of a claim oi confidentiality, p1 ·prietary or trade secrets, work product protection, attorney-client privilege, statutory exemption, or any similar claim.\n\nB. For each Assessment, Defendant must provide the Associate Director for Enforcement for the Bureau of Consumer Protection at the Federal Trade Commission with the name, affiliation, and qualifications of the proposed Assessor, whom the Associate Director shall have the authority to approve in their sole discretion.\n\nC. Within ten (10) days of receiving notice that the Associate Director for Enforcement has approved a proposed Assessor, Defendant must file a joint notice of the selection of the Assessor with the Court.\n\nD. The reporting period for the Assessments must cover: (1) the first 180 days after the Privacy Program has been put in place for the initial Assessment; and (2) each two-year period thereafter for twenty (20) years after the entry date of the Order for the biennial Assessments.\n\nE. Each Assessment must, for the entire assessment period: 1. Determine whether each Covered Business has implemented and maintained the Privacy Program required by Provision IV of this Order, titled Mandated Privacy Program; 2. Assess the effectiveness of each Covered Business's implementation and maintenance of sub-Provisions IV.A-I; 23 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 23 of 45 Identify any gaps or weaknesses in, or instances of material noncomplianc -· 'th, the Privacy Program; 4. Address the status of gaps or weaknesses in, or instances of material non-compliance with, the Privacy Program that were identified in any prior Assessment required by this Order; and 5. Identify specific evidence (including but not limited to documents reviewed, sampling and testing performed, and interviews conducted) examined to make such determinations, assessments, and identifications, and explain why the evidence that the Assessor examined is: (a) appropriate for assessing an enterprise of the Covered Business's size, complexity, and risk profile; and (b) sufficient to justify the Assessor's findings. No finding of any Assessment shall rely primarily on assertions or attestations by a Covered Business's management. The Assessment must be signed by the Assessor, state that the Assessor conducted an independent review of the Privacy Program and did not rely primarily on assertions or attestations by a Covered Business's management, and state the number of hours that each member of the assessment team worked on the Assessment. To the extent that a Covered Business adds, materially revises, or materially updates one or more safeguards required under Provision IV of this Order during an Assessment period, the Assessment must assess the _ effectiveness of the added, materially revised, or materially updated 24 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 24 of 45 for the time period in which it was in effect, and provide a ' ~ ·e parate statement detailing the basis for each additional, materially revised, or materially updated safeguard.\n\nF. Each Assessment must be completed within sixty (60) days after the end of the reporting period to which the Assessment applies. Unless otherwise directed by a Commission representative in writing, Defendant must submit an unredacted copy of the initial Assessment and a proposed redacted copy suitable for public disclosure of the initial Assessment to the Commission within ten ( 10) days after the Assessment has been completed via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: \"United States v. Epic Games, Inc., FTC File No. 2223087.\" Defendant must retain an unredacted copy of each subsequent biennial Assessment as well as a proposed redacted copy suitable for public disclosure of each subsequent biennial Assessment until the Order is terminated and provide it to the Associate Director for Enforcement within ten ( 10) days ofrequest. The initial Assessment and any subsequent biennial Assessment provided to the Commission must be marked, in the upper right-hand corner of each page, with the words \"DPIP Assessment\" in red lettering.\n\nWithin ten (10) days after the completion of each Assessment, Defendant must file an unredacted copy of the Assessment with the Court. The Paru~ acknowledge that the Assessments may contain confidential business information, personal or financial inf01mation, trade secrets, or otherwise competitively sensitive information. Any Assessment containing such information shall be filed under seal and accompanied by a submission demonstrating good cause for sealing the Assessment.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "VI", "title": "Cooperation with Third-Party Privacy Assessor", "category": "affirmative_obligation", "summary": "Defendant must fully cooperate with the third-party Assessor by providing all relevant information, network and IT asset access, and disclosing all material facts without misrepresentation.", "verbatim_text": "A. Provide or otherwise make available to the Assessor all information.and material in its possession, custody, or control that is relevant to the Assessment for which there is no reasonable claim of privilege;\n\nB. Provide or otherwise make available to the Assessor information about each Covered Business's network(s), and all of each Covered Business's IT assets so that the Assessor can determine the scope of the Assessment, and visibility to those portions of the network(s) and IT assets deemed in scope; and\n\nC. Disclose all material facts to the Assessor, and not misrepresent in any manner, expressly or by implication, any fact material to the Assessor's: 26 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 26 of 45 determination of whether Defendant has implemented and maintained the Privacy Program required by Prov rs on IV of this 01 :er, titled Mandated Privacy Program; (2) assessment of the effectiveness of the implementation and maintenance of sub-Provisions IV.A-I; or (3) identification of any gaps or weaknesses in, or instances of material noncompliance with, the Privacy Program.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "VII", "title": "Annual Certification", "category": "compliance_reporting", "summary": "Starting one year after the Compliance Date and each year thereafter for ten years, Defendant must submit annual certifications from the Principal Executive Officer and senior officers of each Covered Business confirming compliance with the Order and disclosing any known material noncompliance.", "verbatim_text": "A. Defendant must provide the Commission with a certification from the Principal Executive Officer that: (1) Defendant has established, implemented, and maintained the requirements of this Order; and (2) Defendant is not aware of any material noncompliance that has not been (a) corrected or (b) disclosed to the Commission. The certification must be based on the personal knowledge of the Principal Executive Officer or subject matter experts upon whom the Principal Executive Officer reasonably relies in making the certification.\n\nB. Defendant must provide the Commission with a certification from a senior officer of each Covered Business other than Defendant responsible for each such Covered Business's Privacy Program that: (1) each Covered Business other than Defendant has established, implemented, and maintained the requirements of this Order; and (2) each Covered Business other than 27 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 27 of 45 efendant is not aware of any material noncompliance that has not been (a) corrected or (b) disc osed to the Comm ion. The certification must be based on the personal knowledge of the senior corporate manager, senior officer, or subject matter experts upon whom the senior corporate manager or senior officer reasonably relies in making the certification.\n\nC. Unless otherwise directed by a Commission representative in writing, submit all annual certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: \"United States v. Epic Games, Inc., FTC File No. 2223087.\"", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "VIII", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Judgment of $275,000,000 is entered against Defendant as a civil penalty; Defendant must pay the full amount to the United States Treasury within seven days of Order entry.", "verbatim_text": "A. Judgment in the amount of two hundred seventy five million dollars ($275,000,000) is entered in favor of Plaintiff against Defendant as a civil penalty.\n\nB. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the United States, two hundred seventy five million dollars ($275,000,000), which, as Defendant stipulates, its undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such payment must be made within seven (7) days of entry of this Order by 28 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 28 of 45 fund transfer in accordance with instructions previously provided ut · by 1a representative aintiff.\n\nC. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all assets transferred pursuant to this Order and may not seek the return of any assets.\n\nD. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Commission in a proceeding to enforce its rights to any payment or monetary judgment pursuant to this Order.\n\nE. Defendant acknowledges that its Taxpayer Identification Numbers (Social Security Numbers or Employer Identification Numbers), which Defendant must submit to the Commission, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "IX", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must acknowledge receipt of the Order, deliver copies to relevant personnel, and obtain signed acknowledgments of receipt within specified timeframes.", "verbatim_text": "A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For five (5) years after entry of this Order, Defendant must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers 29 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 29 of 45 members; (2) all employees, agents, and representatives having manic erial responsibilities for conduct related to the subject matter of the '· Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.\n\nC. From each individual or entity to which Defendant delivered a copy of this Order, Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "X", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must file a compliance report one year after Order entry, submit notices of material changes within 14 days for ten years, and notify the Commission of any bankruptcy filing within 14 days.", "verbatim_text": "A. One (1) year after entry of this Order, Defendant must submit a compliance report, sworn under penalty of perjury: 1. Defendant must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Defendant; (b) identify all of Defendant's businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; ( c) describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales; ( d) describe in detail whether and how Defendant 30 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 30 of 45 s in compliance with each provision of this Order; and (e) provide a copy of each Order Acknowledgment obtained pursuant to this Order,-· ;jll.\" unless previously submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following: 1. Defendant must report any change in: (a) any designated point of contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.\n\nC. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days of its filing.\n\nD. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: \"I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: __\" and supplying the date, signatory's full name, title (if applicable), and signature.\n\notherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed' - DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: \"United States v. Epic Games, Inc., FTC File No. 2223087.\"", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "XI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain specific records for designated periods, including accounting records, personnel records, consumer complaints, and all records necessary to demonstrate full compliance with the Order.", "verbatim_text": "IT IS FURTHER ORDERED that Defendant must create certain records for ten (10) years after entry of the Order, and retain each such record for five (5) years. Specifically, Defendant must create and retain the following records: A. Accounting records showing the revenues from all goods or services sold in connection to any Covered Product or Service;\n\nB. Personnel records showing, for each Person providing services in connection to any Covered Product or Service, whether as an employee or otherwise, that Person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for tern1ination;\n\nC. Copies or records of all consumer complaints and refund requests concerning the subject matter of the Order, whether received directly or through any domestic government regulatory authority; and\n\nD. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "XII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through information requests, depositions, document production, direct communications, employee interviews, and other lawful means including undercover methods.", "verbatim_text": "A. Within fourteen ( 14) days of receipt of a written request from a representative of the Commission or Plaintiff, Defendant must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying. The Commission and Plaintiff are also authorized to obtain discovery, without further leave of court, using any of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69, provided that Defendant, after attempting to resolve a dispute without court action and for good cause shown, may file a motion with this Court seeking an order for one or more of the protections set forth in Rule 26( c ).\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate directly with Defendant. Defendant must permit representatives of the Commission and Plaintiff to interview any employee or other Person affiliated with Defendant who has agreed to such an interview. The Person interviewed may have counsel present.\n\nC. The Commission and Plaintiff may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Defendant or any individual or entity affiliated 33 Case 5:22-cv-00518-BO-RN Document 15 Filed 02/07/23 Page 33 of 45 Defendant, without the necessity of identification or prior notice. Not 1iig in this Ordet''I its the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-l.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "XIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "02.23_epic_games", "company_name": "Epic Games, Inc.", "date_issued": "2023-02-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923203-epic-games-matter", "docket_number": "5:22-CV-00518" }, { "provision_number": "14", "title": "Injunction Against COPPA Violations", "category": "prohibition", "summary": "Defendant is enjoined from violating the Children's Online Privacy Protection Rule in connection with any website or online service directed to children.", "verbatim_text": "2277 AA.. ffaaiilliinngg ttoo pprroovviiddee ssuuffffiicciieenntt nnoottiiccee ooff tthhee iinnffoorrmmaattiioonn DDeeffeennddaanntt ccoolllleeccttss oonnlliinnee 2288 oonnsseenntt DDeeccrreeee PPaaggee 44 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page8 of 31 11 ffrroomm cchhiillddrreenn,, hhooww iitt uusseess ssuucchh iinnffoorrmmaattiioonn,, iittss ddiisscclloossuurree pprraaccttiicceess,, aanndd aallll ootthheerr 22\n\n33 BB.. ffaaiilliinngg ttoo pprroovviiddee ddiirreecctt nnoottiiccee ttoo ppaarreennttss ooff wwhhaatt iinnffoorrmmaattiioonn DDeeffeennddaanntt ccoolllleeccttss 44 oonnlliinnee ffrroomm cchhiillddrreenn,, hhooww iitt uusseess ssuucchh iinnffoorrmmaattiioonn,, iittss ddiisscclloossuurree pprraaccttiicceess,, aanndd 55 66 aallll ootthheerr rreeqquuiirreedd ccoonntteenntt,, aass rreeqquuiirreedd bbyy SSeeccttiioonn 331122..44((cc )) ooff tthhee RRuullee,, 1166 CC..FF..RR.. 77\n\n88 CC.. ffaaiilliinngg ttoo oobbttaaiinn vveerriiffiiaabbllee ppaarreennttaall ccoonnsseenntt bbeeffoorree aannyy ccoolllleeccttiioonn,, uussee,, aanndd//oorr 99 ddiisscclloossuurree ooff ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, aass rreeqquuiirreedd bbyy SSeeccttiioonn 331122..55 ooff 1100\n\n1122 DD.. ffaaiilliinngg ttoo eessttaabblliisshh aanndd mmaaiinnttaaiinn rreeaassoonnaabbllee pprroocceedduurreess ttoo pprrootteecctt tthhee 1133 ccoonnffiiddeennttiiaalliittyy,, sseeccuurriittyy,, aanndd iinntteeggrriittyy ooff ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd ffrroomm 1144\n\n1155 EE.. vviioollaattiinngg aannyy ootthheerr pprroovviissiioonn ooff tthhee RRuullee,, 1166 CC..FF..RR.. PPaarrtt 331122,, aanndd aass tthhee RRuullee mmaayy 1166 1177 hheerreeaafftteerr bbee aammeennddeedd.. AA ccooppyy ooff tthhee RRuullee iiss aattttaacchheedd hheerreettoo aass \"\"AAppppeennddiixx AA\"\" 1188", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "15", "title": "Prohibition Against Misrepresentations About Children's Information", "category": "prohibition", "summary": "Defendant is enjoined from making any misrepresentation concerning the collection, use, disclosure, or deletion of children's personal information.", "verbatim_text": "wwiitthh tthhee ooppeerraattiioonn ooff aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee,, ffrroomm mmaakkiinngg aannyy mmiissrreepprreesseennttaattiioonn 2255 ccoonncceerrnniinngg tthhee ccoolllleeccttiioonn,, uussee,, ddiisscclloossuurree,, oorr ddeelleettiioonn ooff cchhiillddrreenn''ss ppeerrssoonnaall iinnffoorrmmaattiioonn..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "16", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected and maintained in violation of the Rule from April 21, 2000 through the date of entry of the Order.", "verbatim_text": "nnoottiiccee ooff tthhee eennttrryy ooff tthhiiss OOrrddeerr sshhaallll ddeelleettee aallll ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd aanndd 44 mmaaiinnttaaiinneedd wwiitthhiinn iittss ppoosssseessssiioonn,, ccuussttooddyy,, oorr ccoonnttrrooll iinn vviioollaattiioonn ooff tthhee RRuullee aatt aannyy ttiimmee 55 66 ffrroomm AApprriill 2211,, 22000000 tthhrroouugghh tthhee ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "17", "title": "Consumer Education Remedy", "category": "affirmative_obligation", "summary": "Defendant must place a clear and conspicuous notice on websites directed to children that provides a hyperlink to FTC privacy tips for 5 years.", "verbatim_text": "88 1177.. IITT IISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt,, ffoorr aa ppeerriioodd ooff 55 yyeeaarrss ffrroomm tthhee ddaattee ooff eennttrryy ooff tthhiiss 99 OOrrddeerr,, DDeeffeennddaanntt,, iinn ccoonnnneeccttiioonn wwiitthh iittss ooppeerraattiioonn ooff aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee 1100 1111 ddiirreecctteedd ttoo cchhiillddrreenn,, aanndd aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee tthhrroouugghh wwhhiicchh DDeeffeennddaanntt,, wwiitthh 1122 aaccttuuaall kknnoowwlleeddggee,, ccoolllleeccttss,, uusseess,, aanndd//oorr ddiisscclloosseess ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, 1133 sshhaallll ppllaaccee aa cclleeaarr aanndd ccoonnssppiiccuuoouuss nnoottiiccee,, tthhaatt wwiillll uunnaavvooiiddaabbllyy bbee sseeeenn bbyy uusseerrss pprriioorr ttoo 1144 tthhee ccoolllleeccttiioonn ooff ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm tthhee uusseerrss,, wwhhiicchh ssttaatteess aass ffoolllloowwss iinn bboolldd 1155 ttyyppeeffaaccee:: 1166 1177 NNOOTTIICCEE:: VViissiitt wwwwww..OOnnGGuuaarrddOOnnlliinnee..ggoovv ffoorr ttiippss ffrroomm tthhee FFeeddeerraall TTrraaddee CCoommmmiissssiioonn oonn pprrootteeccttiinngg kkiiddss'' pprriivvaaccyy oonnlliinnee 1188 [[\"\"wwwwww..OOnngguuaarrddOOnnlliinnee..ggoovv\"\" mmuusstt ccoonnttaaiinn aa hhyyppeerrlliinnkk ttoo\n\n1199 hhttttpp::////wwwwww..oonngguuaarrddoonnlliinnee.. ggoovv// ttooppiiccss//kkiiddss--pprriivvaaccyy ..aassppxx]] 2200 DDeeffeennddaanntt sshhaallll bbee rreeqquuiirreedd ttoo cchhaannggee tthhee hhyyppeerrlliinnkkss//UURRLLss wwiitthhiinn 1155 ddaayyss aafftteerr rreecceeiipptt 2211", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "18", "title": "Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $250,000 to the United States within 5 days of receipt of notice of entry of the Order.", "verbatim_text": "2233 1188.. IITT IISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt DDeeffeennddaanntt sshhaallll ppaayy ttoo PPllaaiinnttiiffff aa cciivviill ppeennaallttyy,, 2244 2255 ppuurrssuuaanntt ttoo SSeeccttiioonn 55((mm))((11))((AA)) ooff tthhee FFTTCC AAcctt,, 1155 UU..SS..CC.. §§ 4455((mm))((11))((AA)),, iinn tthhee aammoouunntt 2266 ooff ttwwoo hhuunnddrreedd aanndd ffiiffttyy tthhoouussaanndd ddoollllaarrss (($$225500,,000000)),, dduuee aanndd ppaayyaabbllee wwiitthhiinn ffiivvee ((55)) 2277 ddaayyss ooff rreecceeiipptt ooff nnoottiiccee ooff tthhee eennttrryy ooff tthhiiss OOrrddeerr.. UUnnlleessss ootthheerrwwiissee ddiirreecctteedd,, ppaayymmeenntt 2288 oonnsseenntt DDeeccrreeee PPaaggee 66 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page10 of 31 11 sshhaallll bbee mmaaddee bbyy eelleeccttrroonniicc ffuunndd ttrraannssffeerr iinn aaccccoorrddaannccee wwiitthh pprroocceedduurreess ssppeecciiffiieedd bbyy tthhee 22 CCoonnssuummeerr PPrrootteeccttiioonn BBrraanncchh,, CCiivviill DDiivviissiioonn,, UU..SS.. DDeeppaarrttmmeenntt ooff JJuussttiiccee,, WWaasshhiinnggttoonn,, 33", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "22", "title": "Prohibition Against Misrepresentations About Consumer Information Security", "category": "prohibition", "summary": "Defendant must not misrepresent the extent to which it maintains and protects the privacy, confidentiality, security, or integrity of consumer personal information.", "verbatim_text": "2244 2255 mmiissrreepprreesseenntt iinn aannyy mmaannnneerr,, eexxpprreessssllyy oorr bbyy iimmpplliiccaattiioonn,, tthhee eexxtteenntt ttoo wwhhiicchh tthheeyy 2266 mmaaiinnttaaiinn aanndd pprrootteecctt tthhee pprriivvaaccyy,, ccoonnffiiddeennttiiaalliittyy,, sseeccuurriittyy,, oorr iinntteeggrriittyy ooff ccoonnssuummeerr 2277 ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd ffii--oomm oorr aabboouutt ccoonnssuummeerrss..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Prohibition" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "23", "title": "Information Security Program", "category": "affirmative_obligation", "summary": "Defendant must establish and implement a comprehensive information security program to protect the security, confidentiality, and integrity of consumer personal information.", "verbatim_text": "Case3:12-cv-01487-SI Document4 Filed03/28/12 Page11 of 31 11 33.. IITT IISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt DDeeffeennddaanntt,, aanndd iittss ooffffiicceerrss,, aaggeennttss,, rreepprreesseennttaattiivveess,, 22 aanndd eemmppllooyyeeeess,, ddiirreeccttllyy oorr tthhrroouugghh aannyy ccoorrppoorraattiioonn,, ssuubbssiiddiiaarryy,, lliimmiitteedd lliiaabbiilliittyy 33 ccoommppaannyy,, ddiivviissiioonn,, oorr ootthheerr ddeevviiccee,, iinn ccoonnnneeccttiioonn wwiitthh tthhee aaddvveerrttiissiinngg,, mmaarrkkeettiinngg,, 44 pprroommoottiioonn,, ooffffeerriinngg ffoorr ssaallee,, oorr ssaallee ooff aannyy pprroodduucctt oorr sseerrvviiccee,, iinn oorr aaffffeeccttiinngg ccoommmmeerrccee,, 55 66 sshhaallll,, nnoo llaatteerr tthhaann tthhee ddaattee ooff sseerrvviiccee ooff tthhiiss oorrddeerr,, eessttaabblliisshh aanndd iimmpplleemmeenntt,, aanndd 77 tthheerreeaafftteerr mmaaiinnttaaiinn,, aa ccoommpprreehheennssiivvee iinnffoorrmmaattiioonn sseeccuurriittyy pprrooggrraamm tthhaatt iiss rreeaassoonnaabbllyy 88 ddeessiiggnneedd ttoo pprrootteecctt tthhee sseeccuurriittyy,, ccoonnffiiddeennttiiaalliittyy,, aanndd iinntteeggrriittyy ooff ccoonnssuummeerr ppeerrssoonnaall 99 iinnffoorrmmaattiioonn ccoolllleecctteedd ffrroomm oorr aabboouutt ccoonnssuummeerrss.. SSuucchh pprrooggrraamm,, tthhee ccoonntteenntt aanndd 1100 1111 iimmpplleemmeennttaattiioonn ooff wwhhiicchh mmuusstt bbee ffuullllyy ddooccuummeenntteedd iinn wwrriittiinngg,, sshhaallll ccoonnttaaiinn 1122 aaddmmiinniissttrraattiivvee,, tteecchhnniiccaall,, aanndd pphhyyssiiccaall ssaaffeegguuaarrddss aapppprroopprriiaattee ttoo DDeeffeennddaanntt''ss ssiizzee aanndd 1133 ccoommpplleexxiittyy,, tthhee nnaattuurree aanndd ssccooppee ooff DDeeffeennddaanntt''ss aaccttiivviittiieess,, aanndd tthhee sseennssiittiivviittyy ooff tthhee 1144\n\n1155 AA.. tthhee ddeessiiggnnaattiioonn ooff aann eemmppllooyyeeee oorr eemmppllooyyeeeess ttoo ccoooorrddiinnaattee aanndd bbee aaccccoouunnttaabbllee ffoorr 1166\n\n1188 BB.. tthhee iiddeennttiiffiiccaattiioonn ooff mmaatteerriiaall iinntteerrnnaall aanndd eexxtteerrnnaall rriisskkss ttoo tthhee sseeccuurriittyy,, 1199 ccoonnffiiddeennttiiaalliittyy,, aanndd iinntteeggrriittyy ooff ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn tthhaatt ccoouulldd rreessuulltt 2200 iinn tthhee uunnaauutthhoorriizzeedd ddiisscclloossuurree,, mmiissuussee,, lloossss,, aalltteerraattiioonn,, ddeessttrruuccttiioonn,, oorr ootthheerr 2211 2222 ccoommpprroommiissee ooff ssuucchh iinnffoorrmmaattiioonn,, aanndd aasssseessssmmeenntt ooff tthhee ssuuffffiicciieennccyy ooff aannyy 2233 ssaaffeegguuaarrddss iinn ppllaaccee ttoo ccoonnttrrooll tthheessee rriisskkss.. AAtt aa mmiinniimmuumm,, tthhiiss rriisskk aasssseessssmmeenntt 2244 sshhoouulldd iinncclluuddee ccoonnssiiddeerraattiioonn ooff rriisskkss iinn eeaacchh aarreeaa ooff rreelleevvaanntt ooppeerraattiioonn,, iinncclluuddiinngg,, 2255 bbuutt nnoott lliimmiitteedd ttoo:: ((11)) eemmppllooyyeeee ttrraaiinniinngg aanndd mmaannaaggeemmeenntt;; ((22)) iinnffoorrmmaattiioonn 2266 ssyysstteemmss,, iinncclluuddiinngg nneettwwoorrkk aanndd ssooffttwwaarree ddeessiiggnn,, iinnffoorrmmaattiioonn pprroocceessssiinngg,, ssttoorraaggee,, 2277 2288 ttrraannssmmiissssiioonn,, aanndd ddiissppoossaall;; aanndd ((33)) pprreevveennttiioonn,, ddeetteeccttiioonn,, aanndd rreessppoonnssee ttoo aattttaacckkss,, oonnsseenntt DDeeccrreeee PPaaggee 88 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page12 of 31 11\n\nCC.. tthhee ddeessiiggnn aanndd iimmpplleemmeennttaattiioonn ooff rreeaassoonnaabbllee ssaaffeegguuaarrddss ttoo ccoonnttrrooll tthhee 33 rriisskkss iiddeennttiiffiieedd tthhrroouugghh rriisskk aasssseessssmmeenntt,, aanndd rreegguullaarr tteessttiinngg oorr mmoonniittoorriinngg 44 ooff tthhee eeffffeeccttiivveenneessss oofftthhee ssaaffeegguuaarrddss'' kkeeyy ccoonnttrroollss,, ssyysstteemmss,, aanndd 55 66 pprroocceedduurreess..\n\n77 DD.. tthhee ddeevveellooppmmeenntt aanndd uussee ooff rreeaassoonnaabbllee sstteeppss ttoo sseelleecctt aanndd rreettaaiinn sseerrvviiccee pprroovviiddeerrss 88 ccaappaabbllee ooff aapppprroopprriiaatteellyy ssaaffeegguuaarrddiinngg ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn tthheeyy 99 rreecceeiivvee ffrroomm DDeeffeennddaanntt,, aanndd rreeqquuiirriinngg sseerrvviiccee pprroovviiddeerrss bbyy ccoonnttrraacctt ttoo iimmpplleemmeenntt 1100\n\n1122 EE.. tthhee eevvaalluuaattiioonn aanndd aaddjjuussttmmeenntt ooff DDeeffeennddaanntt''ss iinnffoorrmmaattiioonn sseeccuurriittyy 1133 pprrooggrraamm iinn lliigghhtt ooff tthhee rreessuullttss ooff tthhee tteessttiinngg aanndd mmoonniittoorriinngg rreeqquuiirreedd bbyy 1144 ssuubbppaarrtt CC,, aannyy mmaatteerriiaall cchhaannggeess ttoo DDeeffeennddaanntt''ss ooppeerraattiioonnss oorr bbuussiinneessss 1155 aarrrraannggeemmeennttss,, oorr aannyy ootthheerr cciirrccuummssttaanncceess tthhaatt DDeeffeennddaanntt kknnoowwss oorr hhaass 1166 1177 rreeaassoonn ttoo kknnooww mmaayy hhaavvee aa mmaatteerriiaall iimmppaacctt oonn tthhee eeffffeeccttiivveenneessss ooff iittss 1188", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "24", "title": "Third-Party Security Assessments", "category": "assessment", "summary": "Defendant must obtain initial and biennial assessments from a qualified, objective, independent third-party professional for 20 years.", "verbatim_text": "ooff tthhiiss oorrddeerr,, DDeeffeennddaanntt sshhaallll oobbttaaiinn iinniittiiaall aanndd bbiieennnniiaall aasssseessssmmeennttss aanndd rreeppoorrttss 2211 2222 ((\"\"AAsssseessssmmeennttss\"\")) ffrroomm aa qquuaalliiffiieedd,, oobbjjeeccttiivvee,, iinnddeeppeennddeenntt tthhiirrdd--ppaarrttyy pprrooffeessssiioonnaall,, wwhhoo 2233 uusseess pprroocceedduurreess aanndd ssttaannddaarrddss ggeenneerraallllyy aacccceepptteedd iinn tthhee pprrooffeessssiioonn.. TThhee rreeppoorrttiinngg ppeerriioodd 2244 ffoorr tthhee AAsssseessssmmeennttss sshhaallll ccoovveerr:: ((11)) tthhee ffiirrsstt yyeeaarr aafftteerr sseerrvviiccee ooff tthhee OOrrddeerr ffoorr tthhee iinniittiiaall 2255 AAsssseessssmmeenntt,, aanndd ((22)) eeaacchh 22 yyeeaarr ppeerriioodd tthheerreeaafftteerr ffoorr 2200 yyeeaarrss aafftteerr sseerrvviiccee ooff tthhee OOrrddeerr 2266 ffoorr tthhee bbiieennnniiaall AAsssseessssmmeennttss..\n\nCase3:12-cv-01487-SI Document4 Filed03/28/12 Page13 of 31 11 AA.. EEaacchh AAsssseessssmmeenntt sshhaallll:: 22 11.. sseett ffoorrtthh tthhee ssppeecciiffiicc aaddmmiinniissttrraattiivvee,, tteecchhnniiccaall,, aanndd pphhyyssiiccaall ssaaffeegguuaarrddss 33 tthhaatt DDeeffeennddaanntt hhaass iimmpplleemmeenntteedd aanndd mmaaiinnttaaiinneedd dduurriinngg tthhee rreeppoorrttiinngg 44 ppeerriioodd;; 55 66 22.. eexxppllaaiinn hhooww ssuucchh ssaaffeegguuaarrddss aarree aapppprroopprriiaattee ttoo DDeeffeennddaanntt''ss ssiizzee aanndd 77 ccoommpplleexxiittyy,, tthhee nnaattuurree aanndd ssccooppee ooff DDeeffeennddaanntt''ss aaccttiivviittiieess,, aanndd tthhee 88 sseennssiittiivviittyy ooff tthhee ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd ffrroomm oorr aabboouutt 99 ccoonnssuummeerrss;; 1100 1111 33.. eexxppllaaiinn hhooww tthhee ssaaffeegguuaarrddss tthhaatt hhaavvee bbeeeenn iimmpplleemmeenntteedd mmeeeett oorr eexxcceeeedd 1122 tthhee pprrootteeccttiioonnss rreeqquuiirreedd bbyy tthhee PPaarraaggrraapphh 2233 ooff tthhiiss OOrrddeerr;; aanndd 1133 44.. cceerrttiiffyy tthhaatt DDeeffeennddaanntt''ss sseeccuurriittyy pprrooggrraamm iiss ooppeerraattiinngg wwiitthh ssuuffffiicciieenntt 1144 eeffffeeccttiivveenneessss ttoo pprroovviiddee rreeaassoonnaabbllee aassssuurraannccee tthhaatt tthhee sseeccuurriittyy,, 1155 ccoonnffiiddeennttiiaalliittyy,, aanndd iinntteeggrriittyy ooff ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn iiss 1166\n\n1188 BB.. EEaacchh AAsssseessssmmeenntt sshhaallll bbee pprreeppaarreedd aanndd ccoommpplleetteedd wwiitthhiinn 6600 ddaayyss aafftteerr tthhee eenndd ooff 1199 tthhee rreeppoorrttiinngg ppeerriioodd ttoo wwhhiicchh tthhee AAsssseessssmmeenntt aapppplliieess bbyy aa ppeerrssoonn qquuaalliiffiieedd aass aa 2200 CCeerrttiiffiieedd IInnffoorrmmaattiioonn SSyysstteemm SSeeccuurriittyy PPrrooffeessssiioonnaall ((CCIISSSSPP)) oorr aass aa CCeerrttiiffiieedd 2211 2222 IInnffoorrmmaattiioonn SSyysstteemmss AAuuddiittoorr ((CCIISSAA));; aa ppeerrssoonn hhoollddiinngg GGlloobbaall IInnffoorrmmaattiioonn 2233 AAssssuurraannccee CCeerrttiiffiiccaattiioonn ((GGIIAACC)) ffrroomm tthhee SSyyssAAddmmiinn,, AAuuddiitt,, NNeettwwoorrkk,, SSeeccuurriittyy 2244 ((SSAANNSS)) IInnssttiittuuttee;; oorr aa qquuaalliiffiieedd ppeerrssoonn oorr oorrggaanniizzaattiioonn aapppprroovveedd bbyy tthhee AAssssoocciiaattee 2255 DDiirreeccttoorr ffoorr EEnnffoorrcceemmeenntt,, BBuurreeaauu ooff CCoonnssuummeerr PPrrootteeccttiioonn,, FFeeddeerraall TTrraaddee 2266\n\n11 CC.. DDeeffeennddaanntt sshhaallll pprroovviiddee tthhee iinniittiiaall AAsssseessssmmeenntt ttoo tthhee AAssssoocciiaattee DDiirreeccttoorr ffoorr 22 EEnnffoorrcceemmeenntt,, BBuurreeaauu ooff CCoonnssuummeerr PPrrootteeccttiioonn,, FFeeddeerraall TTrraaddee CCoommmmiissssiioonn,, 33\n\n44 AAllll ssuubbsseeqquueenntt bbiieennnniiaall AAsssseessssmmeennttss sshhaallll bbee rreettaaiinneedd bbyy DDeeffeennddaanntt uunnttiill tthhee 55 66 oorrddeerr iiss tteerrmmiinnaatteedd aanndd pprroovviiddeedd ttoo tthhee AAssssoocciiaattee DDiirreeccttoorr ffoorr EEnnffoorrcceemmeenntt wwiitthhiinn 77", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "25", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain acknowledgments of receipt of the Order from itself and deliver the Order to specified personnel and entities.", "verbatim_text": "1122 AA.. DDeeffeennddaanntt,, wwiitthhiinn 77 ddaayyss ooff eennttrryy ooff tthhiiss OOrrddeerr,, mmuusstt ssuubbmmiitt ttoo tthhee CCoommmmiissssiioonn 1133 aann aacckknnoowwlleeddggmmeenntt ooff rreecceeiipptt ooff tthhiiss OOrrddeerr sswwoorrnn uunnddeerr ppeennaallttyy ooff ppeerrjjuurryy..\n\nBB.. FFoorr 88 yyeeaarrss aafftteerr eennttrryy oofftthhiiss OOrrddeerr,, DDeeffeennddaanntt mmuusstt ddeelliivveerr aa ccooppyy ooff tthhiiss OOrrddeerr 1155 ttoo:: ((11)) aallll pprriinncciippaallss,, ooffffiicceerrss,, ddiirreeccttoorrss,, aanndd mmaannaaggeerrss;; ((22)) aallll eemmppllooyyeeeess,, aaggeennttss,, 1166 1177 aanndd rreepprreesseennttaattiivveess hhaavviinngg ssuuppeerrvviissoorryy rreessppoonnssiibbiilliittiieess rreellaattiinngg ttoo tthhee ccoolllleeccttiioonn,, 1188 rreetteennttiioonn,, ssttoorraaggee,, oorr sseeccuurriittyy ooff ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn aanndd aallll 1199 eemmppllooyyeeeess,, aaggeennttss,, aanndd rreepprreesseennttaattiivveess hhaavviinngg ssuuppeerrvviissoorryy rreessppoonnssiibbiilliittiieess rreellaatteedd 2200 ttoo tthhee ooppeerraattiioonn ooff aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee ssuubbjjeecctt ttoo tthhiiss OOrrddeerr;; aanndd ((33)) aannyy 2211 2222 bbuussiinneessss eennttiittyy rreessuullttiinngg ffrroomm aannyy cchhaannggee iinn ssttrruuccttuurree aass sseett ffoorrtthh iinn tthhee SSeeccttiioonn 2233 ttiittlleedd \"\"CCoommpplliiaannccee RReeppoorrttiinngg..\"\" DDeelliivveerryy mmuusstt ooccccuurr wwiitthhiinn 77 ddaayyss ooff eennttrryy ooff 2244 tthhiiss OOrrddeerr ffoorr ccuurrrreenntt ppeerrssoonnnneell.. TToo aallll ootthheerrss,, ddeelliivveerryy mmuusstt ooccccuurr bbeeffoorree tthheeyy 2255 aassssuummee tthheeiirr rreessppoonnssiibbiilliittiieess..\n\nCC.. FFrroomm eeaacchh iinnddiivviidduuaall oorr eennttiittyy ttoo wwhhiicchh aa DDeeffeennddaanntt ddeelliivveerreedd aa ccooppyy ooff tthhiiss 2277 2288 OOrrddeerr,, tthhaatt DDeeffeennddaanntt mmuusstt oobbttaaiinn,, wwiitthhiinn 3300 ddaayyss,, aa ssiiggnneedd aanndd ddaatteedd aacckknnoowwlleeddggmmeenntt ooff rreecceeiipptt ooff tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Order Administration" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "26", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must make timely submissions to the Commission including a comprehensive compliance report 180 days after entry of the Order and change notifications for 20 years.", "verbatim_text": "66.. IITT IISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt DDeeffeennddaanntt mmaakkee ttiimmeellyy ssuubbmmiissssiioonnss ttoo tthhee 33 CCoommmmiissssiioonn:: 44 AA.. OOnnee hhuunnddrreedd eeiigghhttyy ((118800)) ddaayyss aafftteerr tthhee ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr,, DDeeffeennddaanntt 55 66 mmuusstt ssuubbmmiitt aa ccoommpplliiaannccee rreeppoorrtt,, sswwoorrnn uunnddeerr ppeennaallttyy ooff ppeerrjjuurryy.. TThhiiss rreeppoorrtt 77 mmuusstt:: 88 11.. DDeessiiggnnaattee aatt lleeaasstt oonnee tteelleepphhoonnee nnuummbbeerr aanndd aann eemmaaiill,, pphhyyssiiccaall,, aanndd 99 ppoossttaall aaddddrreessss aass ppooiinnttss ooff ccoonnttaacctt,, wwhhiicchh rreepprreesseennttaattiivveess ooff tthhee 1100 1111 CCoommmmiissssiioonn mmaayy uussee ttoo ccoommmmuunniiccaattee wwiitthh DDeeffeennddaanntt;; 1122 22.. IIddeennttiiffyy aallll ooff DDeeffeennddaanntt''ss bbuussiinneesssseess bbyy aallll ooff tthheeiirr nnaammeess,, tteelleepphhoonnee 1133 nnuummbbeerrss,, aanndd pphhyyssiiccaall,, ppoossttaall,, eemmaaiill,, aanndd IInntteerrnneett aaddddrreesssseess;; 1144 33.. DDeessccrriibbee tthhee aaccttiivviittiieess ooff eeaacchh bbuussiinneessss,, iinncclluuddiinngg tthhee pprroodduuccttss aanndd 1155 sseerrvviicceess ooffffeerreedd aanndd tthhee mmeeaannss ooff aaddvveerrttiissiinngg,, mmaarrkkeettiinngg,, aanndd ssaalleess;; 1166 1177 44.. DDeessccrriibbee iinn ddeettaaiill wwhheetthheerr aanndd hhooww DDeeffeennddaanntt iiss iinn ccoommpplliiaannccee wwiitthh eeaacchh 1188 SSeeccttiioonn ooff tthhiiss OOrrddeerr;; 1199 55.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill tthhee ccrriitteerriiaa aanndd pprroocceessss tthhrroouugghh 2200 wwhhiicchh DDeeffeennddaanntt''ss wweebbssiitteess oorr oonnlliinnee sseerrvviicceess rreeggiisstteerr vviissiittoorrss oonnlliinnee ffoorr 2211 2222 aannyy aaccttiivviittyy rreeqquuiirriinngg tthhee ssuubbmmiissssiioonn ooff ppeerrssoonnaall iinnffoorrmmaattiioonn,, aanndd aa ccooppyy 2233 ooff eeaacchh ddiiffffeerreenntt vveerrssiioonn ooff ssccrreeeenn oorr ppaaggee pprroovviiddiinngg oorr ccoolllleeccttiinngg 2244 rreeggiissttrraattiioonn iinnffoorrmmaattiioonn;; 2255 66.. PPrroovviiddee aa ccooppyy ooff eeaacchh ddiiffffeerreenntt vveerrssiioonn ooff aannyy pprriivvaaccyy nnoottiiccee ppoosstteedd oonn 2266 eeaacchh wweebbssiittee oorr oonnlliinnee sseerrvviiccee ooppeerraatteedd bbyy DDeeffeennddaanntt;; 2277 2288 77.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill eeaacchh ppllaaccee wwhheerree tthhee pprriivvaaccyy oonnsseenntt DDeeccrreeee PPaaggee 1122 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page16 of 31 11 nnoottiiccee oonn aannyy ssuucchh wweebbssiittee oorr oonnlliinnee sseerrvviiccee iiss llooccaatteedd aanndd aa ccooppyy ooff eeaacchh 22 ddiiffffeerreenntt vveerrssiioonn ooff ssccrreeeenn oorr ppaaggee oonn wwhhiicchh ssuucchh wweebbssiittee oorr oonnlliinnee 33 sseerrvviiccee ccoolllleeccttss ppeerrssoonnaall iinnffoorrmmaattiioonn;; 44 88.. PPrroovviiddee aa ccooppyy ooff eeaacchh ddiiffffeerreenntt vveerrssiioonn ooff aannyy pprriivvaaccyy nnoottiiccee sseenntt ttoo 55 66 ppaarreennttss ooff cchhiillddrreenn tthhaatt rreeggiisstteerr oonn eeaacchh wweebbssiittee oorr oonnlliinnee sseerrvviiccee;; 77 99.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill wwhheenn aanndd hhooww eeaacchh ssuucchh nnoottiiccee 88 ttoo ppaarreennttss iiss pprroovviiddeedd;; 99 1100.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill tthhee mmeetthhooddss uusseedd ttoo oobbttaaiinn 1100 1111 vveerriiffiiaabbllee ppaarreennttaall ccoonnsseenntt pprriioorr ttoo aannyy ccoolllleeccttiioonn,, uussee,, aanndd//oorr ddiisscclloossuurree 1122 ooff ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn;; 1133 1111.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill tthhee mmeeaannss pprroovviiddeedd ffoorr ppaarreennttss 1144 ttoo rreevviieeww tthhee ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd ffrroomm tthheeiirr cchhiillddrreenn aanndd ttoo 1155 rreeffuussee ttoo ppeerrmmiitt iittss ffuurrtthheerr uussee oorr mmaaiinntteennaannccee;; 1166 1177 1122.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill wwhhyy eeaacchh ttyyppee ooff iinnffoorrmmaattiioonn 00 1188 ccoolllleecctteedd ffrroomm aa cchhiilldd iiss rreeaassoonnaabbllyy nneecceessssaarryy ffoorr tthhee pprroovviissiioonn ooff tthhee 1199 ppaarrttiiccuullaarr rreellaatteedd aaccttiivviittyy;; 2200 1133.. PPrroovviiddee aa ssttaatteemmeenntt sseettttiinngg ffoorrtthh iinn ddeettaaiill tthhee pprroocceedduurreess uusseedd ttoo pprrootteecctt 2211 2222 tthhee ccoonnffiiddeennttiiaalliittyy,, sseeccuurriittyy,, aanndd iinntteeggrriittyy ooff ppeerrssoonnaall iinnffoorrmmaattiioonn 2233 ccoolllleecctteedd ffrroomm cchhiillddrreenn;; aanndd 2244 1144.. PPrroovviiddee aa ccooppyy ooff eeaacchh OOrrddeerr AAcckknnoowwlleeddggeemmeenntt oobbttaaiinneedd ppuurrssuuaanntt ttoo tthhiiss 2255 OOrrddeerr,, uunnlleessss pprreevviioouussllyy ssuubbmmiitttteedd ttoo tthhee CCoommmmiissssiioonn..\n\nBB.. FFoorr 2200 yyeeaarrss ffoolllloowwiinngg eennttrryy ooff tthhiiss OOrrddeerr,, DDeeffeennddaanntt mmuusstt ssuubbmmiitt aa ccoommpplliiaannccee 2277 2288 nnoottiiccee,, sswwoorrnn uunnddeerr ppeennaallttyy ooff ppeerrjjuurryy,, wwiitthhiinn 1144 ddaayyss ooff aannyy cchhaannggee iinn tthhee oonnsseenntt DDeeccrreeee PPaaggee 1133 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page17 of 31 11 ffoolllloowwiinngg:: ((aa)) aannyy ddeessiiggnnaatteedd ppooiinntt ooff ccoonnttaacctt;; oorr ((bb)) tthhee ssttrruuccttuurree ooff DDeeffeennddaanntt oorr 22 aannyy eennttiittyy tthhaatt DDeeffeennddaanntt hhaass aannyy oowwnneerrsshhiipp iinntteerreesstt iinn oorr ddiirreeccttllyy oorr iinnddiirreeccttllyy 33 ccoonnttrroollss tthhaatt mmaayy aaffffeecctt ccoommpplliiaannccee oobblliiggaattiioonnss aarriissiinngg uunnddeerr tthhiiss OOrrddeerr,, 44 iinncclluuddiinngg:: ccrreeaattiioonn,, mmeerrggeerr,, ssaallee,, oorr ddiissssoolluuttiioonn ooff tthhee eennttiittyy oorr aannyy ssuubbssiiddiiaarryy,, 55 66 ppaarreenntt,, oorr aaffffiilliiaattee tthhaatt eennggaaggeess iinn aannyy aaccttss oorr pprraaccttiicceess ssuubbjjeecctt ttoo tthhiiss OOrrddeerr..\n\nCC.. DDeeffeennddaanntt mmuusstt ssuubbmmiitt ttoo tthhee CCoommmmiissssiioonn nnoottiiccee ooff tthhee ffiilliinngg ooff aannyy bbaannkkrruuppttccyy 88 ppeettiittiioonn,, iinnssoollvveennccyy pprroocceeeeddiinngg,, oorr aannyy ssiimmiillaarr pprroocceeeeddiinngg bbyy oorr aaggaaiinnsstt 99 DDeeffeennddaanntt wwiitthhiinn 1144 ddaayyss ooff iittss ffiilliinngg..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "27", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create certain records for 20 years after entry of the Order, and retain each such record for 5 years.", "verbatim_text": "AA.. AAccccoouunnttiinngg rreeccoorrddss sshhoowwiinngg tthhee rreevveennuueess ffrroomm aallll ggooooddss oorr sseerrvviicceess ssoolldd,, aallll 44 ccoossttss iinnccuurrrreedd iinn ggeenneerraattiinngg tthhoossee rreevveennuueess,, aanndd tthhee rreessuullttiinngg nneett pprrooffiitt oorr lloossss;;\n\n66 BB.. PPeerrssoonnnneell rreeccoorrddss sshhoowwiinngg,, ffoorr eeaacchh ppeerrssoonn pprroovviiddiinngg sseerrvviicceess,, wwhheetthheerr aass aann 77 eemmppllooyyeeee oorr ootthheerrwwiissee,, tthhaatt ppeerrssoonn''ss:: nnaammee,, aaddddrreesssseess,, aanndd tteelleepphhoonnee nnuummbbeerrss;; 88 jjoobb ttiittllee oorr ppoossiittiioonn;; ddaatteess ooff sseerrvviiccee;; aanndd,, iiff aapppplliiccaabbllee,, tthhee rreeaassoonn ffoorr 99 tteerrmmiinnaattiioonn;;\n\n1111 CC.. AA ccooppyy ooff aallll ccoommppllaaiinnttss ssuubbmmiitttteedd bbyy ccoonnssuummeerrss ttoo DDeeffeennddaanntt rreeggaarrddiinngg iittss 1122 iinnffoorrmmaattiioonn sseeccuurriittyy pprraaccttiicceess oorr iittss pprraaccttiicceess rreellaattiinngg ttoo tthhee ccoolllleeccttiioonn oorr rreetteennttiioonn 1133 ooff ccoonnssuummeerr ppeerrssoonnaall iinnffoorrmmaattiioonn,, iinncclluuddiinngg ffrroomm cchhiillddrreenn;;\n\nDD.. AAllll rreeccoorrddss nneecceessssaarryy ttoo ddeemmoonnssttrraattee ffuullll ccoommpplliiaannccee wwiitthh eeaacchh pprroovviissiioonn ooff tthhiiss 1155 OOrrddeerr,, iinncclluuddiinngg aallll ssuubbmmiissssiioonnss ttoo tthhee CCoommmmiissssiioonn;; aanndd\n\n1177 EE.. AA ssaammppllee ccooppyy ooff eevveerryy mmaatteerriiaallllyy ddiiffffeerreenntt ffoorrmm,, ppaaggee,, oorr ssccrreeeenn ccrreeaatteedd,, 1188 mmaaiinnttaaiinneedd,, oorr ootthheerrwwiissee pprroovviiddeedd bbyy DDeeffeennddaanntt tthhrroouugghh wwhhiicchh DDeeffeennddaanntt 1199 ccoolllleeccttss ppeerrssoonnaall iinnffoorrmmaattiioonn,, aanndd aa ssaammppllee ccooppyy ooff eeaacchh mmaatteerriiaallllyy ddiiffffeerreenntt 2200 ddooccuummeenntt ccoonnttaaiinniinngg aannyy rreepprreesseennttaattiioonn rreeggaarrddiinngg DDeeffeennddaanntt''ss ccoolllleeccttiioonn,, uussee,, 2211 2222 aanndd ddiisscclloossuurree pprraaccttiicceess ppeerrttaaiinniinngg ttoo ppeerrssoonnaall iinnffoorrmmaattiioonn ooff aa cchhiilldd.. EEaacchh wweebb 2233 ppaaggee ccooppyy sshhaallll bbee aaccccoommppaanniieedd bbyy tthhee UURRLL ooff tthhee wweebb ppaaggee wwhheerree tthhee mmaatteerriiaall 2244 wwaass ppoosstteedd oonnlliinnee.. EElleeccttrroonniicc ccooppiieess sshhaallll iinncclluuddee aallll tteexxtt aanndd ggrraapphhiiccss ffiilleess,, 2255 aauuddiioo ssccrriippttss,, aanndd ootthheerr ccoommppuutteerr ffiilleess uusseedd iinn pprreesseennttiinngg iinnffoorrmmaattiioonn oonn tthhee 2266 IInntteerrnneett.. PPrroovviiddeedd,, hhoowweevveerr,, tthhaatt DDeeffeennddaanntt sshhaallll nnoott bbee rreeqquuiirreedd ttoo rreettaaiinn aannyy 2277 2288 ddooccuummeenntt ffoorr lloonnggeerr tthhaann ttwwoo ((22)) yyeeaarrss aafftteerr tthhee ddooccuummeenntt wwaass ccrreeaatteedd,, oorr ttoo oonnsseenntt DDeeccrreeee PPaaggee 1155 ooff 2200 Case3:12-cv-01487-SI Document4 Filed03/28/12 Page19 of 31 11 rreettaaiinn aa pprriinntt oorr eelleeccttrroonniicc ccooppyy ooff aannyy aammeennddeedd wweebb ppaaggee oorr ssccrreeeenn ttoo tthhee eexxtteenntt 22 tthhaatt tthhee aammeennddmmeenntt ddooeess nnoott aaffffeecctt DDeeffeennddaanntt''ss ccoommpplliiaannccee oobblliiggaattiioonnss uunnddeerr 33 tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Recordkeeping" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "28", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission is authorized to monitor compliance with this Order through various means including requests for reports, depositions, document production, interviews, and other lawful discovery methods.", "verbatim_text": "AA.. WWiitthhiinn 1144 ddaayyss ooff rreecceeiipptt ooff aa wwrriitttteenn rreeqquueesstt ffrroomm aa rreepprreesseennttaattiivvee ooff tthhee 99 CCoommmmiissssiioonn,, DDeeffeennddaanntt mmuusstt:: ssuubbmmiitt aaddddiittiioonnaall ccoommpplliiaannccee rreeppoorrttss oorr ootthheerr 1100 1111 rreeqquueesstteedd iinnffoorrmmaattiioonn,, wwhhiicchh mmuusstt bbee sswwoorrnn uunnddeerr ppeennaallttyy ooff ppeerrjjuurryy;; aappppeeaarr ffoorr 1122 ddeeppoossiittiioonnss;; aanndd pprroodduuccee ddooccuummeennttss,, ffoorr iinnssppeeccttiioonn aanndd ccooppyyiinngg.. TThhee 1133 CCoommmmiissssiioonn iiss aallssoo aauutthhoorriizzeedd ttoo oobbttaaiinn ddiissccoovveerryy,, wwiitthhoouutt ffuurrtthheerr lleeaavvee ooff ccoouurrtt,, 1144 uussiinngg aannyy ooff tthhee pprroocceedduurreess pprreessccrriibbeedd bbyy FFeeddeerraall RRuulleess ooff CCiivviill PPrroocceedduurree 2299,,3300 1155 ((iinncclluuddiinngg tteelleepphhoonniicc ddeeppoossiittiioonnss)),, 3311,, 3333,, 3344,, 3366,, 4455,, aanndd 6699..\n\n1177 BB.. FFoorr mmaatttteerrss ccoonncceerrnniinngg tthhiiss OOrrddeerr,, tthhee CCoommmmiissssiioonn iiss aauutthhoorriizzeedd ttoo ccoommmmuunniiccaattee 1188 ddiirreeccttllyy wwiitthh DDeeffeennddaanntt.. DDeeffeennddaanntt mmuusstt ppeerrmmiitt rreepprreesseennttaattiivveess ooff tthhee 1199 CCoommmmiissssiioonn ttoo iinntteerrvviieeww aannyy eemmppllooyyeeee oorr ootthheerr ppeerrssoonn aaffffiilliiaatteedd wwiitthh aannyy 2200 DDeeffeennddaanntt wwhhoo hhaass aaggrreeeedd ttoo ssuucchh aann iinntteerrvviieeww.. TThhee ppeerrssoonn iinntteerrvviieewweedd mmaayy 2211 2222 hhaavvee ccoouunnsseell pprreesseenntt..\n\nCC.. TThhee CCoommmmiissssiioonn mmaayy uussee aallll ootthheerr llaawwffuull mmeeaannss,, iinncclluuddiinngg ppoossiinngg,, tthhrroouugghh iittss 2244 rreepprreesseennttaattiivveess,, aass ccoonnssuummeerrss,, ssuupppplliieerrss,, oorr ootthheerr iinnddiivviidduuaallss oorr eennttiittiieess,, ttoo 2255 DDeeffeennddaanntt oorr aannyy iinnddiivviidduuaall oorr eennttiittyy aaffffiilliiaatteedd wwiitthh DDeeffeennddaanntt,, wwiitthhoouutt tthhee 2266 nneecceessssiittyy ooff iiddeennttiiffiiccaattiioonn oorr pprriioorr nnoottiiccee.. NNootthhiinngg iinn tthhiiss OOrrddeerr lliimmiittss tthhee 2277 2288 CCoommmmiissssiioonn''ss llaawwffuull uussee ooff ccoommppuullssoorryy pprroocceessss,, ppuurrssuuaanntt ttoo SSeeccttiioonnss 99 aanndd 2200 ooff tthhee FFTTCC AAcctt,, 1155 UU..SS..CC.. §§§§ 4499,, 5577bb--11..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.12_rockyou", "company_name": "RockYou, Inc.", "date_issued": "2012-03-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023120-rockyou-inc", "docket_number": "CV '12 1487" }, { "provision_number": "I", "title": "Monitoring Products and Services", "category": "prohibition", "summary": "Respondents are permanently restrained from promoting, selling, or distributing any Monitoring Product or Service unless they comply with requirements for mobile device security, registration attestation, documentation, and icon notice.", "verbatim_text": "A. Mobile Device Security: No Monitoring Product or Service’s functionality may require circumventing security protections implemented by the Mobile Device operating system or manufacturer, such as by Jailbreaking or Rooting a Mobile Device.\n\nB. Registration Attestation and Documentation: Prior to the sale or distribution of any Monitoring Product or Service, Respondents must obtain: a. An express written attestation from the purchaser that it will use the Monitoring Product or Service for legitimate and lawful purposes by authorized users. i. The express written attestation must state the legitimate and lawful purpose for which the purchaser is using the device, which may include only the following: 1. Parent monitoring a minor Child; 2. Employer monitoring an employee who has provided express written consent to being monitored; or 3. Adult monitoring another adult who has provided express written consent to being monitored; 7 ii. Respondents cannot provide purchasers with written attestation language; iii. Respondents cannot suggest, direct, or otherwise assist, purchasers in submitting fraudulent written attestations; and\n\nb. Documentation proving that the purchaser is an authorized user on the monitored Mobile Device’s service carrier account.\n\nC. Icon Notice: The Monitoring Product or Service must display an application icon, accompanied by the name of the Monitoring Product or Service adjacent to the application icon. The consumer must be able to click on the application icon to a page on which Respondents present a Clear and Conspicuous notice stating: i. The name and material functions of the Monitoring Product or Service; ii. That the Monitoring Product or Service is running on the user’s Mobile Device; and iii. Where and how the user can contact Respondents for additional information, or to resolve an issue of improper installation of the Monitoring Product or Service.\n\nb. Exception to the Icon Notice Requirement: i. Respondents may program the Monitoring Product or Service to allow the purchaser of the Monitoring Product or Service to disable the Icon Notice only if the purchaser attests, prior to installation, that the purchaser is the legal guardian or parent of a minor Child, and that the Monitoring Software or Product will be installed on a Mobile Device predominantly used by the minor Child.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance" ], "remedy_types": [ "Prohibition" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "II", "title": "Additional Warnings and Notices", "category": "prohibition", "summary": "Respondents are permanently restrained from promoting, selling, or distributing Monitoring Products or Services unless they provide purchasers with required home page and purchase page notices about lawful use only.", "verbatim_text": "A. Home Page Notice: The home page of any Internet website advertising the Monitoring Product or Service must Clearly and Conspicuously provide notice that the Monitoring Product or Service may only be used for legitimate and lawful purposes by authorized users, and that installing or using the Monitoring Product or Service for any other 8 purpose may violate local, state, and/or federal law. The foregoing notice must be placed such that it can be viewed on the screen first seen by a potential purchaser who lands on the home page.\n\nB. Purchase Page Notice: Respondents may not complete the sale of a Monitoring Product or Service unless Respondents provide the purchaser with Clear and Conspicuous notice the Monitoring Product or Service may only be used for legitimate and lawful purposes by authorized users, and that installing or using the Monitoring Product or Service for any other purpose may violate local, state, and/or federal law.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance" ], "remedy_types": [ "Prohibition" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "III", "title": "Injunction Concerning the Collection of Personal Information", "category": "prohibition", "summary": "Respondents are permanently restrained from violating the Children's Online Privacy Protection Rule (COPPA), 16 C.F.R. Part 312, including failing to establish reasonable procedures to protect the confidentiality, security, and integrity of children's Personal Information.", "verbatim_text": "IT IS FURTHER ORDERED that Respondents, and Respondents’ officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with being an operator of any Web site or online service directed to Children or of any Web site or online service with actual knowledge that it is Collecting or maintaining Personal Information from a Child, are hereby permanently restrained and enjoined from violating the Children’s Privacy Protection Rule, 16 C.F.R. Part 312, including but not limited to failing to establish and maintain reasonable procedures to protect the confidentiality, security, and integrity of Personal Information from Children. A copy of the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, is attached hereto as Appendix A.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "IV", "title": "Prohibition Against Misrepresentations", "category": "prohibition", "summary": "Respondents are permanently restrained from misrepresenting, expressly or by implication, the extent to which they maintain and protect the privacy, security, confidentiality, or integrity of Personal Information.", "verbatim_text": "IT IS FURTHER ORDERED that Respondents, and Respondents’ officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with any product or service, are hereby permanently restrained and enjoined from misrepresenting, expressly or by implication, the extent to which Respondents maintain and protect the privacy, security, confidentiality, or integrity of Personal Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Prohibition" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "V", "title": "Data Deletion", "category": "affirmative_obligation", "summary": "Within 120 days of entry of this Order, Respondents must destroy all Personal Information collected from a Monitoring Product or Service prior to entry of this Order, except as required by law or government request.", "verbatim_text": "IT IS FURTHER ORDERED that within one hundred twenty (120) days after entry of this Order, Respondents and Respondents’ offers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, must destroy all Personal Information collected from a Monitoring Product or Service prior to entry of this Order. Provided, however, that such Personal Information need not be destroyed, and may be disclosed, to the extent requested by a government agency or required by law, regulation, or court order, including without limitation as required by rules applicable to the safeguarding of evidence in pending litigation.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance" ], "remedy_types": [ "Data Deletion" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "VI", "title": "Mandated Information Security Program", "category": "affirmative_obligation", "summary": "Each Covered Business must establish, implement, and maintain a comprehensive written information security program with specific components including risk assessments, safeguards, testing, and service provider oversight.", "verbatim_text": "A. Document in writing the content, implementation, and maintenance of the Information Security Program;\n\nB. Provide the written program and any evaluations thereof or updates thereto to its board of directors or governing body or, if no such board or equivalent governing body exists, to a senior officer responsible for its information security program at least once every twelve months and promptly after any Covered Incident;\n\nC. Designate a qualified employee or employees to coordinate and be responsible for the Information Security Program;\n\nD. Assess and document, at least once every twelve months and promptly following a Covered Incident, internal and external risks to the security, confidentiality, or integrity of Personal Information that could result in the unauthorized disclosure, misuse, loss, theft, alteration, destruction, or other compromise of such information;\n\nE. Design, implement, maintain, and document safeguards that control for the internal and external risks to the security, confidentiality, or integrity of Personal Information identified in response to sub-Provision VI.D. Each safeguard shall be based on the volume and sensitivity of the Personal Information that is at risk, and the likelihood that the risk could be realized and result in the unauthorized access, collection, use, alteration, destruction, or disclosure of the Personal Information. Respondents’ safeguards shall also include: 1. Technical measures to monitor all of Respondents’ networks and all systems and assets within those networks to identify data security events, including unauthorized attempts to exfiltrate Personal Information from those networks; 2. Technical measures to secure Respondents’ web applications and mobile applications and address well-known and reasonably foreseeable vulnerabilities, such as cross-site scripting, structured query language injection, and other risks identified by Respondents through risk assessments and/or penetration testing; 3. Data access controls for all databases storing Personal Information, including by, at a minimum, (a) requiring authentication to access them, and (b) limiting employee or service provider access to what is needed to perform that employee’s job function; 4. Encryption of all Personal Information on Respondents’ computer networks; and 10 5. Establishing and enforcing policies and procedures to ensure that all service providers with access to Respondents’ network or access to Personal Information are adhering to Respondents’ Information Security Program.\n\nF. Assess, at least once every twelve (12) months and promptly following a Covered Incident, the sufficiency of any safeguards in place to address the risks to the security, confidentiality, or integrity of Personal Information, and modify the Information Security Program based on the results.\n\nG. Test and monitor the effectiveness of the safeguards at least once every twelve months and promptly following a Covered Incident, and modify the Information Security Program based on the results. Such testing shall include vulnerability testing of each of Respondents’ network(s) once every four (4) months and promptly after any Covered Incident, and penetration testing of each Covered Business’s network(s) at least once every twelve (12) months and promptly after any Covered Incident;\n\nH. Select and retain service providers capable of safeguarding Personal Information they receive from each Covered Business, and contractually require service providers to implement and maintain safeguards for Personal Information; and\n\nI. Evaluate and adjust the Information Security Program in light of any changes to Respondents’ operations or business arrangements, a Covered Incident, or any other circumstances that Respondents know or have reason to know may have an impact on the effectiveness of the Information Security Program. At a minimum, each Covered Business must evaluate the Information Security Program at least once every twelve (12) months and modify the Information Security Program based on the results.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "VII", "title": "Information Security Assessments by a Third Party", "category": "assessment", "summary": "Respondents must obtain initial and biennial third-party assessments of their Information Security Program from a qualified, independent assessor, covering the first 180 days and then every 2 years for 20 years.", "verbatim_text": "A. The Assessments must be obtained from a qualified, objective, independent third-party professional (“Assessor”), who: (1) uses procedures and standards generally accepted in the profession; (2) conducts an independent review of the Information Security Program; and (3) retains all documents relevant to each Assessment for five (5) years after completion of such Assessment and will provide such documents to the Commission within ten (10) days of receipt of a written request from a representative of the Commission. No documents may be withheld on the basis of a claim of confidentiality, proprietary or trade secrets, work product, attorney client privilege, statutory exemption, or any similar claim.\n\nB. For each Assessment, Respondents shall provide the Associate Director for Enforcement for the Bureau of Consumer Protection at the Federal Trade Commission 11 with the name and affiliation of the person selected to conduct the Assessment, which the Associate Director shall have the authority to approve in his or her sole discretion.\n\nC. The reporting period for the Assessments must cover: (1) the first one hundred eighty (180) days after the issuance date of the Order for the initial Assessment; and (2) each 2-year period thereafter for twenty (20) years after issuance of the Order for the biennial Assessments.\n\nD. Each Assessment must: (1) determine whether each Covered Business has implemented and maintained the Information Security Program required by Provision VI of this Order, titled Mandated Information Security Program; (2) assess the effectiveness of each Covered Business’s implementation and maintenance of sub-Provisions VI.A-I; (3)identify any gaps or weaknesses in the Information Security Program; and (4) identify specific evidence (including, but not limited to, documents reviewed, sampling and testing performed, and interviews conducted) examined to make such determinations, assessments, and identifications, and explain why the evidence that the Assessor examined is sufficient to justify the Assessor’s findings. No finding of any Assessment shall rely solely on assertions or attestations by a Covered Business’s management. The Assessment shall be signed by the Assessor and shall state that the Assessor conducted an independent review of the Information Security Program, and did not rely solely on assertions or attestations by a Covered Business’s management.\n\nE. Each Assessment must be completed within sixty (60) days after the end of the reporting period to which the Assessment applies. Unless otherwise directed by a Commission representative in writing, Respondents must submit the initial Assessment to the Commission within ten (10) days after the Assessment has been completed via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin, “In re Retina-X Studios, LLC, FTC File No. 172 3118.” All subsequent biennial Assessments shall be retained by Respondents until the order is terminated and provided to the Associate Director for Enforcement within ten (10) days of request.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "VIII", "title": "Cooperation with Third Party Information Security Assessor", "category": "affirmative_obligation", "summary": "Respondents must cooperate fully with third-party Assessors by disclosing all material facts truthfully and providing all relevant information and materials in their possession.", "verbatim_text": "A. Disclose all material facts to the Assessor, and not misrepresent in any manner, expressly or by implication, any fact material to the Assessor’s: (1) determination of whether Respondents have implemented and maintained the Information Security Program required by Provision VI of this Order, titled Mandated Information Security Program; (2)assessment of the effectiveness of the implementation and maintenance of sub- 12 Provisions VI.A-I; or (3) identification of any gaps or weaknesses in the Information Security Program; and\n\nB. Provide or otherwise make available to the Assessor all information and material in their possession, custody, or control that is relevant to the Assessment for which there is no reasonable claim of privilege.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "IX", "title": "Annual Certification", "category": "compliance_reporting", "summary": "Respondents must provide the FTC with an annual certification from a senior corporate manager or officer confirming compliance with the Information Security Program requirements and disclosing any Covered Incidents.", "verbatim_text": "A. One year after the issuance date of this Order, and each year thereafter, provide the Commission with a certification from a senior corporate manager, or, if no such senior corporate manager exists, a senior officer of each Covered Business responsible for each Covered Business’s Information Security Program that: (1) each Covered Business has established, implemented, and maintained the requirements of this Order; (2) each Covered Business is not aware of any material noncompliance that has not been (a) corrected or (b) disclosed to the Commission; and (3) includes a brief description of any Covered Incident. The certification must be based on the personal knowledge of the senior corporate manager, senior officer, or subject matter experts upon whom the senior corporate manager or senior officer reasonably relies in making the certification.\n\nB. Unless otherwise directed by a Commission representative in writing, submit all annual certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin, “Retina-X Studios, LLC, FTC File No. 172 3118, Docket No. C-4711.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "X", "title": "Covered Incident Reports", "category": "compliance_reporting", "summary": "Respondents must submit a report to the FTC within 10 days of first notifying any government entity of a Covered Incident, including details about the incident's date, description, affected information types, consumer count, remediation steps, and copies of notices sent.", "verbatim_text": "IT IS FURTHER ORDERED that Respondents, for any Covered Business, within a reasonable time after the date of discovery of a Covered Incident, but in any event no later than 10 days after the date the Covered Business, or any of the Covered Business’s clients, first notifies any U.S. federal, state, or local government entity of the Covered Incident, must submit a report to the Commission. The report must include, to the extent possible: A. The date, estimated date, or estimated date range when the Covered Incident occurred; B. A description of the facts relating to the Covered Incident, including the causes and scope of the Covered Incident, if known; C. A description of each type of information that triggered the notification obligation to the U.S. federal, state, or local government entity; 13 D. The number of consumers whose information triggered the notification obligation to the U.S. federal, state, or local government entity; E. The acts that the Covered Business has taken to date to remediate the Covered Incident and protect Personal Information from further exposure or access, and protect affected individuals from identity theft or other harm that may result from the Covered Incident; and F. A representative copy of each materially different notice required by U.S. federal, state, or local law or regulation and sent by the Covered Business or any of its clients to consumers or to any U.S. federal, state, or local government entity.\n\nUnless otherwise directed by a Commission representative in writing, all Covered Incident reports to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin, “Retina-X Studios, LLC, FTC File No. 172 3118, Docket No. C-4711.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "XI", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Respondents must submit a sworn acknowledgment of receipt of this Order within 7 days, deliver copies of the Order to principals, officers, managers, and relevant employees for 10 years, and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "A. Each Respondent, within seven (7) days of entry of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For ten (10) years after entry of this Order, the Individual Respondent, for any business that such Respondent, individually or collectively with any other Respondent, is the majority owner or controls directly or indirectly, and the Corporate Respondent, must deliver a copy a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees having managerial responsibilities for conduct related to the subject matter of the Order, and all agents and representatives who participate in conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.\n\nC. From each individual or entity to which a Respondent delivered a copy of this Order, that Respondent must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance", "Data Security" ], "remedy_types": [ "Order Administration" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "XII", "title": "Compliance Report and Notices", "category": "compliance_reporting", "summary": "Respondents must submit a sworn compliance report one year after entry of this Order and provide sworn compliance notices within 14 days of any changes in contact information, business structure, or individual respondent's personal or business circumstances for 10 years.", "verbatim_text": "A. One year after entry of this Order, each Respondent must submit a compliance report, sworn under penalty of perjury, in which: 1. Each Respondent must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Respondent; (b) identify all of the Respondents’ businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales, and the involvement of any other Respondent (which Individual Respondent must describe if he knows or should know due to his own involvement); (d)describe in detail whether and how that Respondent is in compliance with each Provision of this Order, including a discussion of all of the changes Respondents made to comply with the Order; and (e) provide a copy of each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the Commission. 2. Additionally, the Individual Respondent must: (a) identify all telephone numbers and all physical, postal, email and Internet addresses, including all residences; (b) identify all business activities, including any business for which Individual Respondent performs services whether as an employee or otherwise and any entity in which Individual Respondent has any ownership interest; and (c) describe in detail Individual Respondent’s involvement in each such business, including title, role, responsibilities, participation, authority, control, and any ownership.\n\nB. For 10 years after the issuance date of this Order, each Respondent must submit a compliance notice, sworn under penalty of perjury, within fourteen (14) days of any changes in the following: 1. Each Respondent must report any change in: (a) any designated point of contact; or (b) the structure of Corporate Respondent or any entity that Respondent has any ownership interest in or control directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. 2. Additionally, Individual Respondent must report any change in: (a) name, including aliases or fictitious name, or residence address; or (b) title or role in any business activity, including (i) any business for which Individual Respondent performs services whether as an employee or otherwise and (ii) any entity in 15 which Individual Respondent has any ownership interest and over which Individual Respondent has direct or indirect control. For each such business activity, also identify its name, physical address, and any Internet address.\n\nC. Each Respondent must submit to the Commission notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against such Respondent within fourteen (14) days of its filing.\n\nD. Any submission to the Commission required by this Order to sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: “United States v. Retina-X Studios, LLC, FTC File No. 172 3118, Docket No. C-4711.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "XIII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Respondents must create certain records for 10 years after entry of this Order and retain each such record for 5 years, including accounting records, personnel records, consumer complaints, assessment materials, compliance records, and marketing materials.", "verbatim_text": "A. Accounting records showing the revenues from all goods or services sold, the costs incurred in generating those revenues, and resulting net profit or loss;\n\nB. Personnel records showing, for each person providing services, whether as an employee or otherwise, that person’s: name; address; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;\n\nC. Copies or records of all consumer complaints and refund requests, whether received directly or indirectly, such as through a third party, and any response;\n\nD. For five (5) years after the date of preparation of each Assessment required by this Order, all materials and evidence that the Assessor considered, reviewed, relied upon or examined to prepare the Assessment, whether prepared by or on behalf of Respondents, including all plans, reports, studies, reviews, audits, audit trails, policies, training materials, and assessments, and any other materials concerning Respondents’ compliance with related Provisions of this Order, for the compliance period covered by such Assessment;\n\nE. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission; and\n\nF. A copy of each unique advertisement or other marketing material.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance", "Data Security" ], "remedy_types": [ "Recordkeeping" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "XIV", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The FTC is authorized to monitor Respondents' compliance through written requests for reports and documents, depositions, direct communications with employees, and other lawful investigative means including undercover contacts.", "verbatim_text": "A. Within ten (10) days of receipt of a written request from a representative of the Commission, each Respondent must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying.\n\nB. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with each Respondent. Respondents must permit representatives of the Commission to interview any employee or other person affiliated with any Respondent who has agreed to such an interview. The interviewee may have counsel present.\n\nC. The Commission may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Respondent s or any individual or entity affiliated with Respondents, without the necessity of identification of prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.\n\nD. Upon written request from a representative of the Commission, any consumer reporting agency must furnish consumer reports concerning the Individual Respondent, pursuant to Section 604(2) of the Fair Credit Reporting Act, 15 U.S.C. §1681b(a)(2).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance", "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "XV", "title": "Order Effective Dates", "category": "duration", "summary": "This Order is final and effective upon publication on the FTC website and terminates on March 26, 2040, or 20 years from the most recent date the United States or Commission files a complaint alleging any violation of this Order, whichever is later.", "verbatim_text": "IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate\n\npublication on the Commission’s website (ftc.gov) as a final order. This Order will terminate March 26, 2040, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of this Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of: A. Any Provision in this Order that terminates in less than twenty (20) years; B. The Order’s application to any Respondent that is not named as a defendant in such complaint; and 17 C. This Order is such complaint is filed after the Order has terminated pursuant to this Provision. Provided, further, that if such complaint is dismissed or a federal court rules that the Respondent did not violate any Provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Surveillance", "Data Security" ], "remedy_types": [ "Order Administration" ], "case_id": "03.20_retina-x_studios", "company_name": "RETINA-X STUDIOS, LLC", "date_issued": "2020-03-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Federal Trade Commission Act and the Children's Online Privacy Protection Rule (COPPA Rule)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3118-retina-x-studios-llc-matter", "docket_number": "C-4711" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants and all persons acting with them are permanently enjoined from failing to provide direct notice to parents, failing to post required privacy links, failing to obtain Verifiable Parental Consent, retaining children's data longer than necessary, and violating the COPPA Rule.", "verbatim_text": "10 A. Failing to make reasonable efforts, taking into account available technology, to ensure 11 that a Parent of a Child receives direct notice of Defendants’ practices with regard to the 12 Collection, use, or Disclosure of Personal Information from Children, including notice of 13 any material change in the Collection, use, or Disclosure practices to which the Parent 14 has previously consented, unless the Children’s Online Privacy Protection Rule 16 C.F.R. 15 Part 312 (attached as Appendix A), provides an exception to providing such notice;\n\n16 B. Failing to post a prominent and clearly labeled link to an online notice of its information 17 practices with regard to Children on the home or landing page or screen of its website or 18 online service, and at each area of the website or online service where Personal 19 Information is Collected from Children, unless the Children’s Online Privacy Protection 20 Rule 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to providing 21 such notice;\n\n22 C. Failing to obtain Verifiable Parental Consent before any Collection, use, or Disclosure of 23 Personal Information from Children, including consent to any material change in the 24 Collection, use, or Disclosure practices to which the Parent has previously consented, 25 unless the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as 26 Appendix A), provides an exception to Obtaining Verifiable Parental Consent;\n\n1 D. Retaining Personal Information Collected online from a Child for longer than reasonably 2 necessary to fulfill the purpose for which the information was Collected; and\n\n3 E. Violating the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as 4 Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "II", "title": "Injunction Concerning Children's Personal Information Previously Collected", "category": "affirmative_obligation", "summary": "Defendants must refrain from using previously collected children's data without parental consent, destroy such data within specified deadlines, submit sworn statements confirming destruction, delete Affected Work Product, and maintain a compliant data retention schedule.", "verbatim_text": "10 A. Refrain from Disclosing, using, or benefitting from Personal Information Collected from 11 Children that Defendants Collected through the Kurbo Program prior to entry of this 12 Order unless Verifiable Parental Consent is obtained;\n\n13 B. Within thirty (30) days of entry of this Order, destroy all Personal Information Collected 14 through the Kurbo Program by Defendants from accounts that have not, by that date, 15 received direct notice and provided Verifiable Parental Consent;\n\n16 C. Within ninety (90) days of entry of this Order, provide a written statement to the 17 Commission, sworn under penalty of perjury, that (1) describes the process through 18 which Defendants provided direct notice and sought Verifiable Parental Consent for the 19 accounts through which Personal Information was Collected through the Kurbo Program; 20 (2) identifies the total number of accounts for which direct notice was provided, as well 21 as the number of accounts: 22 (i) that provided Verifiable Parental Consent; 23 (ii) that affirmatively declined to provide Verifiable Parental Consent; 24 (iii) that did not respond; 25 (iv) that Parents requested be deleted after receiving the direct notice provided 26 for under sub-provision B; 27 28 – 7 – [PROPOSED] STIPULATED ORDER Case 3:22-cv-00946-TSH Document 15 Filed 03/03/22 Page 8 of 25 1 (v) where Parents engaged with Defendants by asking additional questions; 2 and 3 (3) confirms all information related to accounts for which Verifiable Parental Consent 4 was not received has been destroyed;\n\n5 D. Within ninety (90) days of entry of this Order, delete or destroy any Affected Work 6 Product, and provide a written statement to the Commission, sworn under penalty of 7 perjury, confirming such deletion or destruction;\n\n8 E. Provide additional description and written statements as follows. Any Affected Work 9 Product, or other matter that Defendants are otherwise required to delete or destroy 10 pursuant to this provision may be retained, and may be disclosed, as requested by a 11 government agency or otherwise required by law, regulation, court order, or other legal 12 obligation, including as required by rules applicable to the safeguarding of evidence in 13 pending litigation. In each written statement to the Commission required by this 14 provision, Defendants shall describe in detail any relevant information that Defendants 15 retain on any of these bases and the specific government agency, law, regulation, court 16 order, or other legal obligation that prohibits Defendants from deleting or destroying such 17 information. Within thirty (30) days after the obligation to retain the information has 18 ended, Defendants shall provide an additional written statement to the Commission, 19 sworn under penalty of perjury, confirming that Defendants have deleted or destroyed 20 such information; and\n\n21 F. Maintain and adhere to a retention schedule for Children’s Personal Information 22 Collected through the Kurbo Program, setting forth the purpose for which the information 23 is Collected, the specific business need for retaining such Personal Information, and a set 24 time frame and set of criteria for deletion of such information which may not exceed one 25 (1) year after the last instance of a user tracking food, weight, or activity intake, and 26 27 28 – 8 – [PROPOSED] STIPULATED ORDER Case 3:22-cv-00946-TSH Document 15 Filed 03/03/22 Page 9 of 25 1 make such information about the retention schedule publicly available on Defendants’ 2 website(s) and in the direct notice.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $1.5 million is entered against Defendants jointly and severally, to be paid within 7 days of entry of this Order by electronic fund transfer.", "verbatim_text": "5 A. Judgment in the amount of $1.5 million ($1,500,000) is entered in favor of Plaintiff 6 against Defendants, jointly and severally, as a civil penalty.\n\n7 B. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer of the 8 United States, $1.5 million ($1,500,000), which, as Defendants stipulate, their 9 undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such 10 payment must be made within seven (7) days of entry of this Order by electronic fund 11 transfer in accordance with instructions previously provided by a representative of 12 Plaintiff.\n\n13 C. Defendants relinquish dominion and all legal and equitable right, title, and interest in all 14 assets transferred pursuant to this Order and may not seek the return of any assets.\n\n15 D. The facts alleged in the Complaint will be taken as true, without further proof, in any 16 subsequent civil litigation by or on behalf of the Commission, including in a proceeding 17 to enforce its rights to any payment or monetary judgment pursuant to this Order.\n\n18 E. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants 19 must submit to the Commission, may be used for collecting and reporting on any 20 delinquent amount arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "IV", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendants must submit sworn acknowledgments of receipt of this Order, deliver copies to relevant personnel and entities, and obtain signed acknowledgments within specified timeframes.", "verbatim_text": "23 A. Each Defendant, within 7 days of entry of this Order, must submit to the Commission an 24 acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n25 B. For five (5) years after entry of this Order, each Defendant must deliver a copy of this 26 Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all 27 employees, agents, and representatives with managerial responsibilities for the conduct 28 – 9 – [PROPOSED] STIPULATED ORDER Case 3:22-cv-00946-TSH Document 15 Filed 03/03/22 Page 10 of 25 1 related to Section I or II of the Order; and (3) any business entity resulting from any 2 change in structure as set forth in the Section titled Compliance Reporting. Delivery must 3 occur within seven (7) days of entry of this Order for current personnel. To all others, 4 delivery must occur before they assume their responsibilities.\n\n5 C. From each individual or entity to which Defendants delivered a copy of this Order, 6 Defendants must obtain, within 30 days, a signed and dated acknowledgment of receipt 7 of this Order. This requirement may be satisfied through a digital signature so long as the 8 individual’s identity has been authenticated by a digital certificate issued by a certificate 9 authority and such digital signature is bound to the acknowledgement by means of 10 encryption.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "V", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit annual compliance reports, timely notices of structural or contact changes, bankruptcy notices, and all submissions must be sworn under penalty of perjury and delivered as directed.", "verbatim_text": "13 A. One year after entry of this Order, each Defendant must submit a compliance report, 14 sworn under penalty of perjury: 15 1. Each Defendant must: (a) identify the primary physical, postal, and email address 16 and telephone number, as designated points of contact, which representatives of 17 the Commission and Plaintiff may use to communicate with Defendant; 18 (b) identify all of that Defendant’s businesses by all of their names, telephone 19 numbers, and physical, postal, email, and Internet addresses; (c) describe the 20 activities of each business, including the goods and services offered, the means of 21 advertising, marketing, and sales, and the involvement of any other Defendant; 22 (d) describe in detail whether and how that Defendant is in compliance with each 23 Section of this Order; (e) provide a copy of each different version of any privacy 24 notice posted on each website or online service operated by Defendants that 25 Collects Personal Information from Children or is a Website or Online Service 26 Directed to Children or that is sent to Parents of Children that sign up or register 27 on each website or online service; (f) provide a statement setting forth in detail the 28 – 10 – [PROPOSED] STIPULATED ORDER Case 3:22-cv-00946-TSH Document 15 Filed 03/03/22 Page 11 of 25 1 methods used to obtain Verifiable Parental Consent prior to any Collection, use, 2 and/or Disclosure of Personal Information from Children for each website or 3 online service operated by Defendants that Collects Personal Information from 4 Children or Website or Online Service Directed to Children; (g) provide a 5 statement setting forth in detail the means provided for Parents to review the 6 Personal Information Collected from their Children and to refuse to permit its 7 further use or maintenance for each website or online service operated by 8 Defendants that Collects Personal Information from Children or Website or 9 Online Service Directed to Children; and (h) provide a copy of each Order 10 Acknowledgment obtained pursuant to this Order, unless previously submitted to 11 the Commission.\n\n12 B. For ten (10) years after entry of this Order, each Defendant must submit a compliance 13 notice, sworn under penalty of perjury, within fourteen (14) days of any change in: 14 (a) any designated point of contact; or (b) the structure of that Defendant or any entity 15 that Defendants have any ownership interest in or control directly or indirectly that may 16 affect compliance obligations arising under this Order, including: creation, merger, sale, 17 or dissolution of the entity or any subsidiary, Parent, or affiliate that engages in any acts 18 or practices subject to this Order.\n\n19 C. Each Defendant must submit to the Commission notice of the filing of any bankruptcy 20 petition, insolvency proceeding, or similar proceeding by or against each Defendant 21 within 14 days of its filing.\n\n22 D. Any submission to the Commission required by this Order to be sworn under penalty of 23 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 24 concluding: “I declare under penalty of perjury under the laws of the United States of 25 America that the foregoing is true and correct. Executed on: _____” and supplying the 26 date, signatory’s full name, title (if applicable), and signature.\n\n1 E. Unless otherwise directed by a Commission representative in writing, all submissions to 2 the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by 3 overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 4 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 5 NW, Washington, DC 20580. The subject line must begin: United States v. Kurbo, et al.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "VI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create specified records for ten years and retain each for five years, covering accounting records, personnel records, compliance records, consumer complaints, communications, and copies of forms collecting children's personal information.", "verbatim_text": "11 A. Accounting records showing the revenues from all goods or services sold;\n\n12 B. All personnel records showing, for each Person providing services, whether as an 13 employee or otherwise, that Person’s: name; addresses; telephone numbers; job title or 14 position; dates of service; and (if applicable) the reason for termination;\n\n15 C. All records necessary to demonstrate full compliance with each provision of this Order, 16 including all submissions to the Commission;\n\n17 D. Records of all consumer complaints relating to Defendants’ Collection of Personal 18 Information from Children, whether received directly or indirectly, such as through a 19 Third Party, and any response;\n\n20 E. Copies of communications enumerated in response to Section II.C(2)(v); and\n\n21 F. A copy of each materially different form, page, or screen created, maintained, or 22 otherwise provided by Defendants through which Defendants Collect Personal 23 Information from Children other than solely a persistent identifier that can be used to 24 recognize a user over time and across different websites or online services or from any 25 Website or Online Service Directed to Children, and a copy of each materially different 26 document containing any representation regarding Defendants’ Collection, use, and 27 28 – 12 – [PROPOSED] STIPULATED ORDER Case 3:22-cv-00946-TSH Document 15 Filed 03/03/22 Page 13 of 25 1 Disclosure practices pertaining to Personal Information of Children. Each webpage copy 2 shall be accompanied by the URL of the webpage where the material was posted online. 3 Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in 4 presenting information on the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "VII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through information requests, depositions, discovery, direct communications, employee interviews, and undercover methods.", "verbatim_text": "8 A. Within 14 days of receipt of a written request from a representative of the Commission or 9 Plaintiff, each Defendant must: submit additional compliance reports or other requested 10 information, which must be sworn under penalty of perjury; appear for depositions; and 11 produce documents for inspection and copying. The Commission and Plaintiff are also 12 authorized to obtain discovery, without further leave of court, using any of the procedures 13 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 14 31, 33, 34, 36, 45, and 69.\n\n15 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 16 communicate directly with each Defendant. Defendants must permit representatives of 17 the Commission and Plaintiff to interview any employee or other Person affiliated with 18 any Defendant who has agreed to such an interview. The Person interviewed may have 19 counsel present.\n\n20 C. The Commission and Plaintiff may use all other lawful means, including posing, through 21 its representatives, as consumers, suppliers, or other individuals or entities, to Defendants 22 or any individual or entity affiliated with Defendants, without the necessity of 23 identification or prior notice. Nothing in this Order limits the Commission’s lawful use of 24 compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 25 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "VIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "1 VIII. RETENTION OF JURISDICTION 2 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of 3 construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "03.22_weight_watchersww", "company_name": "Kurbo, Inc.", "date_issued": "2022-03-15", "year": 2022, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923228-weight-watchersww", "docket_number": "3:22-cv-00946" }, { "provision_number": "6", "title": "Injunction Against COPPA Rule Violations", "category": "prohibition", "summary": "Defendants and all persons acting in concert with them are permanently enjoined from violating any provision of the COPPA Rule, as currently promulgated or as modified in the future.", "verbatim_text": "6. Defendants, their successors and assigns, and their officers, agents, servants, employees and attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined from violating, directly or through any corporation, subsidiary, division, website, or other device, any provision of the Rule as promulgated and as it may be modified in the future. A copy of the current Rule is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "7", "title": "Prohibition Against Misrepresentations About Children's Privacy", "category": "prohibition", "summary": "Defendants are permanently enjoined from making any misrepresentation in a website's privacy policy or elsewhere about the collection, use, or disclosure of children's personal information, or about procedures to maintain its confidentiality, security, or integrity.", "verbatim_text": "7. Defendants, their successors and assigns, and their officers, agents, servants, employees and attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined, in connection with the operation of any website or other online service, from making any misrepresentation in the website's privacy policy or elsewhere about the website's collection, use or disclosure of children’s personal information, or about the website's procedures to maintain the confidentiality, security, or integrity of children’s personal information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "8", "title": "Consumer Education Remedy — FTC KidzPrivacy Notice", "category": "affirmative_obligation", "summary": "For five years, defendants must place a clear and conspicuous FTC KidzPrivacy notice in their privacy policy, direct notices to parents, and at each personal information collection point on any child-directed website or online service.", "verbatim_text": "8. For a period of five (5) years from the date of entry of this Consent Decree, defendants, and their successors and assigns, in connection with the operation of any website or online service directed in whole or in part to children, shall place a clear and conspicuous notice (1) within the privacy policy required to be posted on their website(s) by Section 312.4(b) of the Rule, 16 C.F.R. CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 3 OF 13 § 312.4(b); (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on their website(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/kidzprivacy for information from the Federal Trade Commission about protecting children’s privacy online. Where the above notice is posted on a website or delivered via email or other electronic service, it shall be in the form of a hyperlink to www.ftc.gov/kidzprivacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to defendants, their successors or assigns.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "9", "title": "Civil Penalty — $35,000", "category": "affirmative_obligation", "summary": "Defendants Bigmailbox.com, Inc. and Nolan Quan are jointly and severally required to pay a civil penalty of $35,000 to the United States.", "verbatim_text": "9. Defendants Bigmailbox.com, Inc. and Nolan Quan, and their successors and assigns, shall pay to plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of thirty-five thousand dollars ($35,000). Defendants are jointly and severally responsible for paying the penalty.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "10", "title": "Payment of Civil Penalty — Method and Delivery", "category": "affirmative_obligation", "summary": "Defendants must pay the $35,000 civil penalty on the date of entry of the Consent Decree by certified or cashier's check payable to the Treasurer of the United States.", "verbatim_text": "10. Defendants shall make the payment required by Paragraph 9 on the date of entry of this Consent Decree by certified or cashier’s check made payable to the Treasurer of the United States and delivered to: the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "11", "title": "Default Interest on Civil Penalty", "category": "affirmative_obligation", "summary": "If defendants default on payment for more than ten days past the due date, the entire unpaid penalty plus interest becomes immediately due and payable.", "verbatim_text": "11. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 4 OF 13 pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "12", "title": "Deletion of Previously Collected Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendants must delete all personal information previously collected from children through www.bigmailbox.com prior to entry of the Consent Decree.", "verbatim_text": "12. Defendants, and their successors and assigns, shall delete all personal information collected from children through www.bigmailbox.com prior to the date of entry of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "13", "title": "Distribution of Consent Decree and Compliance Guide to Current Personnel", "category": "acknowledgment", "summary": "Within 30 days of entry, defendants must provide a copy of the Consent Decree and FTC compliance guide to all current principals, officers, directors, managers, and relevant employees, obtain signed acknowledgment statements, and within 10 days thereafter submit a signed compliance statement to the FTC.", "verbatim_text": "13. Defendants, and their successors and assigns, within thirty days from the date of entry of this Consent decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children’s Online Privacy Protection Rule (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) to each of their current principals, officers, directors, and managers, and to all current employees, agents, representatives, and attorneys having responsibilities related to the operation of any website or online service subject to the Rule, and secure from each such person a signed statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, and shall, within ten (10) days of\n\nreceipt of a copy of this Consent Decree and the compliance guide, and shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of defendants’ compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided. For purposes of complying with this Paragraph, defendants shall be permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 9 above) from the copy of the Consent Decree provided to any such person.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "14", "title": "Distribution of Consent Decree and Compliance Guide to Future Personnel", "category": "acknowledgment", "summary": "Defendants must provide a copy of the Consent Decree and compliance guide to all future principals, officers, directors, managers, and relevant employees within 30 days of their assuming such position, and maintain copies of signed acknowledgment statements available to the FTC upon request.", "verbatim_text": "14. Defendants, and their successors and assigns, shall provide a copy of this Consent Decree and the compliance guide to each of their future principals, officers, directors, and managers, and to all future employees, agents, representatives, and attorneys having responsibilities related to the operation of any website or online service subject to the Rule, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or responsibilities. Defendants shall maintain copies of the signed statements, as well as other information regarding the fact and manner of their compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Federal Trade Commission. For purposes of complying with this Paragraph, defendants shall be permitted to redact the dollar amount of the civil penalty (set forth in Paragraph 9 above) from the copy of the Consent Decree provided to any such person.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "15", "title": "Initial Compliance Report", "category": "compliance_reporting", "summary": "Within 60 days of entry, defendants must file a written compliance report with the FTC detailing their compliance with the Consent Decree, including registration processes, privacy notices, parental consent methods, and data security procedures.", "verbatim_text": "15. Within sixty (60) days after entry of this Consent Decree, defendants, and their successors and assigns, shall file with the Commission a written report setting forth in detail the manner and form in which they have complied and are complying with this Consent Decree. This report shall include but not be limited to: a. a statement setting forth in detail the process by which www.bigmailbox.com registers new email accounts, and a copy of each different screen or page providing or collecting registration information; CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 6 OF 13 b. a copy of each different privacy notice for www.bigmailbox.com and for any other of defendants’ websites or online services subject to the Rule; c. a statement setting forth in detail each place where the privacy notice is located on www.bigmailbox.com and on any other of defendants’ websites or online services subject to the Rule, and a copy of each different screen or page on which the website collects personal information; d. a copy of each different privacy notice to parents; e. a statement setting forth in detail when and how notices to parents are provided; f. a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; g. a statement setting forth in detail the means provided for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; h. a statement setting forth in detail why each type of information collected is reasonably necessary for the provision of the particular related activity; and CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 7 OF 13 i. a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "16", "title": "Recordkeeping — Compliance Documents", "category": "recordkeeping", "summary": "For five years, defendants must maintain and make available to the FTC within seven days of request print or electronic copies of all documents demonstrating compliance with the Consent Decree, including every information collection form, web page, and representation about data practices.", "verbatim_text": "16. For a period of five years from the date of entry of this Consent Decree, defendants, and their successors and assigns, shall maintain and make available to the Federal Trade Commission for inspection and copying within seven (7) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, a sample copy of every different information collection form, web page, or screen, and a sample copy of each different document containing any representation regarding defendants’ collection, use, and disclosure practices pertaining to personal information. Each web page copy shall be accompanied by the URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendants shall not be required by this paragraph to retain a document for longer than two years after the document is created; or retain a print or electronic copy of any amended web page or screen to the extent that the amendment does not affect defendants’ compliance obligations under this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "17", "title": "Notification of Business Changes — Bigmailbox.com, Inc.", "category": "compliance_reporting", "summary": "Defendants must notify the FTC at least 30 days prior to any corporate change affecting compliance obligations, such as mergers, dissolutions, bankruptcies, or name/address changes.", "verbatim_text": "17. Defendants, and their successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in the business of defendant Bigmailbox.com, Inc. that may affect CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 8 OF 13 compliance obligations arising under this Consent Decree, including, but not limited to, any merger, incorporation, dissolution, assignment, sale, or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporations about which defendants, their successors and assigns, learn less than thirty (30) days prior to the date such action is to take place, they shall notify the Commission as soon as is practicable after obtaining such knowledge.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "18", "title": "Notification of Employment Changes — Nolan Quan", "category": "compliance_reporting", "summary": "For three years, defendant Nolan Quan must notify the FTC of any discontinuation of his current business or employment, or any new involvement in an Internet-related business involving online collection of personal information.", "verbatim_text": "18. For a period of three (3) years from the date of entry of this Consent Decree, defendant Nolan Quan shall notify the Commission of the discontinuance of his current business or employment, or of his employment with, direction or control of, or ownership interest of at least 5% in, any Internet-related business or service involving the collection of personal information online. The notice shall include defendant’s new business address and telephone number, and a description of the nature of the business or employment and his duties and responsibilities.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "19", "title": "Taxpayer Identification Numbers", "category": "affirmative_obligation", "summary": "Defendants are required to furnish their taxpayer identifying numbers to the FTC for use in collecting and reporting on any delinquent amounts arising from their government relationship.", "verbatim_text": "19. Defendants are hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission each of their taxpayer identifying numbers (social security number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of their relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "20", "title": "Submission Address for Reports and Notices", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 12–19 must be sent by certified mail to the FTC's Associate Director, Division of Advertising Practices.", "verbatim_text": "20. All reports, submissions, and notices required by Paragraphs 12 - 19 of this Consent Decree shall be sent by certified mail to: Associate Director, Division of Advertising Practices Bureau of Consumer Protection Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Attention: United States v. Bigmailbox, Inc., et al.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "21", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction over this matter to enable any party to seek further orders for interpretation, modification, enforcement of compliance, or punishment of violations.", "verbatim_text": "21. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_bigmailbox.com", "company_name": "Bigmailbox.com, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3378-bigmailboxcom-inc-et-al", "docket_number": "01-605-A" }, { "provision_number": "1", "title": "Jurisdiction", "category": "acknowledgment", "summary": "The Court has jurisdiction over the subject matter and the parties to this action.", "verbatim_text": "1. This Court has jurisdiction over the subject matter and of the parties.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "2", "title": "Basis for Claims", "category": "acknowledgment", "summary": "The Complaint states a claim upon which relief may be granted under COPPA and the FTC Act.", "verbatim_text": "2. The Complaint states a claim upon which relief may be granted against the defendant under Sections 1303(c) and 1306(d) of the Children’s Online Privacy Protection Act of 1998 (“COPPA”), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (“FTC Act”), 15 U.S.C. §§ 41-58, §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a).", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "6", "title": "Injunction — Prohibition Against COPPA Rule Violations", "category": "prohibition", "summary": "Defendant and all associated persons are permanently enjoined from violating any provision of the COPPA Rule, directly or through any subsidiary, website, or other device.", "verbatim_text": "6. Defendant, its successors and assigns, and its officers, agents, servants, employees and CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 2 OF 12 attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined from violating, directly or through any corporation, subsidiary, division, website, or other device, any provision of the Rule as promulgated and as it may be modified in the future. A copy of the current Rule is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "7", "title": "Consumer Education Remedy — FTC Privacy Notice", "category": "affirmative_obligation", "summary": "For five years, defendant must post a clear and conspicuous FTC children's privacy notice (with hyperlink) in its privacy policy, direct notices to parents, and at each location where personal information is collected on children-directed websites.", "verbatim_text": "7. For a period of five (5) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, shall, in connection with the operation of any website or online service directed in whole or in part to children, place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its website(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/kidzprivacy for information from the Federal Trade Commission about protecting children’s privacy online. Where the above notice is posted on a website or delivered via email or other electronic service, it shall be in the form of a hyperlink to www.ftc.gov/kidzprivacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to defendant, or its successors or assigns.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "8", "title": "Civil Penalty — Amount", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $35,000 to the United States pursuant to the FTC Act.", "verbatim_text": "8. Defendant LookSmart Ltd., and its successors and assigns, shall pay to plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of thirty five thousand dollars ($35,000).", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "9", "title": "Civil Penalty — Payment Method and Delivery", "category": "affirmative_obligation", "summary": "Defendant must pay the civil penalty on the date of entry of the Consent Decree by certified or cashier's check payable to the Treasurer of the United States, delivered to the Office of Consumer Litigation.", "verbatim_text": "9. Defendant shall make the payment required by Paragraph 8 on the date of entry of this Consent Decree by certified or cashier’s check made payable to the Treasurer of the United States and delivered to: the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "10", "title": "Civil Penalty — Default Interest", "category": "affirmative_obligation", "summary": "If defendant defaults on payment for more than ten days, the full unpaid penalty plus statutory interest becomes immediately due and payable.", "verbatim_text": "10. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "11", "title": "Compliance — Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected from children through www.insidetheweb.com between April 21, 2000 and the date of entry of the Consent Decree.", "verbatim_text": "11. Defendant, and its successors and assigns, shall delete all personal information collected from children through www.insidetheweb.com at any time from April 21, 2000 through the date of entry of this Consent Decree.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "12", "title": "Compliance — Distribution of Consent Decree to Current Personnel", "category": "acknowledgment", "summary": "Within thirty days, defendant must distribute copies of the Consent Decree and the COPPA compliance guide to all current principals, officers, directors, and relevant employees, obtain signed acknowledgments, and report compliance to the Commission within ten days thereafter.", "verbatim_text": "12. Defendant, and its successors and assigns, within thirty days from the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children’s Online Privacy Protection Rule CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 4 OF 12 (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) to each of its current principals, officers and directors, and to all current employees, agents, and attorneys having responsibilities related to the subject matter of this Consent Decree, secure from each such person a signed statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, and shall, within ten\n\nacknowledging receipt of a copy of this Consent Decree and the compliance guide, and shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of defendant’s compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "13", "title": "Compliance — Distribution of Consent Decree to Future Personnel", "category": "acknowledgment", "summary": "Defendant must provide the Consent Decree and compliance guide to all future principals, officers, directors, and relevant employees within thirty days of assuming their position, secure signed acknowledgments, maintain copies, and make them available to the FTC upon request.", "verbatim_text": "13. Defendant, and its successors and assigns, shall provide a copy of this Consent Decree and the compliance guide to each of its future principals, officers and directors, and to all future employees, agents and attorneys having responsibilities related to the subject matter of this Consent Decree, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes\n\nsuch position or responsibilities. Defendant shall maintain copies of the signed statements, as well as other information regarding the fact and manner of its compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Federal Trade Commission.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "14", "title": "Compliance Reporting — Initial Written Report", "category": "compliance_reporting", "summary": "Within sixty days of entry, defendant must file a detailed written compliance report with the Commission covering privacy notices, parental consent procedures, data collection practices, and security measures for all Rule-covered websites.", "verbatim_text": "14. Within sixty (60) days after entry of this Consent Decree, defendant, and its successors and assigns, shall file with the Commission a written report setting forth in detail the manner and form in which it has complied and is complying with this Consent Decree. With regard to any website or online\n\nservice subject to the Rule, the report shall include, but not be limited to, the following documents and information: a. a copy of each different privacy notice; b. a statement setting forth in detail each place where the privacy notice is located on each website or online service, and a copy of each different screen or page on which each such website collects personal information; c. a statement setting forth in detail the process by which each website or online service registers visitors for any purpose, and a copy of each different screen or page providing or collecting registration information; d. a copy of each different privacy notice to parents; e. a statement setting forth in detail when and how notices to parents are provided; f. a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; g. a statement setting forth in detail the means provided for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 6 OF 12 h. a statement setting forth in detail why each type of information collected is reasonably necessary for the provision of the particular related activity; and i. a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "15", "title": "Recordkeeping — Document Retention for Compliance", "category": "recordkeeping", "summary": "For five years, defendant must maintain and make available to the FTC within seven days of request all documents demonstrating compliance, including web page copies, information collection forms, and representations about data practices.", "verbatim_text": "15. For a period of five (5) years from the date of entry of this consent order, defendant, its successors and assigns, shall maintain and make available to the Federal Trade Commission for inspection and copying within seven (7) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, a sample copy of each different information collection form, web page, or screen, and a sample copy of each different document containing any representation regarding defendant’s collection, use, and disclosure practices pertaining to personal information. Each web page copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendant shall not be required by this paragraph to retain a document for longer than two years after the document is created; or retain a print or electronic copy of any amended web page or screen to the extent that the amendment does not affect defendant’s compliance obligations under this Consent Decree.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "16", "title": "Compliance — Notice of Business Changes", "category": "compliance_reporting", "summary": "Defendant must notify the Commission at least thirty days before any business change that may affect compliance obligations under the Consent Decree, including mergers, dissolutions, bankruptcies, or name/address changes.", "verbatim_text": "16. Defendant, its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in its business that may affect compliance obligations arising under this Consent Decree, including, but not limited to, any merger, incorporation, dissolution, assignment, sale or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporations about which defendant, its successors and assigns, learn less than thirty (30) days prior to the date such action is to take place, it shall notify the Commission as soon as is practicable after obtaining such knowledge.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "17", "title": "Compliance — Taxpayer Identifying Number", "category": "affirmative_obligation", "summary": "Defendant must furnish its taxpayer identifying number to the FTC in accordance with 31 U.S.C. § 7701 for purposes of collecting and reporting on any delinquent amounts.", "verbatim_text": "17. Defendant is hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission its taxpayer identifying number (social security number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of its relationship with the government.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "18", "title": "Compliance — Submission Address", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 11–17 must be sent by certified mail to the Associate Director, Division of Advertising Practices, FTC.", "verbatim_text": "18. All reports, submissions, and notices required by Paragraphs 11 - 17 of this Consent Decree shall be sent by certified mail to: Associate Director, Division of Advertising Practices Bureau of Consumer Protection Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Attention: United States v. Looksmart Ltd.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "19", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction to interpret, modify, enforce, or punish violations of the Consent Decree upon application by any party.", "verbatim_text": "19. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_looksmart", "company_name": "LookSmart Ltd.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3379-looksmart-ltd", "docket_number": "Civil Action No. 01-606-A" }, { "provision_number": "6", "title": "Injunction Against COPPA Rule Violations", "category": "prohibition", "summary": "Defendants and all persons acting in concert with them are permanently enjoined from violating any provision of the COPPA Rule, as currently promulgated or as amended in the future.", "verbatim_text": "6. Defendants, their successors and assigns, and their officers, agents, servants, employees and attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined from violating, directly or through any corporation, subsidiary, division, website, or other device, any provision of the Rule as promulgated and as it may be modified in the future. A copy of the Rule is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "7", "title": "Consumer Education Remedy — FTC KidzPrivacy Notice", "category": "affirmative_obligation", "summary": "For five years from entry of the Consent Decree, defendants must place a clear and conspicuous FTC KidzPrivacy notice (with hyperlink) in their privacy policy, direct notices to parents, and at each location on their website(s) where personal information is collected.", "verbatim_text": "7. For a period of five (5) years from the date of entry of this Consent Decree, defendants, and their successors and assigns, shall, in connection with the operation of any website or online service directed in whole or in part to children, place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its website(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/kidzprivacy for information from the Federal Trade Commission about protecting children’s privacy online. Where the above notice is posted on a website or delivered via email or other electronic service, it shall be in the form of a hyperlink to www.ftc.gov/kidzprivacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to defendants, or their successors or CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 3 OF 13 assigns.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "8", "title": "Civil Penalty — $30,000 Payment", "category": "affirmative_obligation", "summary": "Defendants Monarch Services, Inc. and Girls' Life, Inc. must jointly and severally pay a civil penalty of $30,000 to the United States.", "verbatim_text": "8. Defendants Monarch Services, Inc. and Girls’ Life, Inc., and their successors and assigns, shall pay to plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of thirty thousand dollars ($30,000). Defendants are jointly and severally responsible for paying the penalty.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "9", "title": "Civil Penalty — Payment Mechanics", "category": "affirmative_obligation", "summary": "Defendants must pay the $30,000 civil penalty on the date of entry of the Consent Decree by certified or cashier's check payable to the Treasurer of the United States and delivered to the Office of Consumer Litigation.", "verbatim_text": "9. Defendants Monarch Services, Inc. and Girls’ Life, Inc., and their successors and assigns, shall make the payment required by Paragraph 8 on the date of entry of this Consent Decree by certified or cashier’s check made payable to the Treasurer of the United States and delivered to: the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "10", "title": "Default in Civil Penalty Payment", "category": "affirmative_obligation", "summary": "If defendants default on payment for more than ten days beyond the due date, the entire unpaid penalty plus interest becomes immediately due and payable.", "verbatim_text": "10. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "11", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendants must delete all personal information collected from children through www.girlslife.com between April 21, 2000 and the date of entry of this Consent Decree.", "verbatim_text": "11. Defendants, and their successors and assigns, shall delete all personal information collected from children through www.girlslife.com at any time from April 21, 2000 through the date of entry of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "12", "title": "Acknowledgment — Current Personnel", "category": "acknowledgment", "summary": "Defendants must provide copies of the Consent Decree and COPPA compliance guide to all current principals, officers, directors, managers, and relevant employees, obtain signed acknowledgments from each, and submit a compliance statement to the FTC within ten days.", "verbatim_text": "12. Defendants, and their successors and assigns, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children’s Online Privacy Protection Rule (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) to each of their current principals, officers, directors, and managers, and to all current employees, agents, representatives, and attorneys having responsibilities related to the subject matter of this Consent Decree, secure from each such person a signed statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, and shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of defendants’ compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "13", "title": "Acknowledgment — Future Personnel", "category": "acknowledgment", "summary": "Defendants must provide the Consent Decree and compliance guide to all future relevant personnel within thirty days of their assuming such responsibilities, obtain signed acknowledgments, and maintain those records available for FTC inspection upon request.", "verbatim_text": "13. Defendants, and their successors and assigns, shall provide a copy of this Consent Decree and the compliance guide to each of their future principals, officers, directors, and managers, and to all future employees, agents, representatives, and attorneys having responsibilities related to the subject matter of this Consent Decree, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or responsibilities. Defendants shall maintain copies of the signed statements, as well as other information regarding the fact and manner of their compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 5 OF 13 to the Federal Trade Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "14", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Within sixty days of entry and at such other times as the FTC requires, defendants must file a sworn written compliance report detailing their adherence to the Consent Decree, including copies of privacy notices, parental consent methods, and data security procedures.", "verbatim_text": "14. Within sixty (60) days after entry of this Consent Decree, and at such other times as the Federal Trade Commission may require, defendants, and their successors and assigns, shall file with the Commission a written report, sworn to under penalty of perjury, setting forth in detail the manner and form in which they have complied and are complying with this Consent Decree. This report shall include but not be limited to: a. a copy of each different privacy notice for www.girlslife.com and for any other of defendants’ websites or online services subject to the Rule; b. a statement setting forth in detail each place where the privacy notice is located on www.girlslife.com and on any other of defendants’ websites or online services subject to the Rule, and a copy of each screen or page on which the website collects personal information; c. a copy of each different privacy notice to parents; d. a statement setting forth in detail when and how notices to parents are provided; e. a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; f. a statement setting forth in detail the means provided for parents to review the CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 6 OF 13 personal information collected from their children and to refuse to permit its further use or maintenance; g. a statement setting forth in detail why each type of information collected is reasonably necessary for the provision of the particular related activity; and h. a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "15", "title": "Recordkeeping", "category": "recordkeeping", "summary": "For five years from entry, defendants must maintain and make available to the FTC within seven days of written request all documents demonstrating compliance, including copies of information collection forms, web pages, and representations about data practices.", "verbatim_text": "15. For a period of five years from the date of entry of this Consent Decree, defendants, and their successors and assigns, shall maintain and make available to the Federal Trade Commission for inspection and copying within seven (7) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, a sample copy of every information collection form, web page, or screen, and a sample copy of each document containing any representation regarding defendants’ collection, use, and disclosure practices pertaining to personal information. Each web page copy shall be accompanied by the URL of the Web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendants shall not be required by this paragraph to retain a document for longer than three years after the document is created; or retain a print or electronic copy of any amended web page or screen to the CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 7 OF 13 extent that the amendment does not affect defendants’ compliance obligations under this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "16", "title": "Notification of Business Changes", "category": "compliance_reporting", "summary": "Defendants must notify the FTC at least thirty days prior to any business change that may affect compliance obligations under the Consent Decree, including mergers, dissolutions, bankruptcy filings, or name/address changes.", "verbatim_text": "16. Defendants, and their successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in the business of defendants that may affect compliance obligations arising under this Consent Decree, including, but not limited to, any merger, incorporation, dissolution, assignment, sale or other action that would result in the emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that, with respect to any proposed change in the corporations about which defendants, their successors and assigns, learn less than thirty (30) days prior to the date such action is to take place, they shall notify the Commission as soon as is practicable after obtaining such knowledge. 17. Defendants are hereby required, in accordance", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "17", "title": "Taxpayer Identification Numbers", "category": "affirmative_obligation", "summary": "Defendants must furnish their taxpayer identifying numbers (SSN or EIN) to the FTC pursuant to 31 U.S.C. § 7701 for purposes of collecting and reporting on any delinquent amounts.", "verbatim_text": "practicable after obtaining such knowledge. 17. Defendants are hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission each of their taxpayer identifying numbers (social security number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of their relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "18", "title": "Submission Address for Reports and Notices", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 11–17 must be sent by certified mail to the FTC's Associate Director, Division of Advertising Practices.", "verbatim_text": "18. All reports, submissions, and notices required by Paragraphs 11 - 17 of this Consent Decree shall be sent by certified mail to: Associate Director, Division of Advertising Practices Bureau of Consumer Protection Federal Trade Commission 600 Pennsylvania Avenue, NW CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 8 OF 13 Washington, DC 20580 Attention: United States v. Monarch Services, Inc., et al.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "19", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction over this matter to enable any party to apply for further orders necessary for interpretation, modification, enforcement, or punishment of violations of the Consent Decree.", "verbatim_text": "19. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.01_monarch_services", "company_name": "Monarch Services, Inc.", "date_issued": "2001-04-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/002-3375-monarch-services-inc-et-al", "docket_number": "AMD 01 CV 1165" }, { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information", "category": "prohibition", "summary": "Defendants are permanently restrained and enjoined from violating COPPA and the COPPA Rule, including failures related to notice, direct notice to parents, verifiable parental consent, deletion of parental contact information, and reasonable security procedures.", "verbatim_text": "A. Failing to provide sufficient notice on its Web site or online services of the Personal 23 Information it Collects, or is Collected on their behalf, online from Children, how it uses 24 such information, its Disclosure practices, and all other required content; 25\n\nB. Failing to provide sufficient direct notice to Parents of the Personal Information 26 27 Defendants Collect, or Personal Information that has been Collected on Defendants’ 28 PROPOSED STIPULATED ORDER, Case No. 5:19-cv-2222; 9 Case 5:19-cv-02222-NC Document 3 Filed 04/24/19 Page 10 of 23 1 behalf, online from Children, how it uses such information, its Disclosure practices, and 2 all other required content;\n\nC. Failing to Obtain Verifiable Parental Consent using a method reasonably calculated to 4 ensure that the Person providing consent is the Child’s Parent, and failing to Obtain 5 Verifiable Parental Consent for some under-13 users despite Collecting Personal 6 Information from them;\n\n8 D. Failing to delete Online Contact Information of the Parent after having failed to Obtain 9 Verifiable Parental Consent; and\n\nE. Failing to establish and maintain reasonable procedures to protect the confidentiality, 11 security, and integrity of Personal Information Collected from Children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "II", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Judgment of $35,000 is entered against Defendants jointly and severally as a civil penalty, to be paid within seven days of entry of this Order by electronic fund transfer.", "verbatim_text": "17 A. Judgement in the amount of thirty-five thousand dollars ($35,000) is entered in favor of 18 Plaintiff against Defendants, jointly and severally, as a civil penalty.\n\nB. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer of the 20 United States, thirty-five thousand dollars ($35,000), which, as Defendants stipulate, their 21 undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. 22 Such payment must be made within seven (7) days of entry of this Order by electronic 23 24 fund transfer in accordance with instructions previously provided by a representative of 25 Plaintiff.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "III", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to assets transferred under the Order; complaint facts are taken as true in future litigation; the civil penalty is non-dischargeable in bankruptcy; and Defendants must provide their Taxpayer Identification Numbers to the Commission.", "verbatim_text": "A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all 4 assets transferred pursuant to this Order and may not seek the return of any assets.\n\nB. The facts alleged in the Complaint will be taken as true, without further proof, in any 6 subsequent civil litigation by or on behalf of the Commission, including in a proceeding 7 8 to enforce its rights to any payment or monetary judgement pursuant to this Order.\n\n9 C. Defendants agree that the judgment represents a civil penalty owed to the government of 10 the United States, is not compensation for actual pecuniary loss, and, therefore, as to the 11 Individual Defendants, it is not subject to discharge under the Bankruptcy Code pursuant 12 to 11 U.S.C. § 523(a)(7).\n\nD. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants 14 must submit to the Commission, may be used for collecting and reporting on any 15 16 delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "IV", "title": "Mandated Information Security Program", "category": "affirmative_obligation", "summary": "Each Covered Business must establish and maintain a comprehensive information security program with documented safeguards, designated coordinators, risk assessments, testing, service provider oversight, and regular evaluation.", "verbatim_text": "1 A. Document in writing the content, implementation, and maintenance of the Information 2 Security Program;\n\nB. Designate a qualified employee or employees to coordinate and be responsible for the 4 Information Security Program;\n\nC. Assess and document, at least once every twelve months and promptly following a 6 Covered Incident, internal and external risks to the security, confidentiality, or integrity 7 8 of Covered Information that could result in the unauthorized Disclosure, misuse, loss, 9 alteration, destruction, or other compromise of such information;\n\nD. Design, implement, and document safeguards that address the internal and external risks 11 each Covered Business identifies to the security, confidentiality, or integrity of Covered 12 Information identified in response to sub-Provision IV.C. Each safeguard shall take into 13 account the sensitivity of Covered Information at issue;\n\nE. Assess, at least once every twelve months and promptly following a Covered Incident, 15 16 the sufficiency of any safeguards in place to address the risks to the security, 17 confidentiality, or integrity of Covered Information. Each such assessment must evaluate 18 safeguards in each area of relevant operation, including: (1) employee training and 19 management; (2) information systems, such as network and software design, information 20 processing, storage, transmission, and disposal; and (3) prevention, detection, and 21 response to attacks, intrusions, or other systems failures;\n\nF. Test and monitor the effectiveness of the safeguards at least once every twelve months 23 24 and promptly following a Covered Incident, and modify the Information Security 25 Program based on the results;\n\n1 G. Select and retain service providers capable of safeguarding Covered Information they 2 receive from each Covered Business, and contractually require service providers to 3 implement and maintain safeguards for Covered Information; and\n\nH. Evaluate and adjust the Information Security Program in light of any changes to its 5 operations or business arrangements, a Covered Incident, or any other circumstances that 6 Defendants know or have reason to know may have an impact on the effectiveness of the 7 8 Information Security Program. At a minimum, Defendants must evaluate the Information 9 Security Program at least once every twelve months.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "V", "title": "Information Security Assessments by a Third Party", "category": "assessment", "summary": "Defendants must obtain an initial and biennial third-party assessments of the information security program by a qualified assessor (CISSP, CISA, or GIAC-certified), covering the first 180 days and each 2-year period thereafter for ten years, with results submitted to the FTC.", "verbatim_text": "A. The Assessments must be obtained from a qualified, objective, independent third-party 15 16 professional (“Assessor”), who uses procedures and standards generally accepted in the 17 profession. The Assessor preparing such Assessments must be: an individual qualified 18 as a Certified Information System Security Professional (CISSP) or as a Certified 19 Information Systems Auditor (CISA); an individual holding Global Information 20 Assurance Certification (GIAC) from the SANS Institute; or a qualified individual or 21 entity approved by the Associate Director for Enforcement, Bureau of Consumer 22 Protection, Federal Trade Commission.\n\n1 B. The reporting period for the Assessments must cover: (1) the first 180 days after the 2 issuance date of the Order for the initial Assessment; and (2) each 2-year period 3 thereafter for ten (10) years after issuance of the Order for the biennial Assessments.\n\nC. Each Assessment must: (1) determine whether each Covered Business has implemented 5 and maintained Provision IV of this Order titled Mandated Information Security 6 Program; (2) assess the effectiveness of each Covered Business’s implementation and 7 8 maintenance of sub-Provisions IV.A-H; and (3) identify any gaps or weaknesses in the 9 Information Security Program.\n\nD. Each Assessment must be completed within sixty (60) days after the end of the reporting 11 period to which the Assessment applies. Unless otherwise directed by a Commission 12 representative in writing, Defendants must submit the initial Assessment to the 13 Commission within ten (10) days after the Assessment has been completed via email to 14 DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to Associate 15 16 Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 17 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: 18 FTC v. Unixiz, Inc. All subsequent biennial Assessments shall be retained by Defendants 19 until the order is terminated and provided to the Associate Director for Enforcement 20 within ten (10) days of request.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "VI", "title": "Prohibition Against Misrepresentations to the Assessor", "category": "prohibition", "summary": "Defendants must not misrepresent, expressly or by implication, any fact material to the Assessor's determination of compliance, effectiveness of the security program, or identification of gaps or weaknesses.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants, whether acting directly or indirectly, in 23 24 connection with any Assessment required by Provision V of this Order titled Information 25 Security Assessments by a Third Party, must not misrepresent in any manner, expressly or by 26 implication, any fact material to the Assessor’s: (1) determination of whether each Covered 27 28 PROPOSED STIPULATED ORDER, Case No. 5:19-cv-2222; 14 Case 5:19-cv-02222-NC Document 3 Filed 04/24/19 Page 15 of 23 1 Business has implemented and maintained Provision IV of this Order titled Mandated 2 Information Security Program; (2) assessment of the effectiveness of the implementation and 3 maintenance of sub-Provisions IV.A-H; or (3) identification of any gaps or weaknesses in the 4 Information Security Program.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Prohibition" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "VII", "title": "Annual Certification", "category": "compliance_reporting", "summary": "Defendants must provide annual certifications to the FTC for ten years from a senior corporate manager or officer of each Covered Business confirming compliance with the Order, noting any material noncompliance, and describing any Covered Incidents.", "verbatim_text": "9 A. One year after the issuance date of this Order, and each year thereafter for a period of ten 10 (10) years, provide the Commission with a certification from a senior corporate manager, 11 or, if no such senior corporate manager exists, a senior officer of each Covered Business 12 responsible for each Covered Business’s Information Security Program that: (1) each 13 Covered Business has established, implemented, and maintained the requirements of this 14 Order; (2) each Covered Business is not aware of any material noncompliance that has 15 16 not been (a) corrected or (b) disclosed to the Commission; and (3) includes a brief 17 description of any Covered Incident. The certification must be based on the personal 18 knowledge of the senior corporate manager, senior officer, or subject matter experts upon 19 whom the senior corporate manager or senior officer reasonably relies in making the 20 certification.\n\nB. Unless otherwise directed by a Commission representative in writing, submit all annual 22 certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or 23 24 by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, 25 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 26 NW, Washington, DC 20580. The subject line must begin: FTC v. Unixiz, Inc.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Data Security" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "VIII", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt within seven days; must deliver a copy of the Order to principals, officers, managers, and relevant employees within seven days (and before new hires assume responsibilities) for five years; and must obtain signed acknowledgments from each recipient within thirty days.", "verbatim_text": "A. Each Defendant, within seven (7) days of entry of this Order, must submit to the 5 Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For 5 years after entry of this Order, each Individual Defendant for any business that such 7 8 Defendant, individually or collectively with any other Defendants, is the majority owner 9 or controls directly or indirectly, and each Corporate Defendant, must deliver a copy of 10 this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) 11 all employees having managerial responsibilities for conduct related to the subject matter 12 of the Order and all agents and representatives who participate in conduct related to the 13 subject matter of the Order; and (3) any business entity resulting from any change in 14 structure as set forth in the Section titled Compliance Reporting. Delivery must occur 15 16 within seven (7) days of entry of this Order for current personnel. For all others, delivery 17 must occur before they assume their responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this Order, that 19 Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of 20 receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "IX", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn compliance report one year after entry of the Order, provide compliance notices within fourteen days of any material changes for ten years, notify the FTC of bankruptcy filings within fourteen days, and submit all required information in the prescribed format and manner.", "verbatim_text": "A. One year after entry of this Order, each Defendant must submit a compliance report, 5 sworn under penalty of perjury. 6 1. Each Defendant must: (a) identify the primary physical, postal, and email 7 8 address and telephone number, as designated points of contact, which 9 representatives of the Commission and Plaintiff may use to communicate with 10 Defendant; (b) identify all of that Defendant’s businesses by all of their names, 11 telephone numbers, and physical, postal, email, and Internet addresses; (c) 12 describe the activities of each business, including the goods and services offered, 13 the means of advertising, marketing, and sales, and the involvement of any other 14 Defendant (which Individual Defendants must describe if they know or should 15 16 know due to their own involvement); (d) describe in detail whether and how that 17 Defendant is in compliance with each Section of this Order; (e) provide a copy of 18 each different version of any privacy notice posted on each Web site or online 19 service operated by Defendants or sent to Parents of Children that register on each 20 Web site or online service; (f) describe in detail the methods used to Obtain 21 Verifiable Parental Consent prior to any Collection, use, and/or Disclosure of 22 Personal Information from Children through any Web site or online service; (g) 23 24 describe in detail the means provided for Parents to review the Personal 25 Information Collected from their Children and to refuse to permit its further use 26 27 28 PROPOSED STIPULATED ORDER, Case No. 5:19-cv-2222; 17 Case 5:19-cv-02222-NC Document 3 Filed 04/24/19 Page 18 of 23 1 or maintenance; and (h) provide a copy of each Order Acknowledgment obtained 2 pursuant to this Order, unless previously submitted to the Commission.\n\n2. Additionally, each Individual Defendant must: (a) identify all telephone 4 numbers and all physical, postal, email and Internet addresses, including all 5 residences; (b) identify all business activities, including any business for which 6 such Defendant performs services whether as an employee or otherwise and any 7 8 entity in which such Defendant has any ownership interest; and (c) describe in 9 detail such Defendant’s involvement in each such business, including title, role, 10 responsibilities, participation, authority, control, and any ownership.\n\nB. For ten (10) years after entry of this Order, each Defendant must submit a compliance 12 notice, sworn under penalty of perjury, within fourteen (14) days of any change in the 13 following: 14 15 1. Each Defendant must report any change in: (a) any designated point of contact; 16 or (b) the structure of any Corporate Defendant or any entity that Defendant has 17 any ownership interest in or controls directly or indirectly that may affect 18 compliance obligations arising under this Order, including: creation, merger, sale, 19 or dissolution of the entity or any subsidiary, parent, or affiliate that engages in 20 any acts or practices subject to this Order.\n\n2. Additionally, each Individual Defendant must report any change in: (a) name, 22 23 including aliases or fictitious name, or residence address; or (b) title or role in any 24 business activity, including any business for which such Defendant performs 25 services whether as an employee or otherwise and any entity in which such 26 27 28 PROPOSED STIPULATED ORDER, Case No. 5:19-cv-2222; 18 Case 5:19-cv-02222-NC Document 3 Filed 04/24/19 Page 19 of 23 1 Defendant has any ownership interest, and identify the name, physical address, 2 and any Internet address of the business or entity.\n\nC. Each Defendant must submit to the Commission notice of the filing of any bankruptcy 4 petition, insolvency proceeding, or similar proceeding by or against such Defendant 5 within fourteen (14) days of its filing.\n\nD. Any submission to the Commission required by this Order to be sworn under penalty of 7 8 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 9 concluding: “I declare under penalty of perjury under the laws of the United States of 10 America that the foregoing is true and correct. Executed on: _____” and supplying the 11 date, signatory’s full name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all submissions to 13 the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by 14 overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 15 16 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 17 NW, Washington, DC 20580. The subject line must begin: FTC v. Unixiz, Inc.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "X", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create certain records for ten years after entry of the Order and retain each such record for five years, including accounting records, personnel records, consumer complaints, compliance records, and copies of all web forms and representations regarding personal information collection.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants must create certain records for (ten) 10 20 years after entry of the Order, and retain each such record for (five) 5 years. Specifically, 21 Corporate Defendant in connection with any Web site or online service and each Individual 22 Defendant for any business that such Defendant, individually or collectively with any other 23 24 Defendants, is a majority owner or controls directly or indirectly, must create and retain the 25 following records: 26 A. accounting records showing the revenues from all goods or services sold;\n\n1 B. personnel records showing, for each Person providing services, whether as an employee 2 or otherwise, that Person’s: name; addresses; telephone numbers; job title or position; 3 dates of service; and (if applicable) the reason for termination;\n\nC. records of all consumer complaints concerning the subject matter of the Order, whether 5 received directly or indirectly, such as through a Third Party, and any response;\n\nD. all records necessary to demonstrate full compliance with each provision of this Order, 7 8 including all submissions to the Commission; and\n\n9 E. a copy of each materially different form, page, or screen created, maintained, or 10 otherwise provided by Defendants through which Personal Information is Collected 11 through any Web site or online service, and a copy of each materially different document 12 containing any representation regarding Collection, use, and Disclosure practices 13 pertaining to Personal Information Collected through such Web site or online service. 14 Each webpage copy shall be accompanied by the URL of the webpage where the material 15 16 was posted online. Electronic copies shall include all text and graphic files, audio scripts, 17 and other computer files used in presenting information on the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "XI", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through information requests, depositions, document production, discovery, direct communications, interviews, undercover monitoring, and consumer reports from credit agencies.", "verbatim_text": "A. Within fourteen (14) days of receipt of a written request from a representative of the 22 Commission or Plaintiff, each Defendant must: submit additional compliance reports or 23 24 other requested information, which must be sworn under penalty of perjury; appear for 25 depositions; and produce documents for inspection and copying. The Commission and 26 Plaintiff are also authorized to obtain discovery, without further leave of court, using any 27 28 PROPOSED STIPULATED ORDER, Case No. 5:19-cv-2222; 20 Case 5:19-cv-02222-NC Document 3 Filed 04/24/19 Page 21 of 23 1 of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including 2 telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to 4 communicate directly with each Defendant. Defendant must permit representatives of the 5 Commission and Plaintiff to interview any employee or other Person affiliated with any 6 Defendant who has agreed to such an interview. The Person interviewed may have 7 8 counsel present.\n\n9 C. The Commission and Plaintiff may use all other lawful means, including posing, through 10 its representatives as consumers, suppliers, or other individuals or entities, to Defendants 11 or any individual or entity affiliated with Defendants, without the necessity of 12 identification or prior notice. Nothing in this Order limits the Commission’s lawful use 13 of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 14 57b-1.\n\n16 D. Upon written request from a representative of the Commission or Plaintiff , any consumer 17 reporting agency must furnish consumer reports concerning Individual Defendants, 18 pursuant to Section 604(1) of the Fair Credit Reporting Act, 15 U.S.C. §1681b(a)(1).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "XII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 21 purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "04.19_unixiz_doing_business_as_i-dressup.com", "company_name": "UNIXIZ, Inc.", "date_issued": "2019-04-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3002-unixiz-inc-doing-business-i-dressupcom", "docket_number": "5:19-cv-2222" }, { "provision_number": "15", "title": "Injunction — COPPA Rule Compliance", "category": "prohibition", "summary": "Defendants are permanently enjoined from failing to provide required privacy notices, failing to send direct notice to parents, failing to obtain verifiable parental consent before collecting children's personal information, and from violating any other provision of the COPPA Rule.", "verbatim_text": "1 A. Failing, on any website or online service directed to children, or on 2 any website or online service through which they, with actual 3 knowledge, collect, use, and/or disclose personal information from 4 children, to provide sufficient notice of the information Defendants 5 collect online from children, how they use such information, their 6 disclosure practices, and all other content, as required by Section 7 312.4(b) of the Rule, 16 C.F.R. § 312.4(b);\n\n8 B. Failing, on any website or online service directed to children, or on 9 any website or online service through which they, with actual 10 knowledge, collect, use, and/or disclose personal information from 11 children, to provide direct notice to parents of what information 12 Defendants collect online from children, how they use such 13 information, their disclosure practices, and all other required content, 14 as required by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c);\n\n15 C. Failing, on any website or online service directed to children, or on 16 any website or online service through which they, with actual 17 knowledge, collect, use, and/or disclose personal information from 18 children, to obtain verifiable parental consent before any collection, 19 use, and/or disclosure of personal information from children, as 20 required by Section 312.5 of the Rule, 16 C.F.R. § 312.5(a)(I); or,\n\n21 D. Violating any other provision of the Children's Online Privacy 22 Protection Rule, 16 C.F .R. Part 312, and as the Rule may hereafter be 23 amended. A copy of the Rule is attached hereto' as \"Appendix A\" and 24 incorporated herein as if fully set forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "16", "title": "Injunction — No Misrepresentations About Children's Privacy", "category": "prohibition", "summary": "Defendants are permanently enjoined from making any misrepresentation in a privacy policy or elsewhere about the collection, use, disclosure, or deletion of children's personal information in connection with the operation of any website or online service.", "verbatim_text": "25 16. IT IS FURTHER ORDERED that Defendants, and their officers, agents, 26 representatives, and employees, and all persons in active concert or 27 participation with them who receive actual notice of this Order by personal 28 service or otherwise, are hereby enjoined, directly or through any Consent Decree Page 4 of 20 EXHIBIT_ 1 1 corporation, subsidiary, division, website, or other device, in connection 2 with the operation of any website or online service, from making any 3 misrepresentation in the website or online service's privacy policy or 4 elsewhere about the website or online service's collection, use, disclosure, 5 or deletion of children's personal information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "17", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Within 10 days of notice of entry of this Order, Defendants must delete all personal information collected in violation of the Rule from April 21, 2000 through the date of entry of this Order.", "verbatim_text": "8 the date of receipt of notice of the entry of this Order shall delete all 9 personal information collected and maintained within their possession, 10 custody, or control in violation of the Rule at any time from April 21, 2000 11 through the date of entry of this Order. 12 CONSUMER EDUCATION REMEDY", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "18", "title": "Consumer Education Remedy — OnGuardOnline Notice", "category": "affirmative_obligation", "summary": "For five years from entry, Defendants must prominently display a clear and conspicuous FTC OnGuardOnline.gov notice within their privacy policy, in direct notices to parents, and at each location on their websites where personal information is collected. Defendants must update hyperlinks within 15 days of notice of any URL change.", "verbatim_text": "13 18. IT IS FURTHER ORDERED that, for a period of five (5) years from the 14 date of entry of this Order, Defendants, in connection with their operation of 15 any website or online service directed to children, and any website or online 16 service through which Defendants, with actual knowledge, collect, use, 17 and/or disclose personal information from children, shall place a clear and 18 conspicuous notice: (1) within the privacy policy required to be posted by 19 Section 312.4(b) of the Rule, 16 C.F .R. § 312.4(b); (2) within the direct 20 notice required to be sent to parents by Section 312.4(c ) of the Rule, 16 21 C.F .R. § 312.4(c ); and, (3) at each location on the website or online service 22 where personal information is collected, which states as follows in bold 23 typeface: 24 NOTICE: Visit www.OnGuardOnline.gov for ti~s from the Federal Trade Commission on protecting kids privacy online 25 r\"www.OnguardOnline.gov\" must contain a hyperlink to nttp://www.onguardonline.gov/topicslkids-privacy.aspx]\n\nDefendants shall be required to change the hyperlinkslURLs within fifteen 27 (15) days after receipt of notice from the Federal Trade Commission of a 28 change to such hyperlinkslURLs.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "19", "title": "Civil Penalty — Amount", "category": "affirmative_obligation", "summary": "Defendants must jointly and severally pay a civil penalty of $3,000,000 to the United States pursuant to Section 5(m)(1)(A) of the FTC Act.", "verbatim_text": "2 19. IT IS FURTHER ORDERED that Defendants, jointly and severally, shall 3 pay to Plaintiff a civil penalty, pursuant to Section 5(m)(I)(A) of the FTC 4 Act, 15 U.S.C. § 45(m)(1)(A), in the amount of three million dollars 5 ($3,000,000).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "20", "title": "Civil Penalty — Payment Procedure", "category": "affirmative_obligation", "summary": "Prior to or concurrently with executing the Order, Defendants must turn over the full penalty amount to their attorneys to hold; within 5 days of notice of entry, attorneys must wire transfer or deliver a certified cashier's check for $3,000,000 to the Treasurer of the United States.", "verbatim_text": "6 20. Prior to or concurrently with Defendants' execution of this Order, 7 Defendants shall tum over the full amount of the civil penalty to their 8 attorneys, who shall hold the entire sum for no purpose other than payment 9 to the Treasurer of the United States after entry of this Order by the Court.\n\n10 Within five (5) days of receipt of notice of the entry of this Order, 11 Defendants' attorneys shall transfer the sum of three million dollars 12 ($3,000,000) in the form of a wire transfer or certified cashier's check made 13 payable to the Treasurer of the United States. The check andlor written 14 confirmation of the wire transfer shall be delivered in accordance with 15 procedures specified by the Office of Consumer Litigation, Civil Division, 16 U.S. Department of Justice, Washington, DC 20530.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "21", "title": "Civil Penalty — Relinquishment of Funds", "category": "affirmative_obligation", "summary": "Defendants relinquish all dominion, control, and title to the funds paid and shall make no claim for return of the funds.", "verbatim_text": "17 21. Defendants relinquish all dominion, control, and title to the funds paid to 18 the fullest extent permitted by law. Defendants shall make no claim to or 19 demand return of the funds, directly or indirectly, through counselor 20 otherwise.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "22", "title": "Civil Penalty — Non-Contest of Payment", "category": "affirmative_obligation", "summary": "Defendants agree not to contest the Commission's right to any payment or money judgment in any subsequent civil litigation to enforce the Order.", "verbatim_text": "21 22. Defendants agree that they will not .contest the Commission's right to any 22 payment or money judgment in any subsequent civil litigation filed by or on 23 behalf of the Commission to enforce its rights to any payment or money 24 judgment pursuant to this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "23", "title": "Civil Penalty — Non-Dischargeable in Bankruptcy", "category": "affirmative_obligation", "summary": "Defendants agree the judgment represents a civil penalty owed to the United States Government and, as to the Individual Defendant, is not subject to discharge under the Bankruptcy Code.", "verbatim_text": "25 23. Defendants agree that the judgment represents a civil penalty owed to the 26 United States Government, and is not compensation for actual pecuniary 27 loss, and therefore, as to the Individual Defendant, it is not subject to 28 discharge under the Bankruptcy Code pursuant to 11 U.S.C. § 523(a)(7).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "24", "title": "Civil Penalty — Default Interest", "category": "affirmative_obligation", "summary": "If any payment defaults for more than 10 days beyond the due date, the entire unpaid penalty plus interest becomes immediately due and payable.", "verbatim_text": "1 24. In the event of any default payment, which default continues for ten (10) 2 days beyond the due date of payment, the entire unpaid penalty, together 3 with interest, as computed pursuant to 28 U.S.C. § 1961 (accrued from the 4 date of default to the date of payment) shall immediately become due and 5 payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "25", "title": "Compliance Monitoring", "category": "monitoring", "summary": "For the purpose of monitoring compliance with the Order, Defendants must respond to written requests, produce documents, appear for depositions, and provide the Commission access to business locations within 14 days; the Commission may also use other lawful means including undercover posing and civil discovery without further leave of court.", "verbatim_text": "9 A. Within fourteen (14) days of receipt ofa written request from a 10 representative of the Commission, Defendants each shall submit 11 written responses, which are true and accurate and sworn to under 12 penalty of perjury; produce documents for inspection and copying; 13 appear for deposition; and provide entry during normal business 14 hours to any business location in each Defendant's possession or 15 direct or indirect control to inspect the business operation. Provided 16 that, Defendants, after attempting to resolve a dispute without court 17 action and for good cause shown, may file a motion with this Court 18 seeking an order including one or more of the protections set forth in 19 Fed. R. Civ. P. 26(c).\n\n20 B. In addition, the Commission is authorized to use all other lawful 21 means, including but not limited to: 22 1. Obtaining discovery from any person , without further leave of 23 court, using the procedures prescribed by Fed. R. Civ. P. 30, 24 31,33,34,36,45 and 69; 25 2. Having its representatives pose as consumers and suppliers to 26 Defendants, their employees, or any other entity managed or 27 controlled in whole or in part by any Defendant, without the 28 necessity of identification or prior notice; and,\n\n1 C. Defendants each shall permit representatives of the Commission to 2 interview any employer, consultant, independent contractor, 3 representative, agent, or employee who has agreed to such an 4 interview, relating in any way to any conduct subject to this Order. 5 The person interviewed may have counsel present, including 6 Defendants' counsel and any individual counsel.\n\n7 D. For purposes of the compliance reporting and monitoring required by 8 this Order, the Commission is authorized to communicate directly 9 with each Defendant. Defendants may have counsel present.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "26", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "For four years from entry, the Individual Defendant must notify the Commission of changes in residence, employment, business ownership, business structure, and name within specified timeframes; the Corporate Defendant must notify of structural changes; all Defendants must provide sworn written compliance reports starting 60 days after entry; and Defendants must notify of any bankruptcy filing within 15 days.", "verbatim_text": "19 A. F or a period of four (4) years from the date of entry of this Order, 20 1. The Individual Defendant shall notify the Commission of the 21 following: 22 a. Any changes in the Individual Defendant's residence, 23 mailing address, and telephone number, within ten (10) 24 days of the date of such change;\n\n25 b. Any changes in the Individual Defendant's employment 26 status (including self-employment), and any change in 27 the Individual Defendant's ownership in any business 28 entity, within ten (10) days of the date of such change. Consent Decree Page 8 of 20 EXHIBIT_ II 1 Such notice shall include the name and address of each 2 business that the Individual Defendant is affiliated with, 3 employed by, creates or forms, or performs services for; 4 a detailed description of the nature of the business; and a 5 detailed description of the Individual Defendant's duties 6 and responsibilities in connection with the business or 7 employment; and,\n\n8 c. Any changes in the structure of any business entity that 9 the Individual Defendant directly or indirectly controls 10 or has an ownership interest in, that may affect 11 compliance obligations arising under this Order, 12 including but not limited to: incorporation or other 13 organization; a dissolution, assignment, sale, merger, or 14 .o ther action; the creation or dissolution of a subsidiary, 15 parent, or affiliate that engages in any acts or practices 16 subject to this Order; or a change in the business name or 17 address, at least thirty (30) days prior to such change, 18 provided that, with respect to any such change in the 19 business entity about which the Individual Defendant 20 learns less than thirty (30) days prior to the date such 21 action is to take place, the Individual Defendant shall 22 notify the Commission as soon as is practicable after 23 obtaining such knowledge; and\n\n24 d. Any changes in the Individual Defendant's name or use 25 of any aliases or fictitious names within ten (10) days of 26 the date of such change.\n\n27 2. The Corporate Defendant shall notify the Commission of any 28 changes in the structure of the Corporate Defendant or any business entity that it directly or indirectly controls, or has an Consent Decree Page 9 of 20 1c9-- EXHIBIT- 1 ownership interest in, that may affect compliance obligations 2 arising under this Order, including but not limited to: 3 incorporation or other organization; a dissolution, assignment, 4 sale, merger, or other action; the creation or dissolution of a 5 subsidiary, parent, or affiliate that engages in any acts or 6 practices subject to this Order; or a change in the business 7 name or address, at least thirty (30) days prior to such change, 8 provided that, with respect to any such change in the business 9 entity about which the Corporate Defendant learns less than 10 thirty (30) days prior to the date such action is to take place, it 11 shall notify the Commission as soon as is practicable after 12 obtaining such knowledge.\n\n13 B. Sixty (60) days after the date of entry of this Order, and thereafter for 14 a period of four (4) years, at such times as the Federal Trade 15 Commission shall reasonably require, Defendants each shall provide 16 a written report to the Commission, which is true and accurate and 17 sworn to under penalty of perjury, setting forth in detail the manner 18 and form in which each has complied and is complying with this 19 Order. This report shall include, but not be limited to: 20 1. For the Individual Defendant: 21 a. The Individual Defendant's then-current residence 22 address, mailing addresses, and telephone numbers; 23 b. The Individual Defendant's then-current employment 24 status (including self-employment), including the name, 25 addresses, and telephone numbers of each business that 26 the Individual Defendant is affiliated with, employed by, 27 or performs services for; a detailed description of the 28 nature of the business; and a detailed description of the Consent Decree Page 10 of 20 EXHIBIT_' _ 10 1 Individual Defendant's duties and responsibilities in 2 connection with the business or employment; and, 3 c. Any other changes required to be reported under Section 4 26.A. of this Order. 5 2. For the Corporate Defendant, and for the Individual Defendant 6 in connection with any business that the Individual Defendant 7 controls, directly or indirectly, or in which he has a majority 8 ownership interest: 9 a. A statement setting forth in detail the criteria and process 10 through which each Defendant's websites or online 11 services register visitors online for any activity requiring 12 the submission of personal information, and a copy of 13 each different version of screen or page providing or 14 collecting registration information; 15 b. A copy of each different version of privacy notice posted 16 on each website or online service operated by each 17 Defendant; 18 c. A statement setting forth in detail each place where the 19 privacy notice on any such website or online service is 20 located and a copy of each different version of screen or 21 page on which such website or online service collects 22 personal information; 23 d. A copy of each different version of privacy notice sent to 24 parents of children that register on each website or online 25 serVIce; 26 e. A statement setting forth in detail when and how each 27 such notice to parents is provided; 28 f. A statement setting forth in detail the methods used to Consent Decree Page 11 of 20 ILl EXHIBIT_'_ 1 obtain verifiable parental consent prior to any collection, 2 use, and/or disclosure of personal infonnation from 3 children; 4 g. A statement setting forth in detail the means provided for 5 parents to review the personal infonnation collected 6 from their children and to refuse to pennit its further use 7 or maintenance; 8 h. A statement setting forth in detail why each type of 9 infonnation collected from a child is reasonably 10 necessary for the provision of the particular related 11 activity; 12 1. A statement setting forth in detail the procedures used to 13 protect the confidentiality, security, and integrity of 14 personal infonnation collected from children; 15 J. A copy of each acknowledgment of receipt of this Order, 16 obtained pursuant to the Section titled \"Distribution of 17 Order'\" , and, 18 k. Any other changes required to be reported under Section 19 26.A. of this Order.\n\n20 C. Each Defendant shall notify the Commission of the filing of a 21 bankruptcy petition by such Defendant within fifteen (15) days of 22 filing.\n\n23 D. For the purposes of this Order, Defendants shall, unless otherwise 24 directed by the Commission's authorized representatives, send by 25 overnight courier (not the U.S. Postal Service) all reports and 26 notifications to the Commission that are required by this Order to the 27 following address: 28 Consent Decree Page 12 of 20 IE) EXHIBIT_f_ Associate Director for Enforcement Bureau of Consumer Protection Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, D.C. 20580 RE: Us. v. Plavdom. Inc. Provided that, in lieu of overnight courier, Defendants may send such reports or notifications by first-class mail, but only if Defendants contemporaneously send an electronic version of such report or notification to the Commission at: DEBrief@ftc.gov.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "27", "title": "Record-Keeping", "category": "recordkeeping", "summary": "For seven years from entry of the Order, Defendants must create and retain records sufficient to demonstrate full compliance, including copies of acknowledgments, all Commission reports, and sample copies of every materially different form or web page through which personal information is collected or privacy representations are made.", "verbatim_text": "IT IS FURTHER ORDERED that, for a period of seven (7) years from the date of entry of this Order, Defendants, for any business for which they, individually or collectively, are the majority owner or directly or indirectly control, are hereby restrained and enjoined from failing to create and retain the following records: A. A print or electronic copy (in HTML format) of all documents necessary to demonstrate full compliance with each provision of this Order, including, but not limited to: 1. Copies of acknowledgments of receipt of this Order required by Sections titled \"Distribution of Order\" and \"Acknowledgment of Receipt of Order\"; 2. All reports submitted to the Commission pursuant to the Section titled \"Compliance Reporting\"; 3. A sample copy of every materially different form, web page, or screen through which personal information is collected, and a sample copy of each materially different document containing any representation regarding D\"efendants' collection, use, and disclosure practices pertaining to personal information of a Consent Decree Page 13 of 20 1(P EXHIBIT_I_ 1 child. Each web page copy shall be accompanied by the URL 2 of the web page where the material was posted online. 3 Electronic copies shall include all text and graphics files, audio 4 scripts, and other computer files used in presenting infonnation 5 on the Internet. Provided, however, that Defendants shall not 6 be required to retain any document for longer than two (2) 7 years after the document was created, or to retain a print or 8 electronic copy of any amended web page or screen to the 9 extent that the amendment does not affect Defendants' 10 compliance obligations under this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "28", "title": "Distribution of Order", "category": "acknowledgment", "summary": "For four years from entry, Defendants must deliver copies of the Order to all principals, officers, directors, managers, and relevant employees and agents of their businesses, within specified timeframes; Defendants must also obtain signed and dated acknowledgments of receipt from all persons receiving the Order within 30 days of delivery.", "verbatim_text": "15 A. Corporate Defendant: The Corporate Defendant must deliver a copy 16 of this Order to: (1) all of its principals, officers, directors, and 17 managers of any business engaged in conduct related to the subject 18 matter of the Order; (2) all employees, agents, and representatives 19 who have responsibilities related to the operation of any website or 20 online service subject to this Order; and (3) any business entity 21 resulting from any change in structure set forth in Subsection A.2. of 22 the Section titled \"Compliance Reporting.\" For current personnel, 23 delivery shall be within five (5) days of service of this Order upon the 24 Corporate Defendant. For new personnel, delivery shall occur prior 25 to their assuming their responsibilities. For any business entity 26 resulting from any change in structure set forth in Subsection A.2. of 27 the Section titled \"Compliance Reporting,\" delivery shall be at least 28 ten (10) days prior to the change in structure.\n\n1 B. Individual Defendant as a control person: For any business engaged 2 in conduct related to the subject matter of the Order that the 3 Individual Defendant controls, directly or indirectly, or in which the 4 Individual Defendant has a majority ownership interest, the 5 Individual Defendant must deliver a copy of this Order to: (1) all 6 principals, officers, directors, and managers; and (2) all employees, 7 agents, and representatives who have responsibilities related to the 8 operation of any website or online service subject to this Order. For 9 current personnel, delivery shall be within five (5) days of service of 10 this Order upon the Individual Defendant. For new personnel, 11 delivery shall occur prior to their assuming their responsibilities.\n\n12 C. Individual Defendant as employee or non-control person: For any 13 business where the Individual Defendant is not a controlling person 14 of a business but otherwise engages in conduct related to the subject 15 matter of this Order, the Individual Defendant must deliver a copy of 16 this Order to all principals and managers of such business before 17 engaging in such conduct.\n\n18 D. Defendants must secure a signed and dated statement acknowledging 19 receipt of the Order, within thirty (30) days of delivery, from all 20 persons receiving a copy of the Order pursuant to this Section. 21 Defendants shall maintain copies of the signed statements, as well as 22 other information regarding the fact and manner of its compliance, 23 including the name and title of each person to whom a copy of the 24 Order has been provided and, upon request, shall make the statements 25 and other information available to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "29", "title": "Acknowledgment of Receipt of Order", "category": "acknowledgment", "summary": "Each Defendant must submit a truthful sworn statement to the Commission acknowledging receipt of this Order within five business days of receipt of the Order as entered by the Court.", "verbatim_text": "27 29. IT IS FURTHER ORDERED that each Defendant, within five (5) 28 business days of receipt of this Order as entered by the Court, must submit Consent Decree Page 15 of 20 /0 EXHIBIT 1 to the Commission a truthful sworn statement acknowledging receipt of this 2 Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "30", "title": "Provision of Taxpayer Identifying Numbers", "category": "affirmative_obligation", "summary": "The Corporate Defendant must furnish its taxpayer identifying number (employer identification number) to the FTC in accordance with 31 U.S.C. § 7701 for purposes of collecting and reporting any delinquent amounts.", "verbatim_text": "4 30. IT IS FURTHER ORDERED that the Corporate Defendant is hereby 5 required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal 6 Trade Commission its taxpayer identifying number (employer identification 7 number), which shall be used for purposes of collecting and reporting any 8 delinquent amount arising out of its relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "31", "title": "Retention of Jurisdiction", "category": "duration", "summary": "This Court retains jurisdiction of this matter for the purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "10 31. This Court shall retain jurisdiction of this matter for the purposes of 11 construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "05.11_playdom", "company_name": "Playdom, Inc.", "date_issued": "2011-05-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1023036-playdom-inc", "docket_number": "Case No. CV11-0724 (Central District of California)" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained from violating the Children's Online Privacy Protection Rule (COPPA), including requirements for parental notice, posting privacy notices, and obtaining verifiable parental consent before collecting personal information from children.", "verbatim_text": "A. failing to make reasonable efforts, taking into account available technology, to ensure that 25 a parent of a child receives direct notice of Defendant’s practices with regard to the collection, 26 use, or disclosure of personal information from children, including notice of any material change 27 in the collection, use, or disclosure practices to which the parent has previously consented; 28\n\n1 B. failing to post a prominent and clearly labeled link to an online notice of its information 2 practices with regard to children, if any, on the home or landing page or screen of its Web site or 3 online service, and at each area of the Web site or online service where personal information is 4 collected from children; and\n\n5 C. failing to obtain verifiable parental consent before any collection, use, or disclosure of 6 personal information from children, including consent to any material change in the collection, 7 use, or disclosure practices to which the parent has previously consented.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "II", "title": "Injunction Concerning Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant is permanently restrained from using or disclosing personal information collected from children prior to the order and must destroy such information within 10 days, except as required by law.", "verbatim_text": "15 A. disclosing, using, or benefitting from personal information collected from children which 16 Defendant obtained prior to entry of this Order; and\n\n17 B. failing to destroy personal information collected from children that is in their possession, 18 custody, or control within ten (10) days after entry of this Order. Provided, however, that such 19 personal information need not be disposed of, and may be disclosed, to the extent requested by a 20 government agency or required by law, regulation, or court order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $4 million is entered against Defendant, with $950,000 to be paid in installments and the remainder suspended subject to truthfulness of financial representations.", "verbatim_text": "25 B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the United 26 States, three hundred thousand dollars ($300,000), within seven (7) days of entry of this Order, 27 followed by payment of six hundred fifty thousand dollars ($650,000) in two (2) equal 28 installments of three hundred twenty five thousand dollars ($325,000), plus interest computed STIPULATED ORDER 8 Case No. 3:16-cv-3474\n\n27 followed by payment of six hundred fifty thousand dollars ($650,000) in two (2) equal 28 installments of three hundred twenty five thousand dollars ($325,000), plus interest computed STIPULATED ORDER 8 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 9 of 20 1 from the date of entry of this Order, due within six (6) months and twelve (12) months,\n\n27 followed by payment of six hundred fifty thousand dollars ($650,000) in two (2) equal 28 installments of three hundred twenty five thousand dollars ($325,000), plus interest computed STIPULATED ORDER 8 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 9 of 20 1 from the date of entry of this Order, due within six (6) months and twelve (12) months,", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "IV", "title": "Additional Monetary Provisions", "category": "acknowledgment", "summary": "Defendant relinquishes rights to assets transferred, facts in Complaint will be taken as true in subsequent litigation, and Defendant acknowledges Taxpayer Identification Number may be used for collection.", "verbatim_text": "21 A. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all 22 assets transferred pursuant to this Order and may not seek the return of any assets.\n\n26 C. Defendant acknowledges that its Taxpayer Identification Number, which Defendant must 27 submit to the Commission, may be used for collecting and reporting on any delinquent amount 28 arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "V", "title": "Injunction Regarding Misrepresenting Practices Relating to Information Privacy", "category": "prohibition", "summary": "Defendant is permanently restrained from misrepresenting the extent to which they maintain and protect privacy, confidentiality, security, or integrity of covered information.", "verbatim_text": "9 A. Defendant’s practices with respect to personal information collected from children, 10 including Defendant’s collection, use, disclosure, and deletion practices;\n\n11 B. the extent to which Defendant collects or infers consumers’ location information; or\n\n12 C. the extent to which Defendant obtains consumers’ consent for the collection of covered 13 information, including opt-in consent.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "VI", "title": "Injunction Regarding Consent for Collection or Inference of Location Information", "category": "prohibition", "summary": "Defendant is permanently restrained from collecting or inferring location information without confirming consumer has provided affirmative express consent and has not revoked consent through device settings.", "verbatim_text": "21 A. the consumer has provided affirmative express consent for the collection of location 22 information to the application, Web site, or other online service that has integrated Defendant’s 23 software development kit;\n\n24 B. the consumer has not expressed, through any operating system, device, browser, or 25 application permission or setting, that the consumer does not consent to, or revokes consent to, 26 the collection of location information; and\n\n27 C. the consumer has not expressed, through any operating system, device, browser, or 28 application permission or setting, that the consumer’s consent to the collection of location STIPULATED ORDER 10 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 11 of 20 1 information is limited to a level of accuracy that is less precise than the location information that 2 is to be collected or inferred by Defendant.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy", "Surveillance" ], "remedy_types": [ "Prohibition" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "VII", "title": "Injunction Regarding Deletion of Location Information", "category": "affirmative_obligation", "summary": "Defendant is permanently restrained from using or disclosing location information collected without meeting Part VI requirements and must destroy such information within 10 days, except as required by law.", "verbatim_text": "7 A. disclosing, using, or benefitting from location information that was collected or inferred 8 prior to entry of this Order without meeting the requirements of Part VI of this Order; and\n\n9 B. failing to destroy location information that was collected or inferred prior to entry of this 10 Order without meeting the requirements of Part VI of this Order that is in their possession, 11 custody, or control within ten (10) days after entry of this Order. Provided, however, that such 12 location information need not be disposed of, and may be disclosed, to the extent requested by a 13 government agency or required by law, regulation, or court order. 14 VIII. COMPREHENSIVE PRIVACY PROGRAM REQUIREMENT", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "VIII", "title": "Comprehensive Privacy Program Requirement", "category": "affirmative_obligation", "summary": "Defendant must establish, implement, and maintain a comprehensive written privacy program no later than the date of service of this Order, designed to address privacy risks and protect covered information.", "verbatim_text": "17 service, in or affecting commerce, shall, no later than the date of service of this Order, establish 18 and implement, and thereafter maintain, a comprehensive privacy program that is reasonably 19 designed to: (1) address privacy risks related to the development and management of new and 20 existing products and services and (2) protect the privacy and confidentiality of covered 21 information. Such program, the content and implementation of which must be fully documented 22 in writing, shall contain privacy controls and procedures appropriate to Defendant’s size and 23 complexity, the nature and scope of Defendant’s activities, and the sensitivity of the covered 24 information, including: 25 A. the designation of an employee or employees to coordinate and be responsible for the\n\n25 A. the designation of an employee or employees to coordinate and be responsible for the 26 privacy program; 27 B. the identification of reasonably foreseeable, material risks, both internal and external, that\n\n27 B. the identification of reasonably foreseeable, material risks, both internal and external, that 28 could result in the Defendant’s unauthorized collection, use, or disclosure of covered information, STIPULATED ORDER 11 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 12 of 20 1 and assessment of the sufficiency of any safeguards in place to control these risks. At a 2 minimum, this privacy risk assessment should include consideration of risks in each area of 3 relevant operation, including, but not limited to: (1) employee training and management, 4 including training on the requirements of this Order; and (2) product design, development, and 5 research;\n\n6 C. the design and implementation of reasonable privacy controls and procedures to address 7 the risks identified through the privacy risk assessment, and regular testing or monitoring of the 8 effectiveness of those privacy controls and procedures;\n\n9 D. the development and use of reasonable steps to select and retain service providers capable 10 of appropriately protecting the privacy of covered information they receive from Defendant, and 11 requiring service providers by contract to implement and maintain appropriate privacy 12 protections; and\n\n13 E. the evaluation and adjustment of Defendant’s privacy program in light of the results of the 14 testing and monitoring required by Subpart C, any material changes to Defendant’s operations or 15 business arrangements, or any other circumstances that Defendant knows or has reason to know 16 may have a material impact on the effectiveness of its privacy program.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "IX", "title": "Privacy Program Assessment Requirement", "category": "assessment", "summary": "Defendant must obtain initial and biennial third-party assessments of its privacy program for 20 years, with initial assessment covering first year and biennial assessments covering each two-year period thereafter.", "verbatim_text": "19 Order, Defendant shall obtain initial and biennial assessments and reports (“Assessments”) from a 20 qualified, objective, independent third-party professional, who uses procedures and standards 21 generally accepted in the profession. The reporting period for the Assessments shall cover: (1) 22 the first year after service of the Order for the initial Assessment; and (2) each two (2) year period 23 thereafter for twenty (20) years after service of the order for biennial Assessments.\n\n19 Order, Defendant shall obtain initial and biennial assessments and reports (“Assessments”) from a 20 qualified, objective, independent third-party professional, who uses procedures and standards 21 generally accepted in the profession. The reporting period for the Assessments shall cover: (1) 22 the first year after service of the Order for the initial Assessment; and (2) each two (2) year period 23 thereafter for twenty (20) years after service of the order for biennial Assessments.\n\n13 C. Defendant shall provide the initial Assessment by overnight courier (not the U.S. Postal 14 Service) to the Associate Director for Enforcement, Bureau of Consumer Protection, Federal 15 Trade Commission, 600 Pennsylvania Ave. NW, Washington D.C. 20580, or by email to 16 Debrief@ftc.gov, within ten (10) days after the Assessment has been prepared. All subsequent 17 biennial Assessments shall be retained by Defendant until the Order is terminated and provided to 18 the Associate Director for Enforcement within ten (10) days of request. The subject line must 19 begin: United States v. InMobi Pte Ltd.\n\n17 biennial Assessments shall be retained by Defendant until the Order is terminated and provided to 18 the Associate Director for Enforcement within ten (10) days of request. The subject line must 19 begin: United States v. InMobi Pte Ltd.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "X", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit acknowledgment of receipt of Order and deliver copies to specified personnel for 20 years, obtaining signed acknowledgments from recipients.", "verbatim_text": "23 A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission 24 an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n25 B. For twenty (20) years after entry of this Order, Defendant must deliver a copy of this 26 Order to: (1) all principals, officers, and directors, and managers of Defendant and of its 27 subsidiaries and divisions in the United States; (2) all employees, agents, and representatives 28 having responsibilities relating to the collection, retention, storage, or security of covered STIPULATED ORDER 13 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 14 of 20 1 information and all employees, agents, and representatives having responsibilities related to the 2 operation of any website or online service subject to this Order; and (3) any business entity 3 resulting from any change in structure as set forth in the Part titled Compliance Reporting. 4 Delivery must occur within seven (7) days of entry of this Order for current personnel. For all 5 others, delivery must occur before they assume their responsibilities.\n\n6 C. From each individual or entity to which Defendant delivers a copy of this Order, 7 Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of 8 this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "XI", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit detailed compliance reports to the Commission at 180 days after entry and provide notices of changes for 20 years.", "verbatim_text": "12 A. One hundred eighty (180) days after entry of this Order, Defendant must submit a 13 compliance report, sworn under penalty of perjury. In such report, Defendant must: 14 1. identify the primary physical, postal, and email address and telephone number, as 15 designated points of contact, which representatives of the Commission and 16 Plaintiff may use to communicate with Defendant; 17 2. identify all of Defendant’s businesses by all of their names, telephone numbers, 18 and physical, postal, email, and Internet addresses; 19 3. describe the activities of each such business, including the goods and services 20 offered, the means of advertising, marketing, and sales; 21 4. describe in detail whether and how Defendant is in compliance with each Part of 22 this Order; 23 5. provide a copy of each different version of any privacy notice posted on each Web 24 site or online service operated by Defendant or otherwise communicated to parents of children 25 from whom Defendant collects personal information; 26 6. provide a statement setting forth in detail any methods used to obtain verifiable 27 parental consent prior to any collection, use, and/or disclosure of personal information from 28 children or the methods used to avoid collecting, using, and/or disclosing personal information STIPULATED ORDER 14 Case No. 3:16-cv-3474 Case 3:16-cv-03474 Document 2-1 Filed 06/22/16 Page 15 of 20 1 from children; 2 7. provide a statement setting forth in detail the means provided for parents to review 3 any personal information collected from their children and to refuse to permit its further use or 4 maintenance; 5 8. provide a statement setting forth in detail why each type of information collected 6 from a child is reasonably necessary for the provision of the particular related activity; 7 9. provide a statement setting forth in detail the procedures used to protect the 8 confidentiality, security, and integrity of personal information collected from children; and 9 10. provide a copy of each Order Acknowledgment obtained pursuant to this Order, 10 unless previously submitted to the Commission.\n\n11 B. For twenty (20) years after entry of this Order, Defendant must submit a compliance 12 notice, sworn under penalty of perjury, within fourteen (14) days of any change in: (a) any 13 designated point of contact; or (b) the structure of Defendant or any entity that Defendant has any 14 ownership interest in or control directly or indirectly that may affect compliance obligations 15 arising under this Order, including: creation, merger, sale, or dissolution of the entity or any 16 subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order. 17 C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 18 insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days 19 of its filing. 20 D. Any submission to the Commission required by this Order to be sworn under penalty of\n\n21 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I 22 declare under penalty of perjury under the laws of the United States of America that the foregoing 23 is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "XII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain records for 20 years demonstrating compliance, including all submissions to Commission, consumer complaints, and versions of software development kits.", "verbatim_text": "4 years after entry of the Order, and retain each such record for five (5) years. Specifically, 5 Defendant must create and retain the following records: 6 A. all records necessary to demonstrate full compliance with each provision of this Order, 7 including all submissions to the Commission; 8 B. copies of all consumer complaints relating to Defendant’s collection of covered 9 information or personal information, and any response; and 10 C. a copy of each materially different version of any software development kit Defendant 11 makes available to developers, and any associated documentation or instructions. 12 XIII. COMPLIANCE MONITORING", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "XIII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "Commission and Plaintiff are authorized to monitor compliance through requests for additional reports, depositions, document production, interviews, and other lawful means including posing as consumers.", "verbatim_text": "15 A. Within fourteen (14) days of receipt of a written request from a representative of the 16 Commission or Plaintiff, Defendant must: submit additional compliance reports or other 17 requested information, which must be sworn under penalty of perjury; appear for depositions; and 18 produce documents for inspection and copying. The Commission and Plaintiff are also 19 authorized to obtain discovery, without further leave of court, using any of the procedures 20 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 21 34, 36, 45, and 69.\n\n22 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 23 communicate directly with Defendant. Defendant must permit representatives of the Commission 24 and Plaintiff to interview any employee or other person affiliated with Defendant who has agreed 25 to such an interview. The person interviewed may have counsel present. 26 C. The Commission and Plaintiff may use all other lawful means, including posing, through", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "XIV", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "4 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 5 purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.16_inmobi_pte", "company_name": "InMobi Pte Ltd.", "date_issued": "2016-06-15", "year": 2016, "administration": "Obama", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/152-3203-inmobi-pte-ltd", "docket_number": "3:16-cv-3474" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently restrained from failing to provide parental notice, failing to post a prominent privacy notice link, failing to obtain verifiable parental consent, and from violating the COPPA Rule.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available technology, to ensure 20 that a Parent of a Childreceives direct notice of Defendants’ practices with regard to the 21 Collection, use, or Disclosure of Personal Informationfrom Children, including notice of any 22 Page 7 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 8 of 22 1 material change in the Collection, use, or Disclosure practices to which the Parent has previously 2 consented;\n\nB. Failing to post a prominent and clearly labeled link to an online notice of its information 3 practices with regard to Children on the home or landing page or screen of its website or online 4 service, and at each area of the website or online service where Personal Informationis Collected 5 from Children; and\n\nC. Failing to Obtain Verifiable Parental Consent before any Collection, use, or Disclosure of 7 Personal Informationfrom Children, including consent to any material change in the Collection, 8 use, or Disclosure practices to which the Parent has previously consented; and\n\nD. Violating the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as 10 Appendix A).", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "II", "title": "Injunction Concerning Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendants must refrain from using pre-Order children's Personal Information and must destroy all such data within 10 days of entry of the Order.", "verbatim_text": "A. Refrain from Disclosing, using, or benefitting from Personal Information Collected from 16 Children that Defendants obtained prior to entry of this Order; and\n\nB. Destroy such Personal Information in all forms in their possession, custody, or control within 18 ten (10) days after entry of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A $4,000,000 civil penalty judgment is entered against Corporate Defendant and Individual Defendant Kozachenko jointly and severally; Corporate Defendant must pay $150,000 within 7 days, with the remainder suspended subject to conditions.", "verbatim_text": "3 A. Judgment in the amount of four million dollars ($4,000,000) is entered in favor of Plaintiffagainst Corporate Defendant and Individual Defendant Kozachenko, jointly and 4 severally,as a civil penalty.\n\nB. Corporate Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer 6 of the United States, one hundred and fifty thousand dollars ($150,000), which, as Corporate 7 Defendant stipulates, its undersigned counsel holds in escrow for no purpose other than payment 8 to Plaintiff. Such payment must be made within seven (7) days of entry of this Order by 9 electronic fund transfer in accordance with instructions previously provided by a representative 10 of Plaintiff. Upon such payment, the remainder of the judgment is suspended, subject to the 11 Subsections below.\n\nC. The Plaintiff’s agreement to the suspension of part of the judgment is expressly premised 13 upon the truthfulness, accuracy, and completeness of Defendants’ sworn financial statements and 14 related documents (collectively, “financial representations”) submitted to the Commission, 15 namely: 1. the Financial Statement of Individual Defendant Alexander Kozachenko signed on 16 November 16, 2019, including the attachments; and 17 2. the Financial Statement of Corporate Defendant HyperBeard, Inc. signed byChief 18 Executive Officer Alexander Kozachenko, on November 16, 2019, including the attachments.\n\nD. The suspension of the judgment will be lifted as to CorporateDefendant and Defendant 20 Kozachenko if, upon motion by the Plaintiff, the Court finds that Corporate Defendant or 21 Defendant Kozachenko failed to disclose any material asset, materially misstated the value of 22 Page 9 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 10 of 22 1 any asset, or made any other material misstatement or omission in the financial representations 2 identified above.\n\nE. If the suspension of the judgment is lifted, the judgment becomes immediately due as to 3 Corporate Defendant and Defendant Kozachenko in the amount specified in Subsection A above 4 (which the parties stipulate only for purposes of this Section represents the amount of civil 5 penalty for the violations alleged in the Complaint), less any payment previously made pursuant 6 to this Section, plus interest computed from the date of entry of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "IV", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to assets transferred under this Order; Complaint facts may be used as true in future litigation; Defendants must provide Taxpayer Identification Numbers to the Commission.", "verbatim_text": "A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all 10 assets transferred pursuant to this Order and may not seek the return of any assets.\n\nB. The facts alleged in the Complaint will be taken as true, without further proof, in any 12 subsequent civil litigation by or on behalf of the Commission, including in a proceeding to 13 enforce its rights to any payment or monetary judgment pursuant to this Order.\n\n14 C. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants must submit to the Commission, may be used for collecting and reporting on any delinquent 15 amount arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "V", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt of the Order within 7 days, deliver copies to relevant personnel within 7 days and to future personnel before they assume responsibilities, and collect signed acknowledgments within 30 days.", "verbatim_text": "A. Each Defendant, within 7 days of entry of this Order, must submit to the Commission an 20 acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n1 B. For five (5) years after entry of this Order, the Individual Defendant for any business that 2 such Defendant, individually or collectively with any other Defendants, is the majority owner or controls directly or indirectly, and the Corporate Defendant, must deliver a copy of this Orderto: 3 (1) all principals, officers, directors, managers and members; (2) all employees having 4 managerial responsibilities relating to the Collection, retention, storage, or security of Personal 5 Information, and all agents and representatives who participate in the operation of any of 6 Defendants’ websites or online services; and (3) any business entity resulting from any change in 7 structure as set forth in the Section titled Compliance Reporting. Delivery must occur within 8 seven (7) days of entry of this Order for current personnel. To all others, delivery must occur 9 before they assume their responsibilities.\n\nC. From each individual or entity to which Defendants delivered a copy of this Order, 11 Defendants must obtain, within 30 days, a signed and dated acknowledgment of receipt of this 12 Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "VI", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn compliance report one year after entry of the Order, submit compliance notices within 14 days of specified changes for 10 years, notify the Commission of any bankruptcy filing within 14 days, and follow prescribed submission procedures.", "verbatim_text": "A. One year after entry of this Order, each Defendant must submit a compliance report, 16 sworn under penalty of perjury: 17 1. Each Defendant must: (a) identify the primary physical, postal, and email address 18 and telephone number, as designated points of contact, which representatives of the Commission 19 and Plaintiff may use tocommunicate with Defendants; (b) identify all ofthat Defendant’s 20 businesses by all of their names, telephone numbers, and physical, postal, email, and Internet 21 addresses; (c) describe the activities of each business, including the goods and services offered, 22 Page 11 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 12 of 22 1 the means of advertising, marketing, and sales, and the involvement of any other Defendant 2 (which Individual Defendant must describe if he knows or should know due to his own involvement); (d) describe in detail whether and how that Defendant is in compliance with each 3 Section of this Order; (e) provide a copy of each different version of any privacy notice posted 4 on each website or online service operated by Defendants or sent to Parents of Children that 5 register on each website or online service; (f) provide a statement setting forth in detail the 6 methods used to Obtain Verifiable Parental Consent prior to any Collection, use, and/or 7 Disclosure of Personal Informationfrom Children; (g) provide a statement setting forth in detail 8 the means provided for Parents to review the Personal InformationCollected from their Children 9 and to refuse to permit its further use or maintenance; and (h) provide a copy of each Order 10 Acknowledgment obtained pursuant to this Order, unless previously submitted to the 11 Commission.\n\n12 2. Additionally, the Individual Defendant must: (a) identify all telephone numbers 13 and all physical, postal, email, and Internet addresses, including all residences; (b) identify all 14 business activities, including any business for which such Defendant performs services whether as an employee or otherwise and any entity in which such Defendant has any ownership interest; 15 and (c) describe in detail such Defendant’s involvement in each such business, including title, 16 role, responsibilities, participation, authority, control, and any ownership.\n\nB. For ten (10) years after entry of this Order, each Defendant must submit a compliance 18 notice, sworn under penalty of perjury, within fourteen (14) days of any change inthe following: 19 1. Each Defendant must report any change in: (a) any designated point of contact; 20 or (b) the structure of Corporate Defendant or anyentity that Defendants have any ownership 21 interest in or control directly or indirectly that may affect compliance obligations arising under 22 Page 12 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 13 of 22 1 this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, 2 Parent, or affiliate that engages in any acts or practices subject to this Order.\n\n2. Additionally, Individual Defendant must report any change in: (a) name, 3 including aliases or fictitious name, or residence address; or (b) title or role in any business 4 activity, including any business for which such Defendant performs services whether as an 5 employee or otherwise and any entity in which such Defendant has any ownership interest, and 6 identify the name, physical address, and any Internet address of the business or entity.\n\nC. Each Defendant must submit to the Commission notice of the filing of any bankruptcy 8 petition, insolvency proceeding, or similar proceeding by or against each Defendant within 14 9 days of its filing.\n\nD. Any submission to the Commission required by this Order to be sworn under penalty of 11 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I 12 declare under penalty of perjury under the laws of the United States of America that the 13 foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full 14 name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all submissions to 15 the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 16 courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 17 Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 18 DC 20580. The subject line must begin: United States v. HyperBeard, Inc.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "VII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create specified records for 10 years after entry of the Order and retain each such record for 5 years, covering accounting records, compliance records, consumer complaints, and copies of data collection forms and privacy representations.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants must create certain records forten (10) 21 years after entry of the Order, and retain each such record for five (5) years. Specifically, 22 Page 13 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 14 of 22 1 Corporate Defendant and Individual Defendant for any business that such Defendant, 2 individually or collectively with any other Defendants, is a majority owner or controls directly or indirectly, must create and retain the following records: 3 A. Accounting records showing the revenues from all goods or services sold;\n\nB. All records necessary to demonstrate full compliance with each provision of this Order, 5 including all submissions to the Commission;\n\nC. Copies of all consumer complaints relating to Defendants’ Collection of Personal 7 Information whether received directly or indirectly, such as through a Third Party, and any 8 response; and\n\nD. A copy of each materially different form, page, or screen created, maintained, or 10 otherwise provided by Defendants through which Defendants Collect Personal Information other 11 than solely a Persistent Identifier, and a copy of each materially different document containing 12 any representation regarding Defendants’ Collection, use, and Disclosure practices pertaining to 13 Personal Information.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "VIII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance by requesting reports, conducting depositions, obtaining discovery, communicating directly with Defendants and their personnel, and using other lawful investigative means.", "verbatim_text": "A. Within 14 days of receipt of a written request from a representative of the Commission or 17 Plaintiff,each Defendant must: submit additional compliance reports or other requested 18 information, which must be sworn under penalty of perjury; appear for depositions; and produce 19 documents for inspection and copying. The Commission and Plaintiff are also authorized to 20 obtain discovery, without further leave of court, using any of the procedures prescribed by 21 22 Page 14 of 19 STIPULATED ORDER Case 3:20-cv-03683-JSC Document 3 Filed 06/03/20 Page 15 of 22 1 Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, 2 and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to 3 communicate directly with each Defendant. Defendants must permit representatives of the 4 Commission and Plaintiff to interview any employee or other Personaffiliated with any 5 Defendant who has agreed to such an interview. The Personinterviewed may have counsel 6 present.\n\nC. The Commission and Plaintiff may use all other lawful means, including posing, through 8 its representatives, as consumers, suppliers, or other individuals or entities, to Defendants or any 9 individual or entity affiliated with Defendants, without the necessity of identification or prior 10 notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 11 pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "IX", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "13 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 14 purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.20_hyperbeard", "company_name": "HyperBeard, Inc.", "date_issued": "2020-06-15", "year": 2020, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57(b); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d); 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3109-hyperbeard-inc", "docket_number": "3:20-cv-03683" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant and those acting in concert with it are permanently enjoined from failing to provide required direct and online notices to parents, failing to obtain verifiable parental consent before collecting children's personal information, retaining children's personal information longer than necessary, and violating the COPPA Rule.", "verbatim_text": "16 A. Failing to make reasonable efforts, taking into account available technology, to ensure 17 that a Parent of a Child receives direct notice as required by Section 312.4(b)-(c) of the 18 Rule, 16 C.F.R. § 312.4(b)-(c), unless the Children’s Online Privacy Protection Rule, 19 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to providing such 20 notice;\n\n21 B. Failing to post a prominent and clearly labeled link to an online notice of Defendant’s 22 information practices with regard to Children on the home or landing page or screen of 23 Defendant’s website or online service, and at each area of Defendant’s website or online 24 service where Personal Information is Collected from Children, unless the Children’s STIPULATED ORDER - 9 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:23-cv-00836-RAJ Document 19 Filed 06/09/23 Page 10 of 22 1 Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A), provides 2 an exception to providing such notice;\n\n3 C. Failing to Obtain Verifiable Parental Consent before any Collection, use, or Disclosure of 4 Personal Information from Children, including consent to any material change in the 5 Collection, use, or Disclosure practices to which the Parent has previously consented, 6 unless the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as 7 Appendix A), provides an exception to Obtaining Verifiable Parental Consent;\n\n8 D. Retaining Personal Information Collected from a Child for longer than is reasonably 9 necessary to fulfill the purpose for which the information was Collected; and\n\n10 E. Violating the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as 11 Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "II", "title": "Required Notice to Adults", "category": "affirmative_obligation", "summary": "Defendant must send the Xbox Platform Notice and the 'Microsoft's Xbox Parental Controls and Family Settings' email notice to every Adult Microsoft Account not associated with a Child Microsoft Account, within 45 days of entry of the Order (180 days for non-U.S. accounts).", "verbatim_text": "13 IT IS FURTHER ORDERED that, within forty-five (45) days of entry of this Order, 14 Defendant must send through the Xbox Live Service the Xbox Platform Notice and email the 15 notice entitled “Microsoft’s Xbox Parental Controls and Family Settings” (both of which 16 appear at Appendix B) to every Adult Microsoft Account that was not associated with a Child 17 Microsoft Account before entry of this Order. Provided, however, that such notices being sent to 18 non-United States-based accounts must be sent within one hundred and eighty days (180) days of 19 entry of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "III", "title": "Injunction Concerning Personal Information Previously Collected from Children", "category": "affirmative_obligation", "summary": "Defendant must seek verifiable parental consent for existing Child Microsoft Accounts, suspend collection and use of their data if consent is not obtained, delete unconsented data within one year of the Account Suspension Date, and submit a sworn written report on outcomes.", "verbatim_text": "1 A. Within sixty (60) days of entry of this Order, seek to Obtain Verifiable Parental Consent 2 to Collect, use, Disclose, and retain Personal Information Collected from such Child 3 Microsoft Account;\n\n4 B. Within one hundred and eighty (180) days of entry of this Order (the “Account 5 Suspension Date”), if Defendant has not Obtained Verifiable Parental Consent, refrain 6 from Collecting Personal Information from Child Microsoft Accounts via the Xbox Live 7 Service, and refrain from Disclosing or using Personal Information Defendant Collected 8 from Children through Child Microsoft Accounts via the Xbox Live Service, except for 9 the use of persistent identifiers to Support the Internal Operations of the Xbox Live 10 Service, unless and until Defendant has Obtained Verifiable Parental Consent;\n\n11 C. Within one (1) year of the Account Suspension Date, Delete all Personal Information 12 Defendant Collected from Children through Child Microsoft Accounts for which 13 Defendant has not, by that date, Obtained Verifiable Parental Consent;\n\n14 D. Within one (1) year and one month of the Account Suspension Date, provide a written 15 statement to the Commission, sworn under penalty of perjury, that (1) describes the 16 process through which Defendant Obtained Verifiable Parental Consent from Parents to 17 Collect, use, and retain Personal Information Collected from each Child Microsoft 18 Account; (2) identifies the total number of Child Microsoft Accounts for which 19 Defendant sought to Obtain Verifiable Parental Consent, as well as the number of Child 20 Microsoft Accounts for which: 21 (i) Defendant Obtained Verifiable Parental Consent; 22 (ii) a Parent affirmatively declined to consent; 23 (iii) a Parent did not respond; 24 (iv) a Parent requested Deletion, and STIPULATED ORDER - 11 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:23-cv-00836-RAJ Document 19 Filed 06/09/23 Page 12 of 22 1 (v) a Parent engaged with Defendant by asking additional questions; and 2 (3) confirms all Personal Information related to Child Microsoft Accounts for which 3 Defendant failed to Obtain Verifiable Parental Consent has been Deleted.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "IV", "title": "Data Retention", "category": "affirmative_obligation", "summary": "Defendant must establish a system to delete within two weeks any Personal Information collected for purposes of obtaining parental consent (if consent is not given), and must maintain a publicly available retention schedule for Personal Information collected through Child Microsoft Accounts.", "verbatim_text": "8 A. Within thirty (30) days of entry of this Order, establish and implement, and thereafter 9 maintain, a system to Delete, within two (2) weeks from the date of Collection, all 10 Personal Information Defendant has Collected from Children for purposes of 11 Obtaining Verifiable Parental Consent, unless the Parent provides Verifiable Parental 12 Consent.\n\n13 B. As of the date of entry of this Order, maintain and adhere to a retention schedule for 14 Personal Information Collected through Child Microsoft Accounts, setting forth the 15 purpose for which the information was Collected, the specific business need for 16 retaining such Personal Information, and an established time frame and set of criteria 17 for Deletion of such information that may not be longer than is reasonably necessary 18 to fulfill the purpose for which the information was Collected, and make such 19 information about the retention schedule publicly available on Defendant’s website(s) 20 and in the direct notice.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "V", "title": "Requirement to Notify Third Parties When Disclosing Personal Information Collected from a Child", "category": "affirmative_obligation", "summary": "Within 120 days of entry of the Order, Defendant must indicate to video game publishers (e.g., via API) whenever it discloses Personal Information from a Child Microsoft Account that the user is under age 13.", "verbatim_text": "23 IT IS FURTHER ORDERED that Defendant, within one hundred and twenty (120) days 24 of entry of this Order, in connection with operating a Covered Service, must, at each instance STIPULATED ORDER - 12 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:23-cv-00836-RAJ Document 19 Filed 06/09/23 Page 13 of 22 1 when Disclosing Personal Information from a Child Microsoft Account to any video game 2 publisher on such service, indicate to such party (such as through an API) that the user is a child 3 under age 13.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "VI", "title": "Mandated Data Documentation", "category": "affirmative_obligation", "summary": "Within 90 days of entry of the Order, Defendant must internally document the decision to collect, use, disclose, or maintain each Personal Information data field from Child Microsoft Accounts, including purpose, segmentation controls, retention limits, deletion means, safeguards against unauthorized sharing, and access controls.", "verbatim_text": "5 IT IS FURTHER ORDERED that Defendant, in connection with the Collection, 6 maintenance, use, or Disclosure of, or provision of access to, Personal Information Collected 7 through a Covered Service, must, within ninety (90) days of issuance of this Order, document 8 internally the decision to Collect, use, Disclose, provide access to, or maintain each data field of 9 Personal Information that is Collected through Child Microsoft Accounts. Such documentation 10 must include: for what purpose the data field of Personal Information is being Collected; the data 11 segmentation controls in place to ensure that the data field of Personal Information Collected is 12 only used for the particular purpose for which it was Collected; the data retention limit set and 13 the technical means for achieving Deletion of the data field of Personal Information; the 14 safeguards in place to prevent unauthorized sharing or sale of the data field of Personal 15 Information; and the controls in place to ensure only authorized employees with a legitimate 16 business purpose(s) have access to the data field of Personal Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "VII", "title": "Registration Requirement", "category": "affirmative_obligation", "summary": "Defendant must obtain the age of users during account registration for a Covered Service and must provide Clear and Conspicuous notice about creating child accounts and parental controls during the registration process.", "verbatim_text": "19 A. During the account set-up or registration process for a Covered Service, Defendant must 20 obtain the age of the user.\n\n21 B. As of the date of entry of this Order, Defendant is required to provide users the following 22 information during the account set-up or registration process for a Covered Service: 23 Please create a child account for any child that plays on this device. Microsoft offers parental controls for this device and a family safety 24 settings app to provide controls to parents, so you can place limitations STIPULATED ORDER - 13 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:23-cv-00836-RAJ Document 19 Filed 06/09/23 Page 14 of 22 1 for reasons of privacy and safety. For example, you can limit who can communicate with the child. If this device will be used by a child, you 2 can make the child account and set controls on the next screen. Defendant must provide Clear and Conspicuous notice of the steps to set up a Child 3 Microsoft Account during the registration process. Provided, however, that such 4 information be provided to non-United States-based accounts within one hundred and 5 eighty (180) days of the date of entry of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "VIII", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $20,000,000 is entered against Defendant, payable to the U.S. Treasury within 7 days of entry of the Order, with Defendant relinquishing all rights to the transferred assets.", "verbatim_text": "9 A. Judgment in the amount of twenty million dollars ($20,000,000) is entered in favor of 10 Plaintiff against Defendant, as a civil penalty.\n\n11 B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the 12 United States, twenty million dollars ($20,000,000), which, as Defendant stipulates, its 13 undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. 14 Such payment must be made within seven (7) days of entry of this Order by electronic 15 fund transfer in accordance with instructions provided by a representative of Plaintiff.\n\n16 C. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all 17 assets transferred pursuant to this Order and may not seek the return of any assets.\n\n18 D. The facts alleged in the Complaint will be taken as true, without further proof, in any 19 subsequent civil litigation by or on behalf of the Commission, including in a proceeding 20 to enforce its rights to any payment or monetary judgment pursuant to this Order.\n\n21 E. Defendant acknowledges that its Taxpayer Identification Number, which Defendant must 22 submit to the Commission, may be used for collecting and reporting on any delinquent 23 amount arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "IX", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit a sworn acknowledgment of receipt of the Order within 7 days, deliver copies to all principals, officers, managers, and relevant employees within 7 days (and to new personnel before they assume responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "4 A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission 5 an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n6 B. For five (5) years after entry of this Order, Defendant for any business that Defendant 7 controls, directly or indirectly, or for which Defendant is the majority owner, must 8 deliver a copy of this Order to: (1) all principals, officers, directors, managers, and 9 members; (2) all employees having managerial responsibilities relating to the subject 10 matter of the Order, and all agents and representatives who participate in conduct related 11 to the subject matter of the Order; and (3) any business entity resulting from any change 12 in structure as set forth in the Section titled Compliance Reporting. Delivery must occur 13 within seven (7) days of entry of this Order for current personnel. To all others, delivery 14 must occur before they assume their responsibilities.\n\n15 C. From each individual or entity to which Defendant delivered a copy of this Order, 16 Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of 17 receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "X", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit a sworn annual compliance report one year after entry of the Order, submit sworn notices within 14 days of structural or contact changes for 10 years, notify the Commission within 14 days of any bankruptcy filing, and follow specified submission procedures.", "verbatim_text": "A. One year after entry of this Order, Defendant must submit a compliance report, sworn 22 under penalty of perjury, in which Defendant must: (a) identify the primary physical, 23 postal, and email address and telephone number, as designated points of contact, which 24 STIPULATED ORDER - 15 UNITED STATES ATTORNEY 700 STEWART STREET, SUITE 5220 SEATTLE, WASHINGTON 98101 (206) 553-7970 Case 2:23-cv-00836-RAJ Document 19 Filed 06/09/23 Page 16 of 22 1 representatives of the Commission and Plaintiff may use to communicate with 2 Defendant; (b) identify all of Defendant’s businesses related to each Covered Service by 3 all of their names, telephone numbers, and physical, postal, email, and Internet addresses; 4 (c) describe the activities of each Covered Service, including the goods and services 5 offered, the means of advertising, marketing, and sales; (d) describe in detail whether and 6 how Defendant is in compliance with each Section of this Order; (e) provide a copy of 7 each different version of any privacy notice for each Covered Service or sent to Parents 8 of Children that register for each Covered Service; (f) provide a statement setting forth in 9 detail the methods used to Obtain Verifiable Parental Consent before any Collection, use, 10 and/or Disclosure of Personal Information from Children; (g) provide a statement setting 11 forth in detail the means provided for Parents to review the Personal Information 12 Collected from their Children and to refuse to permit its further use or maintenance for 13 each Covered Service; and (h) provide a copy of each Order acknowledgment obtained 14 pursuant to this Order, unless previously submitted to the Commission.\n\n15 B. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, 16 sworn under penalty of perjury, within fourteen (14) days of any change in: (a) any 17 designated point of contact; or (b) the structure of Defendant or any entity that Defendant 18 has any ownership interest in or controls, directly or indirectly, that may affect 19 compliance obligations arising under this Order, including: creation, merger, sale, or 20 dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or 21 practices subject to this Order.\n\n22 C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 23 insolvency proceeding, or similar proceeding by or against Defendant within fourteen 24 (14) days of its filing.\n\n1 D. Any submission to the Commission required by this Order to be sworn under penalty of 2 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 3 concluding: “I declare under penalty of perjury under the laws of the United States of 4 America that the foregoing is true and correct. Executed on: _____” and supplying the 5 date, signatory’s full name, title (if applicable), and signature.\n\n6 E. Unless otherwise directed by a Commission representative in writing, all submissions to 7 the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by 8 overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 9 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 10 NW, Washington, DC 20580. The subject line must begin: United States v. Microsoft 11 Corp.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "XI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create specified records for each Covered Service for 10 years after entry of the Order and retain each such record for 5 years, including accounting records, personnel records, consumer complaints, compliance records, and copies of collection forms and privacy representations.", "verbatim_text": "16 A. Accounting records showing the revenues from all goods or services sold;\n\n17 B. Personnel records showing, for each Person providing services, whether as an employee 18 or otherwise, that Person’s: name; addresses; telephone numbers; job title or position; 19 dates of service; and (if applicable) the reason for termination;\n\n20 C. Records of all consumer complaints relating to Defendant’s Collection of Personal 21 Information from Children through each Covered Service, whether received directly or 22 indirectly, such as through a Third Party, and any response;\n\n23 D. All records necessary to demonstrate full compliance with each section of this Order, 24 including all submissions to the Commission;\n\n1 E. A copy of each materially different form, page, or screen created, maintained, or 2 otherwise provided by Defendant through which Defendant Collects Personal 3 Information from Children through each Covered Service, and a copy of each materially 4 different document containing any representation regarding Defendant’s Collection, use, 5 and Disclosure practices pertaining to Personal Information from Children Collected 6 through each Covered Service. Each webpage copy shall be accompanied by the URL of 7 the webpage where the material was posted online. Electronic copies shall include all 8 text and graphics files, audio scripts, and other computer files used in presenting 9 information on the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "XII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through written requests for reports, depositions, document production, direct communications with Defendant and its personnel, and other lawful investigative means including undercover contacts.", "verbatim_text": "13 A. Within fourteen (14) days of receipt of a written request from a representative of the 14 Commission or Plaintiff, Defendant must: submit additional compliance reports or other 15 requested information, which must be sworn under penalty of perjury; appear for 16 depositions; and produce documents for inspection and copying. The Commission and 17 Plaintiff are also authorized to obtain discovery, without further leave of court, using any 18 of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including 19 telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\n20 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 21 communicate directly with Defendant. Defendant must permit representatives of the 22 Commission and Plaintiff to interview any employee or other Person affiliated with any 23 Defendant who has agreed to such an interview. The Person interviewed may have 24 counsel present.\n\n1 C. The Commission and Plaintiff may use all other lawful means, including posing, through 2 its representatives, as consumers, suppliers, or other individuals or entities, to Defendant 3 or any individual or entity affiliated with Defendant, without the necessity of 4 identification or prior notice. Nothing in this Order limits the Commission’s lawful use 5 of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 6 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "XIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "8 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 9 purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "06.23_microsoft_corporation", "company_name": "Microsoft Corporation", "date_issued": "2023-06-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), and 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923258-microsoft-corporation-us-v", "docket_number": "2:23-cv-00836-RAJ" }, { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently restrained and enjoined from violating the COPPA Rule, including failures to provide direct notice to parents, post required privacy links, obtain verifiable parental consent, delete children's personal information upon request, and retain data beyond what is necessary.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available technology, to ensure that a Parent of a Child receives direct notice of Defendants' practices with regard to the Collection, use, or Disclosure of Personal Information from Children, including notice of any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented;\n\nB. Failing to post a prominent and clearly labeled link to an on line notice of its information practices with regard to Children, if any, on the home or landing page or screen of its website or online service, and at each area of the website or online service where Personal Information is Collected from Children;\n\nC. Failing to Obtain Verifiable Consent before any Collection, use, or Disclosure of Personal Information from Children, including consent to any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented;\n\nD. Failing to Delete a Child's Personal Information at the request of a Parent; and\n\nE. Retaining Personal Information for longer than is reasonably necessary to fulfill the purpose for which the information was Collected.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "II", "title": "Injunction Concerning Notice to App Users", "category": "affirmative_obligation", "summary": "Within 30 days, Defendants must implement an in-app pop-up alert and publish a news feed post on the Recolor mobile application to notify users of the settlement, using the exact wording in Appendices B and C.", "verbatim_text": "IT IS FURTHER ORDERED that, within 30 days of entry of this Order, Defendants shall provide notice to users of the Recolor mobile application as follows: A. Defendants shall implement an in-app pop-up alert, in the exact wording set forth in Appendix B to this Order and in an easily legible format consistent with the format set forth in Appendix B. The alert shall (1) appear the first time that each user opens the Recolor mobile application after the notice is implemented and remain in the application until the user acknowledges the alert, pursuant to Subsection A(2) below, (2) require the user to acknowledge the alert by selecting a button, or equivalent user interaction (including clicking a link to the news feed post required by Subsection B below), before being able to continue to use the application, and (3) remain in the application for a period of 180 days from initial implementation or until the user acknowledges the alert pursuant to Subsection A(2) above.\n\nB. Defendants shall, in conjunction with implementing the alert required by Subsection A above, publish a news feed post, in the exact wording set forth in Appendix C to this Order and in an easily legible format consistent with the format set forth in Appendix C, on the Recolor mobile application's news feed. The post shall remain in the news feed for a period of 180 days from initial publication.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "III", "title": "Injunction Concerning Deletion of Personal Information", "category": "affirmative_obligation", "summary": "Within 60 days, Defendants must delete all Personal Information associated with Covered App Users and instruct any Third Parties who received such information to alsodelete it, subject to specified exceptions.", "verbatim_text": "A. Defendants shall, within 60 days of entry of this Order, Delete all Personal Information, in all forms, in their possession, custody, or control, that is associated with Covered App Users; provided, however, that: 1. Defendants may comply with Subsection A of this Section by (a) Deleting such information for Covered App Users that Defendants identify with search terms or an equivalent method, if such search terms or equivalent method are approved in writing by the Commission or a representative of the Commission, and (b) Deleting such information if Defendants have actual knowledge or knowledge fairly implied on the basis of objective circumstances that a user is a Covered App User; 2. Defendants may, with the affirmative consent of the Covered App User, transfer the content generated by that user to the user's device; 3. Personal Information need not be destroyed, and may be Collected, used, and Disclosed, to the extent Defendants Obtain Verifiable Consent for its Collection, use, and Disclosure; and 4. Personal Information need not be Deleted, and may be Disclosed, to the extent requested by a government agency or as required by a law, regulation, or court order.\n\nB. Within 60 days of entry of this Order, Defendants must instruct any Third Party that has received from Defendants Personal Information Collected from Covered App Users to Delete such information; provided, however, that Defendants may comply with this Subsection by instructing such Third Parties to Delete such information for all Covered App Users that Defendants identify pursuant to Subsection A. I above.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "IV", "title": "Refunds to Underage Subscribers", "category": "affirmative_obligation", "summary": "Defendants must provide refunds to qualifying Recolor subscribers who were under age 13 when signing up for a subscription and who request a refund within 9 months of the Order, and must process such refunds within 14 days of receiving notice.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants must provide a refund to all qualified Recolor mobile application subscribers as follows: A. Defendants must provide the refund if (I) the subscriber ( or their parent or guardian, if the subscriber is under the age of 18 at the time of the refund request) requests a refund within 9 months of entry of this Order; (2) the subscriber has a current subscription at the time of the refund request, and (3) the subscriber (or their parent or guardian, if the subscriber is under the age of 18 at the time of the refund request) requests the refund by notifying Defendants through Recolor customer service that (a) the subscriber was under the age of 13 when signing up for the subscription, and (b) the subscriber (or their parent or guardian, if the subscriber is under the age of 18 at the time of the refund request) elects to cancel the current subscription for a refund of the subscription fee. Defendants may require the subscriber (or their parent or guardian, if the subscriber is under the age of 18 at the time of the refund request) to click a checkbox verifying, under penalty of perjury, that the subscriber was under the age of 13 when signing up for the subscription. Defendants may not impose additional requirements for obtaining these refunds.\n\nB. Within 14 days of receiving such notice, Defendants must, depending on the preference or functionality of the mobile application store, (I) issue a refund to the subscriber via the subscriber's mobile application store, or (2) instruct the subscriber's mobile application store to issue a refund to the subscriber. If the mobile application store is unable to issue a refund, Defendants must fully cooperate with the app store and the subscriber ( or their parent or guardian) to ensure that the refund is issued (e.g., by informing the subscriber to update their method of payment with their mobile application store if necessary to process the refund).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "V", "title": "Monetary Judgment for Civil Penalty and Partial Suspension", "category": "affirmative_obligation", "summary": "Judgment of $3,000,000 is entered against Defendants jointly and severally; Defendants must pay $100,000 within 7 days; if Recolor Oy is sold within one year, all Net Proceeds must be remitted within 90 days of payment; the remainder of the judgment is suspended upon timely compliance, subject to conditions.", "verbatim_text": "A. Judgment in the amount of Three Million Dollars ($3,000,000) is entered in favor of Plaintiff against Defendants, jointly and severally, as a civil penalty.\n\n1. Pay One Hundred Thousand Dollars ($100,000) to the Treasurer of the United States within 7 days of entry of this Order by electronic fund transfer in accordance with instructions previously provided by a representative of Plaintiff.\n\n2. If, within one year of entry of this Order, Defendants sell Recolor Oy or substantially all of the assets of Recolor Oy, or otherwise substantially divest from Recolor Oy, they shall remit all Net Proceeds from the Sale or Divestiture to the Treasurer of the United States within 90 days of payment for the sale or divestiture.\n\n3. Within 120 days of a sale or divestiture under subparagraph 2, if any, Defendants shall provide Plaintiff a copy of the closing documents pertaining to such sale or divestiture, including an accounting of the financial aspects of the Entire Transaction with respect to calculation of the Net Proceeds from the Sale or Divestiture.\n\n4. Upon timely payment completion of all obligations contained in subparagraphs 1, 2, and 3, time being of the essence, the remainder of the judgment is suspended, subject to the Subsections below. C. Plaintiffs agreement to the suspension of part of the judgment is expressly premised upon complete and timely compliance with subparagraphs B.1, B.2, and B.3, time being of the essence, Page 14 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 15 of 36 as well as the truthfulness, accuracy, and completeness of Defendants' sworn financial statements and related documents ( collectively, \"financial representations\") submitted to the Commission, namely: 1. The Financial Statement of Defendant Recolor Oy, signed by Arsi Rosengren, CFO of Kuu Hubb Oy, on July 10, 2020, including attachments; and 2. The documentation and information submitted via email from Defendants' counsel, Chanley Howell, to FTC counsel Evan Rose, as follows: a. On July 22, 2020, at approximately 12:13 pm PDT and.12:15 pm PDT, including 10 files sent via file sharing; b. On July 29, 2020, at approximately 5:23 am PDT, including 1 attachment; c. On July 31, 2020, at approximately 11 :29 am PDT, including 3 attachments; d. On August 5, 2020, at approximately 10:31 am PDT, including 2 attachments; e. On August 17, 2020, at approximately 6:09 am PDT, including 2 attachments; f. On August 19, 2020, at approximately 10:40 am PDT; g. On September 1, 2020, at approximately 7:06 am PDT, including 2 attachments; h. On November 5, 2020, at approximately 12:05 pm PST, including 1 attachment; and i. On November 10, 2020, at approximately 8:55 am PST, including 1 attachment. Page 15 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 16 of 36 D. The suspension of the judgment will be lifted as to any Defendant if, upon motion by Plaintiff, the Court finds that: 1. Defendant failed to disclose any material asset, materially misstated the value of any asset, or made any other material misstatement or omission in the financial representations identified above; or 2. Defendant failed to completely and timely comply with subparagraphs B.1, B.2, and B. 3 above, time being of the essence. E. If the suspension of the judgment is lifted, the judgment becomes immediately due as to that Defendant in the amount specified in Subsection A above (which the parties stipulate only for purposes of this Section represents the amount of the civil penalty for the violations alleged in the Complaint), less any payment previously made pursuant to this Section, plus interest computed from the date of entry of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "VI", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to assets transferred under this Order and may not seek their return; facts alleged in the Complaint may be taken as true in any subsequent civil litigation by the Commission.", "verbatim_text": "A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all assets transferred pursuant to this Order and may not seek the return of any assets.\n\nB. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Commission, including in a proceeding to enforce its rights to any payment or monetary judgment pursuant to this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "VII", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt within 7 days, deliver copies of the Order to principals, officers, employees, and agents within specified timeframes for 5 years, and obtain signed acknowledgments of receipt within 30 days from each recipient.", "verbatim_text": "A. Each Defendant, within 7 days of entry of this Order, must submit to the Commission an acknowledgment ofreceipt of this Order sworn under penalty of perjury.\n\nB. For 5 years after entry of this Order, each Defendant must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees having managerial responsibilities for conduct related to the subject matter of the Order and all agents and representatives who participate in conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Section titled Compliance Reporting. Delivery must occur within 7 days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this Order, that Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "VIII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn compliance report within 90 days addressing Personal Information deletion, a comprehensive annual compliance report one year after entry, sworn notices within 14 days of any changes in contact or organizational structure for 10 years, and bankruptcy notices within 14 days of filing.", "verbatim_text": "A. Ninety days after entry of this Order, Defendants must submit a compliance report, sworn under penalty of perjury, describing in detail their compliance with the Section titled Injunction Concerning Deletion of Personal Information. The report shall include, for each Third Party that Defendants instructed to Delete Personal Information Collected from Children, a statement setting forth in detail such Third Party's response to Defendants, if any, including, but not limited to, Page 17 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 18 of 36 whether such Third Party Deleted the Personal Information Collected from Children and, if not, why such Third Party did not Delete the Personal Information Collected from Children, to the extent that such Third Party provided such information to Defendants.\n\nB. One year after entry of this Order, each Defendant must submit a compliance report, sworn under penalty of perjury. Each Defendant must: 1. Identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Defendant; 2. Identify all of that Defendant's businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; 3. Describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales, and the involvement of any other Defendant; 4. Describe in detail whether and how that Defendant is in compliance with each Section of this Order; 5. For the Section titled Refunds to Underage Subscribers, also identify the total number of refunds requested and the total number ofrefunds issued, and explain any refunds requested but not issued. State by calendar year the dollar amounts involved, including the total for all refunds issued pursuant to this Order; 6. Provide a copy of each different version of any privacy notice posted on each website or online service operated by that Defendant or otherwise communicated to Parents of Children from whom that Defendant Collects Personal Information; Page 18 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 19 of 36 7. Describe in detail any methods used to Obtain Verifiable Consent prior to any Collection, use, and/or Disclosure of Personal Information from Children or the methods used to avoid Collecting, using, and/or Disclosing Personal Information from Children; 8. Describe in detail any means provided for Parents to review any Personal Information Collected from their Children and to refuse to permit its further use or maintenance; 9. Describe in detail why each type of Personal Information Collected from a Child is reasonably necessary for the provision of the particular related activity; and 10. Provide a copy of each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the Commission.\n\nC. For 10 years after entry of this Order, each Defendant must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in the following: I. Any designated point of contact; or 2. The structure of any entity that Defendant has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.\n\nD. Each Defendant must submit to the Commission notice of the filing of any bankruptcy petition; insolvency proceeding, or similar proceeding by or against such Defendant within 14 days of its filing.\n\nE. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: \"I declare under penalty of perjury under the laws of the United States of America that the foregoing Page 19 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 20 of 36 is true and correct. Executed on: __\" and supplying the date, signatory's full name, title (if applicable), and signature.\n\nF. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: FTC v. Recolor Oy.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "IX", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create and retain specified records for 10 years (creation) and 5 years (retention), including accounting records, personnel records, consumer complaints, compliance documents, copies of data collection forms and privacy representations, and advertising materials related to collection of children's Personal Information.", "verbatim_text": "A. Accounting records showing the revenues from all goods or services sold;\n\nB. Personnel records showing, for each person providing services, whether as an employee or otherwise, that Person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;\n\nC. Records of all consumer complaints relating to the unauthorized Collection, use, or Disclosure of Personal Information of Children interacting with a website or on line service, and any response;\n\nD. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission;\n\nE. A copy of each materially different form, page, or screen created, maintained, or otherwise provided by each Defendant through which Personal Information of Children is Collected through a website or online service, and a copy of each materially different document containing Page 20 of25 Case 1:21-cv-01758-RDM Document 4 Filed 07/21/21 Page 21 of 36 any representation regarding Collection, use, and Disclosure practices pertaining to Personal Information from Children Collected through a website or online service. Each webpage copy shall be accompanied by the URL of the webpage where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet; and\n\nF. A copy of each unique advertisement, other marketing material, or other representation related to the Collection of Personal Information of Children that is made in connection with promoting or offering for sale an online service.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "X", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff have broad authority to monitor Defendants' compliance, including requesting additional reports, taking depositions, obtaining discovery, communicating directly with Defendants, interviewing affiliated persons, and using other lawful means including undercover methods.", "verbatim_text": "A. Within 14 days ofreceipt of a written request from a representative of the Commission or Plaintiff, each Defendant must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying. The Commission and Plaintiff are also authorized to obtain discovery, without further leave of court, using any of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate directly with each Defendant. Defendant must permit representatives of the Commission and Plaintiff to interview any employee or other Person affiliated with any Defendant who has agreed to such an interview. The Person interviewed may have counsel present.\n\nC. The Commission and Plaintiff may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Defendants or any individual or entity affiliated with Defendants, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-l.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "XI", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "IT IS FURTHER ORDERED that this CoU1t retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "07.21_kuuhuub_et_al._u.s._v.", "company_name": "Kuuhubb Inc.", "date_issued": "2021-07-15", "year": 2021, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), 56(a)(1), 57b, and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/182-3184-kuuhuub-inc-et-al-us-v-recolor-oy", "docket_number": "21-cv-01758" }, { "provision_number": "I", "title": "Deletion of Children's Personal Information Associated with Inactive Alexa Child Profiles", "category": "affirmative_obligation", "summary": "Defendants must implement a process to identify Inactive Alexa Child Profiles within six months, and thereafter delete associated Personal Information within 90 days unless a parent requests retention or the profile becomes active.", "verbatim_text": "9 A. Defendants and Defendants' officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of 11 this Order shall, within six (6) months ofentry ofthis Order, implement a process to 12 identify Inactive Alexa Child Profiles; and\n\n13 B. Following identification ofany Inactive Alexa Child Profile, Defendants shall delete any 14 Personal Information collected from a Child associated with that Inactive Alexa Child 15 Profile within 90 days, unless the Parent ofthe applicable Child requests that such 16 information be retained or the applicable Child Profile becomes active again prior to such 17 deletion.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "II", "title": "Prohibition Against Misrepresentations About Privacy of Geolocation Information and Voice Information", "category": "prohibition", "summary": "Defendants are permanently restrained from misrepresenting their retention, access limitation, or deletion practices for Alexa App Geolocation Information or Voice Information, including what controls consumers and parents may exercise.", "verbatim_text": "1 A. The extent to which any Defendant retains, limits or permits access to, or deletes any 2 Alexa App Geolocation Information or Voice Information;\n\n3 B. The extent to which a consumer may exercise control over any Defendant's retention, 4 deletion, or access to Alexa App Geolocation Information or Voice Information, and the 5 steps a consumer must take to implement such controls; or\n\n6 C. The extent to which a Parent may exercise control over any Defendant's retention or 7 deletion of a Child's Voice Information, and the steps a Parent must take to implement 8 such controls.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "III", "title": "Mandated Deletion of Information", "category": "affirmative_obligation", "summary": "Defendants must delete Alexa App Geolocation Information, Voice Information, and Children's Personal Information upon consumer or parent request, and must not use deleted information to create or improve any Data Product.", "verbatim_text": "13 A. Delete all Alexa App Geolocation Information and Voice Information collected from a 14 consumer where the consumer has requested that any Defendant delete such information 15 via a mechanism any Defendant has made available for that purpose;\n\n16 B. Delete all Personal Information collected by Alexa from a Child where the Child's Parent 17 has requested that any Defendant delete such information via a mechanism any 18 Defendant has made available for that purpose;\n\n19 C. After processing the deletion ofAlexa App Geolocation Information, Voice Information, 20 or Children's Personal Information as provided for in Sections I, IV(A) and IV(B), 21 Defendant shall not subsequently use such information for the creation or improvement 22 of any Data Product. For the avoidance of doubt, the foregoing provision does not limit 23 Defendant's use of any Data Product created prior to the processing of the deletion of 24 STIPULATED ORDER -8 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 9 of 22 1 Alexa App Geolocation Information, Voice Information, or Children's Personal 2 Information as provided for in Section I, IV(A) and IV(B).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "IV", "title": "Mandated Notice of Retention and Deletion", "category": "affirmative_obligation", "summary": "Within 90 days of entry, Defendants must document, adhere to, and make publicly available clearly conspicuous disclosures for Alexa App Geolocation Information and Voice Information retention and deletion practices, including mechanisms for parent deletion requests.", "verbatim_text": "6 receive actual notice ofthis Order, must, within ninety (90) days ofentry ofthis order, 7 document, adhere to, and make publicly available: 8 A. Clearly and Conspicuously, when a consumer is prompted to grant Defendant permission 9 to access Alexa App Geolocation Information, a link to a retention and deletion 10 disclosure for Alexa App Geolocation Information (\"Geolocation Information 11 Disclosure\"), setting forth: (1) the purpose for which such information is collected, used, 12 or maintained; and (2) the mechanisms, ifany, by which consumers may request deletion 13 ofsuch information;\n\n14 B. In the Alexa and Alexa Devices FAQs (or a similarly prominent location) a retention and 15 deletion disclosure for Voice Information (\"Voice Information Disclosure\"), that includes 16 an explanation of: (1) the purposes for which such information is collected, used, or 17 maintained; (2) the mechanisms, ifany, by which consumers may request deletion of 18 such information; and (3) the mechanisms by which Parents ofChildren may request 19 deletion ofPersonal Information that Alexa collects from children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "V", "title": "Notice to Users", "category": "affirmative_obligation", "summary": "Within 30 days of entry, Defendant Amazon must post a link to the Exhibit A Notice in the Alexa FAQs and on the Amazon Parent Dashboard home page for a period of six months.", "verbatim_text": "21 IT IS FURTHER ORDERED that, on or before thirty (30) days after the date ofthe entry 22 ofthis Order, Defendant Amazon must: 23 A. Post in the Alexa and Alexa Devices FAQs (or a similarly prominent location), which can 24 be accessed on the Web and in the Alexa App, for a period ofsix (6) months after the STIPULATED ORDER -9 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 10 of 22 1 effective date ofthis Order, a link to an exact copy ofthe notice attached hereto as 2 Exhibit A (\"Exhibit A Notice\"); and\n\n3 B. Post Clearly and Conspicuously on the home page ofthe Amazon Parent Dashboard for a 4 period ofsix (6) months after the effective date ofthis Order, a link to an exact copy of 5 the Exhibit A Notice.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "VI", "title": "Mandated Privacy Program", "category": "affirmative_obligation", "summary": "Within 90 days of entry and for 20 years thereafter, Defendants must establish, implement, and maintain a comprehensive privacy program to protect Alexa App Geolocation Information, including documentation, risk assessment, safeguards, training, access controls, and vendor oversight.", "verbatim_text": "14 A. Document in writing the content, implementation, and maintenance ofthe 15 Program;\n\n16 B. Provide the written program and any evaluations thereof or updates thereto to a 17 senior officer ofDefendants responsible for the Program at least once every 18 twelve (12) months;\n\n19 C. Designate a qualified employee or employees to coordinate and be responsible for 20 the Program;\n\n21 D. Assess and document, at least once every twelve (12) months, internal and 22 external risks to the privacy ofAlexa App Geolocation Information that could 23 result in the (1) unauthorized collection, maintenance, alteration, use, or 24 disclosure of, or provision ofaccess to, Alexa App Geolocation Information; or STIPULATED ORDER- 10 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 11 of 22 1 the (2) misuse, loss, theft, alteration, destruction, or other compromise ofsuch 2 information;\n\n3 E. Design, implement, maintain, and document safeguards that control for the 4 internal and external risks Defendants identify to the privacy of Alexa App 5 Geolocation Information identified in response to Provision VII.D. Each 6 safeguard must be based on the volume and sensitivity ofAlexa App Geolocation 7 Information that is at risk, and the likelihood that the risk could be realized and 8 result in the ( 1) unauthorized collection, maintenance, use, or disclosure of, or 9 provision of access to, Alexa App Geolocation Information; or the (2) misuse, 10 loss, theft, alteration, destruction, or other compromise ofsuch information. Such 11 safeguards must also include: 12 1. Conducting a privacy review and producing a written report (\"Privacy 13 Review Statement\") for Alexa's collection, maintenance, use, or 14 disclosure ofAlexa App Geolocation Information. The Privacy Review 15 Statement must describe: 16 a) How Alexa collects, maintains, uses, or discloses Alexa App 17 Geolocation Information; 18 b) For how long Alexa App Geolocation Information is retained; 19 c) The risks ofthe (1) collection, maintenance, alteration, use, or 20 disclosure of, or provision ofaccess to; or the (2) misuse, loss, 21 theft, alteration, destruction, or other compromise ofAlexa App 22 Geolocation Information, and the safeguards in place or to be 23 implemented that are intended to control identified risks; 24 STIPULATED ORDER - 11 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 12 of 22 1 d) Any other known, reasonable safeguards or other procedures that 2 would mitigate the identified risks ofthe (1) collection, 3 maintenance, alteration, use, or disclosure of, or provision of 4 access to; or the (2) misuse, loss, theft, alteration, destruction, or 5 other compromise ofAlexa App Geolocation Information that 6 were not implemented, and each reason that such alternatives were 7 not implemented; and 8 e) Any decision made as a result ofthe review ( e.g., whether a 9 practice was approved, approved contingent upon safeguards or 10 other recommendations being implemented, or rejected). 11 2. Implementing controls to limit access to unencrypted Alexa App 12 Geolocation Information only to authorized services; 13 3. Training ofall employees whose responsibilities include access to 14 unencrypted Alexa App Geolocation Information, at least every twelve 15 (12) months, on how to safeguard Alexa App Geolocation Information; 16 4. Training ofall employees whose responsibilities include deletion ofAlexa 17 App Geolocation Information, at least every twelve (12) months, on how 18 to comply with deletion requests; 19 5. Implementing data access controls for all databases and assets storing 20 unencrypted Alexa App Geolocation Information; and 21 6. Reviewing and adjusting as appropriate at least once every twelve (12) 22 months, employee access to unencrypted Alexa App Geolocation 23 Information to ensure that the employee needs continued access to the 24 STIPULATED ORDER- 12 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 13 of 22 1 Alexa App Geolocation Information to perform the employee's specific 2 job function; 3 F. Assess, at least once every twelve (12) months, the sufficiency of any safeguards\n\n3 F. Assess, at least once every twelve (12) months, the sufficiency of any safeguards 4 in place to address the internal and external risks of the (1) collection, 5 maintenance, alteration, use, or disclosure of, or provision of access to; or the 6 (2) misuse, loss, theft, alteration, destruction, or other compromise ofAlexa App 7 Geolocation Information, and modify the Program as needed based on the results; 8 G. Test and monitor the effectiveness ofthe safeguards at least once every twelve\n\n8 G. Test and monitor the effectiveness ofthe safeguards at least once every twelve 9 (12) months, and modify the Program as needed based on the results; 10 H. With respect to service providers who may have access to or receive Alexa App\n\n10 H. With respect to service providers who may have access to or receive Alexa App 11 Geolocation Information through or from Defendants, take reasonable efforts to 12 select and retain service providers capable ofimplementing and maintaining 13 safeguards sufficient to address the internal and external risks ofthe 14 (1) collection, maintenance, alteration, use, or disclosure of, or provision ofaccess 15 to; or the (2) misuse, loss, theft, alteration, destruction, or other compromise of 16 Alexa App Geolocation Information; and 17 I. Evaluate and adjust the Program in light ofany changes to Defendants' operations\n\n17 I. Evaluate and adjust the Program in light ofany changes to Defendants' operations 18 or business arrangements, new or more efficient technological or operational 19 methods that are intended to control for the risks identified in Provision VII.D of 20 this Order, or any other circumstances that Defendants know or have reason to 21 know may have an impact on the effectiveness ofthe Program. At a minimum, 22 Defendants must evaluate the Program at least once every twelve (12) months and 23 modify the Program based on the results as needed. 24 II", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "VII", "title": "Certifications", "category": "compliance_reporting", "summary": "Defendants must annually provide the FTC with a certification from a Vice President confirming compliance with the Order for 10 years, and must submit certifications via email or overnight courier to the specified address.", "verbatim_text": "3 A. One year after the entry date ofthis Order, and each year thereafter for ten (10) years 4 after the entry date ofthis Order, provide the Commission with a certification from a 5 Vice President with oversight responsibilities involving the Alexa service, that: 6 (1) Defendants have established, implemented, and maintained the requirements ofthis 7 Order; and (2) Defendants are not aware ofany material noncompliance that has not been 8 (a) corrected or (b) disclosed to the Commission. The certification must be based on the 9 personal knowledge ofthe senior corporate manager, senior officer, or subject matter 10 experts upon whom the signatory reasonably relies in making the certification; and\n\n11 B. Unless otherwise directed by a Commission representative in writing, submit all annual 12 certifications to the Commission pursuant to this Order via email to DEbrief@ftc.gov or 13 by overnight courier (not the U.S. Postal Service) to Associate Director for Enforcement, 14 Bureau ofConsumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue 15 NW, Washington, DC 20580. The subject line must begin, \"United States v. 16 Amazon.com, Inc., FTC File No. 1923128.\"", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "VIII", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $25,000,000 is entered against Defendants, payable to the U.S. Treasury within 7 days of entry of the Order by electronic fund transfer.", "verbatim_text": "19 A. Judgment in the amount oftwenty-five million dollars ($25,000,000) is entered in favor 20 ofPlaintiff against Defendants as a civil penalty.\n\n21 B. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer ofthe 22 United States, twenty-five million dollars ($25,000,000), which as Defendants stipulate, 23 its undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. 24 STIPULATED ORDER- 14 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 15 of 22 1 Such payment must be made within seven (7) days ofentry ofthis Order by electronic 2 fund transfer in accordance with instructions provided by a representative ofPlaintiff.\n\n3 C. Defendants relinquish dominion and all legal and equitable right, title, and interest in all 4 assets transferred pursuant to this Order and may not seek the return ofany assets.\n\n5 D. The facts alleged in the Complaint will be taken as true, without further proof, in any 6 subsequent civil litigation by or on behalf ofthe Commission to enforce its rights to any 7 payment or monetary judgment pursuant to this Order.\n\n8 E. Defendants acknowledge that their Taxpayer Identification Numbers (Employer 9 Identification Numbers), which Defendants previously submitted to the Commission, 10 may be used for collecting and reporting on any delinquent amount arising out ofthis 11 Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "IX", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendants must submit a sworn acknowledgment of receipt within 10 days, deliver copies of the Order to specified personnel within 10 days (and to future personnel before they assume responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "15 A. Defendants, within ten (10) days after the effective date ofthis Order, must submit to the 16 Commission an acknowledgment ofreceipt ofthis Order sworn under penalty ofperjury.\n\n17 B. For ten (10) years after entry ofthis Order, Defendants must deliver a copy ofthis Order 18 to: (1) all principals, officers, directors, and LLC managers and members ofthe Alexa 19 business within the Defendant entities; (2) all employees and agents having managerial 20 responsibilities for the deletion ofAlexa App Geolocation Information or Voice 21 Information; and (3) any business entity resulting from any change in structure as set 22 forth in the Section titled Compliance Reporting. Delivery must occur within ten (10) 23 days ofentry ofthis Order for current personnel. For all others, delivery must occur 24 before they assume their responsibilities.\n\n1 C. From each individual or entity to which Defendants delivered a copy of this Order, 2 Defendants must obtain, within thirty (30) days, a signed and dated acknowledgment of 3 receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "X", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn annual compliance report one year after entry, provide timely notices of changes in contact or structure within 14 days, and report any bankruptcy filings within 14 days, with all submissions sent to the specified FTC address.", "verbatim_text": "7 A. One year after entry ofthis Order, Defendants must submit a compliance report, sworn 8 under penalty ofperjury. Defendants must: (1) identify the primary physical, postal, and 9 email address and telephone number, as designated points ofcontact, which 1O representatives of the Commission and Plaintiff may use to communicate with 11 Defendants; (2) identify all of Defendants' businesses that collect, maintain, alter, use, or 12 disclose, or provide access to, Alexa App Geolocation Information or Voice Information 13 by all oftheir names, telephone numbers, and physical, postal, email, and Internet 14 addresses; (3) describe the activities of each such business, including the goods and 15 services offered, the means ofadvertising, marketing, and sales; ( 4) describe whether and 16 how Defendants are in compliance with each Section of this Order; and (5) provide a 17 copy of each Order Acknowledgment obtained pursuant to this Order, unless previously 18 submitted to the Commission.\n\n19 B. For ten (10) years after entry of this Order, Defendants must submit a compliance notice, 20 sworn under penalty ofperjury, within fourteen ( 14) days of any change in: (1) any 21 designated point ofcontact; or (2) the structure of Defendants or any entity that 22 Defendants have any ownership interest in or control directly or indirectly that may affect 23 compliance obligations arising under this Order, including: creation, merger, sale, or 24 STIPULATED ORDER- 16 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 17 of 22 1 dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or 2 practices subject to this Order.\n\n3 C. Defendants must submit to the Commission notice ofthe filing of any bankruptcy 4 petition, insolvency proceeding, or similar proceeding by or against Defendants within 5 fourteen (14) days of its filing.\n\n6 D. Any submission to the Commission required by this Order to be sworn under penalty of 7 perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 8 concluding: \"I declare under penalty ofperjury under the laws ofthe United States of 9 America that the foregoing is true and correct. Executed on: __\" and supplying the 10 date, signatory's full name, title (if applicable), and signature.\n\n11 Unless otherwise directed by a Commission representative in writing, all submissions to 12 the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 13 courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 14 Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 15 DC 20580. The subject line must begin, \"United States v. Amazon.com, Inc., FTC File No. 16 1923128.\"", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "XI", "title": "Record Keeping", "category": "recordkeeping", "summary": "Defendants must create certain records for 10 years after entry and retain each record for 5 years, covering personnel records, consumer complaints, deletion requests, compliance records, and advertising materials related to Alexa App Geolocation Information and Voice Information.", "verbatim_text": "21 A. Personnel records showing, for each person having managerial responsibility for the 22 deletion ofAlexa App Geolocation Information or Voice Information, whether as an 23 employee or otherwise, that person's: name; job title or position; and dates of service;\n\n1 B. Records of all consumer complaints and refund requests related to collection, retention or 2 deletion ofAlexa App Geolocation Information or Voice Information received through 3 Defendants' customer service channels, and any response thereto based on a reasonable 4 search criteria that accounts for the volume of such communications Defendants receive 5 through its customer service channels;\n\n6 C. Records of all deletion requests made by individuals or Parents regarding the deletion of 7 Alexa App Geolocation Information or Voice Information via a mechanism or 8 mechanisms that any Defendant has made available for that purpose; the response to such 9 requests; and any actions taken in response to such requests based on reasonable search 10 criteria that account for the volume of such communications or requests Defendants 11 receive through appropriate channels;\n\n12 D. All records necessary to demonstrate material compliance with this Order, including all 13 submissions to the Commission; and\n\n14 E. A copy ofeach unique advertisement or other marketing material related to collection, 15 retention or deletion ofAlexa App Geolocation Information or Voice Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "XII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The FTC and Plaintiff are authorized to monitor Defendants' compliance through information requests, direct communications, employee interviews, and other lawful means including undercover investigation.", "verbatim_text": "19 A. Within thirty (30) days ofreceipt of a written request from a representative ofthe 20 Commission or Plaintiff, Defendants must: submit additional compliance reports or other 21 requested information, which must be sworn under penalty ofperjury; and produce 22 documents for inspection and copying.\n\n23 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 24 communicate directly with Defendants. Defendants must permit representatives ofthe STIPULATED ORDER- 18 Case 2:23-cv-00811-TL Document 29 Filed 07/19/23 Page 19 of 22 1 Commission and Plaintiff to interview any employee or other person affiliated with 2 Defendants who has agreed to such an interview. The person interviewed may have 3 counsel present.\n\n4 C. The Commission and Plaintiff may use all other lawful means, including posing, through 5 their representatives, as consumers, suppliers, or other individuals or entities, to 6 Defendants or any individual or entity affiliated with Defendants, without the necessity of 7 identification or prior notice. Nothing in this Order limits the Commission's lawful use 8 ofcompulsory process, pursuant to Sections 9 and 20 ofthe FTC Act, 15 U.S.C. §§ 49, 9 57b-l.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "XIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "11 IT IS FURTHER ORDERED that this Court retains jurisdiction ofthis matter for 12 purposes of construction, modification, and enforcement ofthis Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "07.23_amazon.com", "company_name": "Amazon.com, Inc.", "date_issued": "2023-07-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a); and Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/192-3128-amazoncom-alexa-us-v", "docket_number": "2:23-cv-00811" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained from failing to provide Direct Notice, failing to post required privacy links, failing to obtain Verifiable Parental Consent or School Authorization, conditioning participation on excess data disclosure, retaining Children's Personal Information longer than necessary, and violating the COPPA Rule.", "verbatim_text": "9 A. Failing to make reasonable efforts, taking into account available technology, to ensure that a 10 Parent of a Child, or a School Representative where any Personal Information Collection is for 11 an Educational Purpose, receives Direct Notice of Defendant’s practices with regard to the 12 Collection, use, or Disclosure of Personal Information from Children, including notice of any 13 material change in the Collection, use, or Disclosure practices to which the Parent or School has 14 previously consented, unless the COPPA Rule provides an exception to providing such notice;\n\n15 B. Failing to post a Clear and Conspicuous link to an online notice of its information practices with 16 regard to Children on the home or landing page or screen of its website or online service, and at 17 each area of the website or online service where Personal Information is Collected from 18 Children, unless the COPPA Rule provides an exception to providing such notice;\n\n19 C. Failing to obtain Verifiable Parental Consent or School Authorization (in accordance with 20 Provision II), before any Collection, use, or Disclosure of Personal Information from Children, 21 including consent to any material change in the Collection, use, or Disclosure practices to which 22 the Parent or School has previously consented, unless the COPPA Rule provides an exception to 23 obtaining Verifiable Parental Consent or School Authorization;\n\n24 D. Conditioning a Child’s participation in an activity on the Child Disclosing more Personal 25 Information than is reasonably necessary to participate in such activity;\n\n26 E. Retaining Personal Information Collected online from a Child for longer than reasonably 27 necessary to fulfill the purpose for which the information was Collected; and\n\n1 F. Violating the COPPA Rule.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "II", "title": "Injunction Concerning Using Schools to Provide Direct Notice to Parents or Obtain Verifiable Parental Consent", "category": "prohibition", "summary": "Defendant is permanently restrained from relying on Schools to obtain Verifiable Parental Consent on its behalf and from relying on School Authorization without a written agreement containing specific required elements.", "verbatim_text": "A. Relying on Schools to act as intermediaries to obtain Verifiable Parental Consent on behalf of 10 Defendant; and\n\nB. Relying on School Authorization for the Collection of Personal Information from Children 12 unless they enter into a written agreement with the School or School Representative that: 13 1. Provides that Personal Information can only be used for Educational Purpose(s); 14 2. Describes all Personal Information that is Collected and how it will be used and 15 Disclosed; 16 3. Provides the School a link to its online notice of information practices and recommends 17 the School make it available on the School’s website; 18 4. Requires a School Representative to acknowledge and agree that they have authority to 19 authorize the Collection of Personal Information from Children on behalf of the School, 20 along with their name and title at the School; and 21 5. Provides that any Personal Information Collected by Defendant is under the Direct 22 Control of the School with regard to its use and maintenance.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "III", "title": "Data Minimization Requirement", "category": "prohibition", "summary": "Defendant is permanently restrained from Collecting more Personal Information from Children than is reasonably necessary for the Child to participate in any activity offered on the Edmodo Platform.", "verbatim_text": "1 notice of this Order, whether acting directly or indirectly, in connection with offering the Edmodo 2 Platform, are hereby permanently restrained and enjoined from Collecting more Personal Information 3 than reasonably necessary for the Child to participate in any activity offered on any such website or 4 online service.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "IV", "title": "Injunction Concerning Use of Previously Collected Personal Information", "category": "affirmative_obligation", "summary": "Defendant must refrain from using previously collected Children's Personal Information without consent, destroy existing non-consented data within 60 days, provide sworn written statements to the Commission within 90 days, delete Affected Work Product within 90 days, and maintain a data retention schedule.", "verbatim_text": "A. Refrain from Disclosing, using, or benefitting from Personal Information Collected from 12 Children that Defendant collected through the Edmodo Platform prior to entry of this Order 13 unless Verifiable Parental Consent or School Authorization is obtained as outlined in Provisions 14 I and II;\n\nB. Within sixty (60) days of entry of this Order, destroy all Personal Information Collected through 16 the Edmodo Platform by Defendant from accounts that have not, by that date, provided 17 Verifiable Parental Consent or School Authorization as described in Provisions I and II;\n\nC. Within ninety (90) days of entry of this Order, provide a written statement to the Commission, 19 sworn under penalty of perjury, that (1) describes the process through which Defendant provided 20 Direct Notice and sought Verifiable Parental Consent or School Authorization for the accounts 21 through which Personal Information is Collected through the Edmodo Platform; (2) identifies the 22 total number of accounts for which Direct Notice was provided, as well as the number of 23 accounts that: 24 (i) provided Verifiable Parental Consent; 25 (ii) provided School Authorization; 26 (iii) affirmatively declined to provide Verifiable Parental Consent or School 27 Authorization; 28 12 [PROPOSED] STIPULATED ORDER CASE NO. Case 3:23-cv-02495-TSH Document 15 Filed 06/27/23 Page 13 of 32 1 (iv) did not respond; 2 (v) Parents or Schools requested be deleted after receiving the Direct Notice provided for 3 under sub-provision IV.B; and 4 (vi) that were the subject of additional questions to Defendant by Parents or Schools; and 5 (3) confirms all Personal Information Collected from Children through the Edmodo Platform 6 related to accounts for which Verifiable Parental Consent or School Authorization was not 7 received has been destroyed;\n\nD. Within ninety (90) days of entry of this Order, delete or destroy any Affected Work Product, and 9 provide a written statement to the Commission, sworn under penalty of perjury, confirming such 10 deletion or destruction. Any Affected Work Product, or Personal Information that Defendant is 11 otherwise required to delete or destroy pursuant to this provision may be retained, and may be 12 disclosed, as requested by a government agency or otherwise required by law, regulation, court 13 order, or other legal obligation, including as required by rules applicable to the safeguarding of 14 evidence in pending litigation. In each written statement to the Commission required by this 15 provision, Defendant shall describe in detail any relevant information that Defendant retains on 16 any of these bases and the specific government agency, law, regulation, court order, or other 17 legal obligation that prohibits Defendant from deleting or destroying such information. Within 18 thirty (30) days after the obligation to retain the information has ended, Defendant shall provide 19 an additional written statement to the Commission, sworn under penalty of perjury, confirming 20 that Defendant has deleted or destroyed such information; and\n\nE. Maintain and adhere to a retention schedule for Children’s Personal Information Collected 22 through the Edmodo Platform, setting forth the purpose for which the information is Collected, 23 the specific business need for retaining such Personal Information, and a set time frame and set 24 of criteria for deletion of such information which may not exceed one (1) year after the 25 termination of the agreement with the School (unless the School affirmatively requests a 26 different time period), or, with respect to Children’s Personal Information that is not Collected 27 under the Direct Control of a School, may not exceed one (1) year after the generation of the data 28 13 [PROPOSED] STIPULATED ORDER CASE NO. Case 3:23-cv-02495-TSH Document 15 Filed 06/27/23 Page 14 of 32 1 (unless the Parent, after receiving notice of the impending deletion from Defendant, affirmatively 2 requests that Defendant retain a Child’s data for longer), and make such information about the 3 retention schedule publicly available on Defendant’s website and in the Direct Notice.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "V", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A $6 million civil penalty judgment is entered against Defendant but suspended based on Defendant's sworn financial statements; the suspension will be lifted and the full amount become due if Defendant is found to have made material misstatements in its Financial Attestations.", "verbatim_text": "6 A. Judgment in the amount of $6 million ($6,000,000) is entered in favor of Plaintiff against 7 Defendant, as a civil penalty.\n\n8 B. The judgment is suspended subject to the Subsections below.\n\n9 C. The Plaintiff’s agreement to the suspension of the judgment is expressly premised upon the 10 truthfulness, accuracy, and completeness of Defendant’s sworn financial statements and related 11 documents (collectively, “Financial Attestations”) submitted to the Commission, namely: 12 1. the Financial Statement of Corporate Defendant, Edmodo, LLC, signed by General 13 Counsel, Susan Shinoff, and all supporting documents.\n\n14 D. The suspension of the judgment will be lifted as to Defendant if, upon motion by Plaintiff, the 15 Court finds that Defendant failed to disclose any material asset, materially misstated the value of 16 any asset, or made any other material misstatement or omission in the Financial Attestations.\n\n17 E. If the suspension of the judgment is lifted, the judgment becomes immediately due as to 18 Defendant in the amount specified in Subsection A of this Section (which the parties stipulate 19 only for purposes of this Section represents the amount of civil penalty for the violations alleged 20 in the Complaint), less any payment previously made pursuant to this Section, plus interest 21 computed from the date of entry of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "VI", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendant relinquishes all rights to assets transferred under this Order, stipulates that Complaint facts will be taken as true in future enforcement proceedings, and acknowledges that its Taxpayer Identification Numbers may be used for collecting on any delinquent amounts.", "verbatim_text": "A. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all assets 25 transferred pursuant to this Order and may not seek the return of any assets.\n\n1 B. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent 2 civil litigation by or on behalf of the Commission, including in a proceeding to enforce its rights 3 to any payment or monetary judgment pursuant to this Order.\n\n4 C. Defendant acknowledges that its Taxpayer Identification Numbers, which Defendant must 5 submit to the Commission, may be used for collecting and reporting on any delinquent amount 6 arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "VII", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit a sworn acknowledgment of receipt of this Order within 7 days, deliver copies to all principals, officers, key employees, and agents within 7 days (and before others assume responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "9 A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission an 10 acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n11 B. For five (5) years after entry of this Order, Defendant, for any business that Defendant is the 12 majority owner of, or controls directly or indirectly, must deliver a copy of this Order to: (1) all 13 principals, officers, directors, managers, and members; (2) all employees having managerial 14 responsibilities relating to the subject matter of the Order, and all agents and representatives who 15 participate in conduct related to the subject matter of the Order; and (3) any business entity 16 resulting from any change in structure as set forth in Section VIII (Compliance Reporting). 17 Delivery must occur within seven (7) days of entry of this Order for current personnel and 18 entities. To all others, delivery must occur before they assume their responsibilities. 19 C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant\n\n19 C. From each individual or entity to which Defendant delivered a copy of this Order, Defendant 20 must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "VIII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit a comprehensive sworn compliance report one year after entry of this Order, file sworn compliance notices within 14 days of any structural or contact changes for 10 years, notify the Commission within 14 days of any bankruptcy filing, and submit all required sworn statements in the prescribed form and to the prescribed address.", "verbatim_text": "A. One year after entry of this Order, Defendant must submit a compliance report, sworn under 24 penalty of perjury, in which Defendant must: (a) identify the primary physical, postal, email 25 address, and telephone number, as designated points of contact, which representatives of the 26 Commission and Plaintiff may use to communicate with Defendant; (b) identify all businesses 27 owned or controlled by Defendant by all of their names, telephone numbers, and physical, postal, 28 15 [PROPOSED] STIPULATED ORDER CASE NO. Case 3:23-cv-02495-TSH Document 15 Filed 06/27/23 Page 16 of 32 1 email, and Internet addresses; (c) describe the activities of each business, including the goods 2 and services offered, the means of advertising, marketing, and sales; (d) describe in detail 3 whether and how Defendant is in compliance with each Section of this Order; (e) provide a copy 4 of each different version of any privacy notice posted on each Website or Online Service 5 Directed to Children operated by Defendant or sent to Parents of Children that register on each 6 website or online service; (f) provide a statement setting forth in detail the methods used to 7 obtain Verifiable Parental Consent or School Authorization prior to any Collection, use, and/or 8 Disclosure of Personal Information from Children by the Edmodo Platform; (g) provide a 9 statement setting forth in detail the means provided for Parents to review the Personal 10 Information Collected from their Children and to refuse to permit its further use or maintenance 11 by the Edmodo Platform; and (h) provide a copy of each Order Acknowledgment obtained 12 pursuant to this Order, unless previously submitted to the Commission.\n\n13 B. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, sworn 14 under penalty of perjury, within fourteen (14) days of any change in: (a) any designated point of 15 contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest 16 in or control directly or indirectly that may affect compliance obligations arising under this 17 Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or 18 affiliate that engages in any acts or practices subject to this Order.\n\n19 C. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 20 insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days 21 of its filing.\n\n22 D. Any submission to the Commission required by this Order to be sworn under penalty of perjury 23 must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare 24 under penalty of perjury under the laws of the United States of America that the foregoing is true 25 and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if 26 applicable), and signature.\n\n1 E. Unless otherwise directed by a Commission representative in writing, all submissions to the 2 Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight 3 courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of 4 Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 5 DC 20580. The subject line must begin: United States v. Edmodo, LLC.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "IX", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create specific records for 10 years and retain each for 5 years, covering accounting records, personnel records, compliance documentation, consumer complaints, consent records, and copies of data collection forms and privacy representations.", "verbatim_text": "12 A. Accounting records showing the revenues from all goods or services sold;\n\n13 B. All personnel records showing, for each person providing services, whether as an employee or 14 otherwise, that person’s: name, addresses, telephone numbers, job title or position, dates of 15 service, and (if applicable) the reason for termination;\n\n16 C. All records necessary to demonstrate full compliance with each provision of this Order, 17 including all submissions to the Commission;\n\n18 D. Copies of all consumer complaints relating to Defendant’s Collection of Personal Information, 19 whether received directly or indirectly, such as through a Third Party, and any response;\n\n20 E. All records demonstrating the steps Defendant has taken to obtain Verifiable Parental Consent or 21 School Authorization, as applicable, for each Child user; and\n\n22 F. A copy of each materially different form, page, or screen created, maintained, or otherwise 23 provided by Defendant through which Defendant Collects Personal Information, and a copy of 24 each materially different document containing any representation regarding Defendant’s 25 Collection, use, and Disclosure practices pertaining to Personal Information. Each webpage 26 copy shall be accompanied by the URL of the webpage where the material was posted online. 27 28 17 [PROPOSED] STIPULATED ORDER CASE NO. Case 3:23-cv-02495-TSH Document 15 Filed 06/27/23 Page 18 of 32 1 Electronic copies shall include all text and graphics files, audio scripts, and other computer files 2 used in presenting information on the Internet.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "X", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through document requests, depositions, discovery, direct communications, employee interviews, and undercover methods, with Defendant required to respond within 14 days of written requests.", "verbatim_text": "6 A. Within fourteen (14) days of receipt of a written request from a representative of the 7 Commission or Plaintiff, Defendant must: submit additional compliance reports or other 8 requested information, which must be sworn under penalty of perjury; appear for depositions; 9 and produce documents for inspection and copying. The Commission and Plaintiff are also 10 authorized to obtain discovery, without further leave of court, using any of the procedures 11 prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 12 34, 36, 45, and 69.\n\n13 B. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate 14 directly with Defendant. Defendant must permit representatives of the Commission and Plaintiff 15 to interview any employee or other Person affiliated with Defendant who has agreed to such an 16 interview. The Person interviewed may have counsel present.\n\n17 C. The Commission and Plaintiff may use all other lawful means, including posing, through its 18 representatives, as consumers, suppliers, or other individuals or entities, to Defendant or any 19 individual or entity affiliated with Defendant, without the necessity of identification or prior 20 notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 21 pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49 and 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "XI", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "2 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of 3 construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "08.23_edmodo", "company_name": "Edmodo, LLC", "date_issued": "2023-08-15", "year": 2023, "administration": "Biden", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/202-3129-edmodo-llc-us-v", "docket_number": "23-cv-02495" }, { "provision_number": "8", "title": "Permanent Injunction — COPPA Rule Compliance", "category": "prohibition", "summary": "Defendants and all persons acting in concert with them are permanently enjoined from violating any provision of the COPPA Rule, 16 C.F.R. Part 312, as it may be amended.", "verbatim_text": "8. The defendants, their successors and assigns, and their officers, agents, servants, representatives, and employees, and all persons in active concert or participation with them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined, directly or through any corporation, subsidiary, division, website, or other device, from violating any provision of the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, and as the Rule may hereafter be amended. A copy of the Rule is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "9", "title": "Consumer Education — FTC Privacy Notice on Child-Directed Sites", "category": "affirmative_obligation", "summary": "For five years, defendants must post a bold, conspicuous FTC privacy hyperlink in their privacy policy, parent notice, and at each personal-information collection point on any child-directed website or online service.", "verbatim_text": "9. For a period of five (5) years from the date of entry of this Consent Decree, the defendants, and their successors and assigns, in connection with the operation of any website or other online service directed to children or through which it, with actual knowledge, collects, uses, and/or discloses personal information from children, shall place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of Page 3 of 15 the Rule, 16 C.F.R. § 312.4(b); (2) within the direct notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); and (3) at each location on its website(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/privacy for information from the Federal Trade Commission about protecting children’s privacy online. Where the above notice is posted on a website or delivered via email or other electronic service, it shall be in the form of a hyperlink to www.ftc.gov/privacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to the defendants, their successors or assigns.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "10", "title": "Consumer Education — OnGuardOnline Safety Tips on Blog Hosting Service", "category": "affirmative_obligation", "summary": "For five years, defendants must place a conspicuous OnGuardOnline social-networking safety-tips hyperlink on the homepage(s) and privacy notice(s) of any blog hosting service they operate.", "verbatim_text": "10. For a period of five (5) years from the date of entry of this Consent Decree, the defendants, and their successors and assigns, in connection with the operation of any blog hosting service, shall place a clear and conspicuous notice on the homepage(s) and privacy notice(s) of their website(s), which states, in the form of a hyperlink in bold typeface, as follows: Visit www.OnGuardOnline.gov for social networking safety tips for parents and youth [“parents” must contain a hyperlink to < www.onguardonline.gov/socialnetworking.html > and “youth” must contain a hyperlink to < www.onguardonline.gov/socialnetworking_youth.html >] The Federal Trade Commission may change the hyperlinks/URLs upon thirty (30) days prior written notice to the defendants, their successors or assigns.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Other" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "11", "title": "Civil Penalty — $1,000,000", "category": "affirmative_obligation", "summary": "Defendants must pay a $1,000,000 civil penalty jointly and severally: $600,000 within five business days of entry, then two $200,000 installments (plus interest) due at six and twelve months from entry.", "verbatim_text": "a. The defendants shall pay the penalty required by this paragraph by paying Six Hundred Thousand Dollars ($600,000) within five (5) business days following entry of this Consent Decree, followed by payment of the remaining Four Hundred Thousand Dollars ($400,000) in two (2) equal installments of Two Hundred Thousand Dollars ($200,000) plus interest, as calculated pursuant to 28 U.S.C. § 1961, due within six (6) and twelve (12) months, respectively, of the date of entry of this Consent Decree; provided, however, that at any time, and without penalty, the defendants may pay the balance due, make more frequent payments, make advance payments, or make larger payments than scheduled;\n\nb. The defendants shall make all payments required by this paragraph by electronic fund transfer in accordance with procedures specified by the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "12", "title": "Default in Payment", "category": "affirmative_obligation", "summary": "If any payment is in default for ten days beyond its due date, the entire remaining unpaid penalty plus interest becomes immediately due and payable.", "verbatim_text": "12. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "13", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Within five days of entry, defendants must delete all personal information collected and maintained in violation of the COPPA Rule through the date of entry.", "verbatim_text": "13. The defendants, and their successors and assigns, within five (5) days from the date of entry of this Consent Decree, shall delete all personal information collected and maintained in violation of the Rule through the date of entry of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "14", "title": "Distribution of Order and Compliance Guide — Current Personnel", "category": "acknowledgment", "summary": "Within thirty days of entry, defendants must provide a copy of the Consent Decree and COPPA compliance guide to all current principals, officers, directors, managers, relevant employees, agents, and representatives, obtain signed acknowledgments, and submit a compliance statement to the Commission within ten days thereafter.", "verbatim_text": "14. The defendants, and their successors and assigns, within thirty (30) days from the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children’s Online Privacy Protection Rule (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) to each of its current principals, officers, directors, and managers; and to all current employees and agents having responsibilities related to the operation of any website or online service subject to this Consent Decree; and to all current representatives having responsibilities related to compliance with this Consent Decree; and secure from each such person a signed statement acknowledging receipt of a copy of this Consent Decree and the compliance guide. The defendants shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of the defendants’ compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided.\n\ndefendants shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of the defendants’ compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "15", "title": "Distribution of Order and Compliance Guide — Future Personnel", "category": "acknowledgment", "summary": "For five years from entry, defendants must provide the Consent Decree and compliance guide to all future principals, officers, directors, managers, relevant employees, agents, and representatives within thirty days of their assuming such position, obtain signed and dated acknowledgments, and maintain those records for Commission inspection upon request.", "verbatim_text": "15. The defendants, and their successors and assigns, for a period of five (5) years from the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the compliance guide to each of its future principals, officers, directors, and managers; and to all future employees and agents having responsibilities related to the operation of any website or Page 6 of 15 online service subject to this Consent Decree; and to all future representatives having responsibilities related to compliance with this Consent Decree; and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or responsibilities. The defendants shall maintain copies of the signed statements, as well as other information regarding the fact and manner of their compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Commission.\n\nresponsibilities. The defendants shall maintain copies of the signed statements, as well as other information regarding the fact and manner of their compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "16", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "For three years, individual defendants must notify the Commission of changes in address, employment, ownership, name, and corporate structure. Beginning sixty days after entry, all defendants must submit sworn written compliance reports whenever the FTC reasonably requires, detailing registration practices, privacy notices, parental consent procedures, and data protection measures.", "verbatim_text": "i. Each individual defendant shall notify the Commission of the following: (1) Any changes in residence addresses, mailing addresses, and telephone numbers of such individual defendant, within ten (10) days of the date of such change;\n\n(2) Any changes in employment status (including self-employment) of such individual defendant, and any change in the ownership of the individual defendant in any business entity, within ten (10) days of the date of such change. Such notice shall include the name and address of each business that the individual defendant is affiliated Page 7 of 15 with, employed by, creates, forms, or performs services for; a statement of the nature of the business; and a statement of the individual defendant’s duties and responsibilities in connection with the business or employment; and\n\n(3) Any changes in the individual defendant’s name or use of any aliases or fictitious names; and\n\nii. Each defendant shall notify the Commission of any changes in corporate structure of the corporate defendant, or any business entity that an individual defendant directly or indirectly controls or has an ownership interest in, that may affect compliance obligations arising under this Consent Decree, including but not limited to a dissolution, assignment, sale, merger, or other action that would result in the emergence of a successor entity; the creation or dissolution of a subsidiary, parent, or affiliate that engages in any acts or practices subject to this Consent Decree; the filing of a bankruptcy petition; or a change in the corporate name or address, at least thirty (30) days prior to such change, provided that, with respect to any proposed change in the corporation about which a defendant learns less than thirty (30) days prior to the date such action is to take place, such defendant shall notify the Commission as soon as is practicable after obtaining such knowledge.\n\nb. Sixty (60) days after the date of entry of this Consent Decree and at such times as the Federal Trade Commission shall reasonably require, the defendants each shall provide a written report to the Commission, sworn to under penalty of perjury, setting forth in detail the manner and form in which they have complied and are complying with this Consent Decree. This report shall include, but not be limited to: i. For each individual defendant: (1) The then-current residence addresses, mailing addresses, and telephone numbers of the individual defendant; and (2) The then-current employment and business addresses and telephone numbers of the individual defendant; a description of the business activities of each such employer or business, and the title and responsibilities of the individual defendant, for each such employer or business. ii. For all defendants: (1) a statement setting forth in detail the criteria and process through which any of their websites registers visitors online for any activity requiring the submission of personal information, and a copy of each different screen or page providing or collecting registration information; (2) a copy of each different privacy notice posted on any of their websites; (3) a statement setting forth in detail each place where the privacy Page 9 of 15 notice on any website is located and a copy of each screen or page on which the website collects personal information; (4) a copy of each different privacy notice sent to parents; (5) a statement setting forth in detail when and how each notice to parents is provided; (6) a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; (7) a statement setting forth in detail the means provided for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; (8) a statement setting forth in detail why each type of information collected from a child is reasonably necessary for the provision of the particular related activity; and (9) a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "17", "title": "Recordkeeping", "category": "recordkeeping", "summary": "For five years from entry, defendants must maintain and make available to the FTC (within fourteen days of a written request) print or electronic copies of all documents demonstrating compliance, including acknowledgments, reports, web page copies with URLs, and all materials related to the collection, use, and disclosure of children's personal information.", "verbatim_text": "17. For a period of five (5) years from the date of entry of this Consent Decree, defendants, and their successors and assigns, shall maintain, and make available to the Federal Trade Commission for inspection and copying within fourteen (14) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, copies of acknowledgments of receipt of this Consent Decree; all reports submitted to the Commission pursuant to this Consent Decree; a sample copy of every different form, web page, or screen through which personal information is collected; and a sample copy of each different document containing any representation regarding defendants’ collection, use, and disclosure practices pertaining to personal information of a child. Each web page copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendant shall not be required to retain any document for longer than two (2) years after the document was created, or to retain a print or electronic copy of any amended web page or screen to the extent that the amendment does not affect defendant’s compliance obligations under this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "18", "title": "Provision of Taxpayer Identifying Numbers", "category": "affirmative_obligation", "summary": "Defendants must furnish their taxpayer identifying numbers (SSN or EIN) to the FTC pursuant to 31 U.S.C. § 7701 for use in collecting and reporting on any delinquent amounts owed to the government.", "verbatim_text": "18. The defendants are hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission their taxpayer identifying numbers (social security Page 11 of 15 number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of their relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "19", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction over this matter to allow any party to seek further orders for interpretation, modification, enforcement, or punishment of violations of the Consent Decree.", "verbatim_text": "19. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.06_xanga.com_john_hiler_and_marc_ginsburg", "company_name": "Xanga.com, Inc.", "date_issued": "2006-09-15", "year": 2006, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c), and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a), and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a), and 57b", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/062-3073-xangacom-inc-john-hiler-marc-ginsburg", "docket_number": "06 Civ." }, { "provision_number": "15", "title": "Injunction — COPPA Compliance", "category": "prohibition", "summary": "Defendants are permanently enjoined from violating COPPA by failing to provide required notices, failing to obtain verifiable parental consent, and otherwise violating the COPPA Rule.", "verbatim_text": "20 A. Failing to provide sufficient notice of what information Defendants collect online 21 from children, how they use such information, their disclosure practices, and all 22 other content, on any website or online service that is directed to children, or any 23 website or online service through which they, with actual knowledge, collect, use, 24 andlor disclose personal information from children, as required by Section 25 312.4(b) of the Rule, 16 C.F.R. § 312.4(b);\n\n26 B. Failing to provide direct notice to parents of what information Defendants collect 27 online from children, how they use such information, their disclosure practices, 28 and all other required content, in connection with any website or online service onsent Decree and Order Page 3 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page4 of 15 1 that is directed to children, or any website or online service through which they, 2 with actual knowledge, collect, use, andlor disclose personal information from 3 children, as required by Section 312.4(c) ofthe Rule, 16 C.F.R. § 312.4(c);\n\n4 C. Failing to obtain verifiable parental consent before any collection, use, andlor 5 disclosure of personal information from children, in connection with any website 6 or online service that is directed to children, or on any website or online service 7 through which they, with actual knowledge, collect, use, and/or disclose personal 8 information from children, as required by Section 312.5 of the Rule, 16 C.F.R. § 9 312.5(a)(1); or,\n\n10 D. Violating any other provision of the Children's Online Privacy Protection Rule, 11 16 C.F .R. Part 312, and as the Rule may hereafter be amended. A copy of the 12 Rule is attached hereto as \"Appendix A\" and incorporated herein as if fully set 13 forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "16", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendants must delete all personal information collected in violation of the Rule from April 21, 2000 through the date of the Order, within five days of entry.", "verbatim_text": "15 16. IT IS FURTHER ORDERED that Defendants, within five (5) days from the date of 16 entry of this Order, shall delete all personal information collected and maintained in 17 violation of the Rule at any time from April 21, 2000 through the date of entry of this 18 ·Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "17", "title": "Civil Penalty — Payment of $50,000", "category": "affirmative_obligation", "summary": "Defendants must jointly and severally pay a civil penalty of $50,000 to the United States pursuant to Section 5(m)(1)(A) of the FTC Act.", "verbatim_text": "20 17. IT IS FURTHER ORDERED that Defendants, jointly and severally, shall pay to 21 Plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the FTC Act, 15 U.S.C. 22 § 4S(m)(I)(A), in the amount of fifty thousand dollars ($50,000).\n\n23 18. Prior to or concurrently with Defendants' execution ofthis Order, Defendants shall turn 24 over the full amount of the civil penalty to their attorneys, who shall hold the entire sum 25 for no purpose other than payment to the Treasurer oftM United States after entry ofthis 26 Order by the Court. Within five (5) days of receipt of notice oftlie entry of this Order, 27 Defendants' attorneys shall transfer the sum of $50,000 in the form of a wire transfer or . 28 certified cashier's check made payable tothe Treasurer of the United States. The check . onsent Decree and Order Page 4 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page5 of 15 1 and/or written confirmation of the wire transfer shall be delivered in accordance with 2 procedures specified by the Office of Consumer Litigation, Civil Division, U.S. 3 Department of Justice, Washington, DC 20530.\n\n4 19. Defendants relinquish all dominion, control, and title to the funds paid to the fullest 5 extent permitted by law. Defendants shall make no claim to or demand return of the 6 funds, directly or indirectly, through counselor otherwise.\n\n7 O. Defendants agree that the facts as alleged in the Complaint filed in this action shall be 8 taken as true, without further proof, in any subsequent civil litigation filed by or on 9 behalf of the Commission solely to enforce its rights to any payment or money judgment 10 pursuant to this Order.\n\n11 1. Defendants agree that the judgment represents a civil penalty owed to the United States 12 Government, is not compensation for actual pecuniary loss, and, therefore, as to the 13 Individual Defendant, is not subject to discharge under the Bankruptcy Code pursuant to 14 11 U.S.C. § 523(a)(7).\n\n15 2. In the event of any default in payment, which default continues for ten (10) days beyond 16 the due date of payment, the entire unpaid penalty, together with interest, as computed 17 pursuant to 28 U.S.C. § 1961 (accrued from the date of default to the date of payment) 18 shall immediately become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "23", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission is authorized to monitor compliance with the Order, including requiring written reports, document production, depositions, and business entry from Defendants within ten days of written notice.", "verbatim_text": "22 A. Within ten (10) days of receipt of written notice from a representative of the 23 Commission, Defendants each shall submit written reports, which are true and 24 accurate and sworn to under penalty of perjury; produce documents for inspection 25 and copying; appear for deposition; and provide entry during normal business 26 hours to any business location in each Defendant's possession or direct or indirect 27 control to inspect the business operation. Provided that Defendants, after 28 attempting to resolve any dispute without court action and for good cause shown, onsent Decree and Order Page 5 of15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page6 of 15 1 may file a motion with this Court seeking an order including one or more of the 2 protections set forth in Fed. R. Civ. P. 26(c).\n\n3 B. In addition, the Commission is authorized to use all other lawful means, including 4 but not limited to: 5 1. Obtaining discovery from any person, without further leave of court, using 6 the procedures prescribed by Fed. R. Civ. P. 30, 31, 33, 34, 36, 45 and 69; 7 2. Having its representatives pose as consumers and suppliers to Defendants, 8 their employees, or any other entity managed or controlled in whole or in 9 part by any Defendant, without the necessity of identification or prior 10 notice; and,\n\n11 C. Defendants each shall permit representatives of the Commission to interview any 12 employer, consultant, independent contractor, representative, agent, or employee 13 who has agreed to such an interview, relating in any way to any conduct subject 14 to this Order. The person interviewed may have counsel present, including 15 Defendants' counsel and any individual counsel.\n\n16 D. For purposes of the compliance reporting and monitoring required by this Order, 17 the Commission is authorized to communicate directly with each Defendant.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "24", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must notify the Commission of personal and business changes for three years, file sworn written compliance reports beginning 60 days after entry, and notify the Commission of any bankruptcy filings within 15 days.", "verbatim_text": "26 A. For a period of three (3) years from the date of entry of this Order, 27 1. Individual Defendant shall notifY the Commission of the following: 28 a. Any changes in such Defendant's residence, mailing address. and onsent Decree and Order Page 6 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page7 of 15 1 telephone number, within ten (10) days of the date of such change;\n\n2 b. Any changes in such Defendant's employment status (including 3 self-employment), and any change in such Defendant's ownership 4 in any business entity, within ten (10) days of the date of such 5 change. Such notice shall include the name and address of each 6 business that such Defendant is affiliated with, employed by, 7 creates or forms, or performs services for; a detailed description of 8 the nature of the business; and a detailed description of such 9 Defendant's duties and responsibilities in connection with the 10 business or employment; and,\n\n11 c. Any changes in such Defendant's name or use of any aliases or 12 fictitious names within ten (10) days of the date of such change;\n\n13 2. Defendants shall notifY the Commission of any changes in structure of the 14 Corporate Defendant or any business entity that any Defendant directly or 15 indirectly controls, or has an ownership interest in, that may affect 16 compliance obligations arising under this Order, including but not limited 17 to: incorporation or other organization; a dissolution, assignment, sale, 18 merger, or other action; the creation or dissolution of a subsidiary, parent, 19 or affiliate that engages in any acts or practices subject to this Order; or a 20 change in the business name or address, at least thirty (30) days prior to 21 such ch!IDge, prOVided that, with respect to any such change in the 22 business entity about which a Defendant learns less than thirty (30) days 23 prior to the date such action is to take place, such Defendant shall notify 24 the Commission as soon as is practicable after obtaining such knowledge.\n\n25 B. Sixty (60) days after the date of entry of this Order, and thereafter for a period of 26 three (3) years, at such times as the Federal Trade Commission shall reasonably 27 require, Defendants each shall provide a written report to the Commission, which 28 is true and accurate and sworn to under penalty of perjury, setting forth in detail onsent Decree and Order Page 7 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page8 of 15 1 the manner and form in which each has complied and is complying with this 2 Order. This report shall include, but not be limited to: 3 1. For the Individual Defendant: 4 a. such Defendant's then-current residence address, mailing 5 addresses, and telephone numbers; 6 b. such Defendant's then-current employment status (including self- 7 employment), including the name, addresses, and telephone 8 numbers of each business that such Defendant is affiliated with, 9 employed by, or performs services for; a detailed description of the 10 nature of the business; and a detailed description of such 11 Defendant's duties and responsibilities in connection with the 12 business or employment; and, 13 c. Any other changes required to be reported under Subsection A of 14 this Section. 15 2. For the Corporate Defendant and Individual Defendant, for any business 16 which they, individually or collectively, own a majority interest in or 17 directly or indirectly control: 18 a. A statement setting forth in detail the criteria and process through 19 which any of Defendant's websites or online services enable the 20 collection or disclosure of personal information, and a copy of 21 each different version of screen or page where personal 22 information can be collected or disclosed; 23 b. A copy of each different version of privacy notice posted on any of 24 Defendant's websites or online services; 25 c. A statement setting forth in detail each place where a privacy 26 notice or a link to a privacy notice is located on any website or 27 online service, and a copy of each different version of screens or 28 pages containing a privacy notice or a link to a privacy notice; onsent Decree and Order Page 8 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page9 of 15 1 d. A copy of each different version of privacy notice sent to parents; 2 e. A statement setting forth in detail when and how each notice to 3 parents is provided; 4 f. A statement setting forth in detail the methods used to obtain 5 verifiable parental consent prior to any collection, use, and/or 6 . disclosure of personal information from children; 7 g. A statement setting forth in detail the means provided for parents 8 to review the personal infonnation collected from their children 9 and to refuse to permit its further use or maintenance; 10 h. A statement setting forth in detail why each type of infonnation 11 collected from a child is reasonably necessary for the provision of 12 the particular related activity; 13 i. A statement setting forth in detail the procedures used to protect 14 the confidentiality, security, and integrity of personal infonnation 15 collected from children; 16 J. A copy of each acknowledgment of receipt of this Order, obtained 17 pursuant to the Section titled \"Distribution of Order\"; and, 18 k. Any other changes required to be reported under Subsection A of 19 this Section.\n\n20 c. Each Defendant shall notify the Commission of the filing of a bankruptcy petition 21 by such Defendant within fifteen (15) days of filing.\n\n22 D. For the purposes of this Order, Defendants shall, unless otherwise directed by the 23 Commission's authorized representatives, send by overnight courier (not the U.S. 24 Postal Service) all reports and notifications to the Commission that are required 25 by this Order to the following address: 26 27 28 onsent Decree and Order Page 9 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page10 of 15 1 Associate Director for Enforcement Bureau of Consumer Protection 2 Federal Trade Commission 600 Pennsylvania Avenue, NW 3 Washington, D.C. 20580 u.s. RE: v. W3 Innovations. LLC 4 5 Provided that, in lieu of overnight courier, Defendants may send such reports or 6 notifications by first-class mail, but only if Defendants contemporaneously send 7 an electronic version of such report or notification to the Commission at: 8 DEBrief@ftc.gov.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "25", "title": "Recordkeeping Provisions", "category": "recordkeeping", "summary": "For six years from entry of the Order, Defendants must create and retain records sufficient to demonstrate full compliance, including acknowledgments, compliance reports, and copies of all forms and pages through which children's personal information is collected or disclosed.", "verbatim_text": "5. IT IS FURTHER ORDERED that, for a period of six (6) years from the date of entry of 11 this Order, Corporate Defendant and Individual Defendant, for any business engaged in 12 activities relating to the subject matter of this Order, and which they. individually or 13 collectively, own a majority interest in or directly or indirectly control, are hereby 14 restrained and enjoined from failing to create and retain the following records: 15 A. A print or electronic copy of all documents necessary to demonstrate full 16 compliance with each provision of this Order, including, but not limited to: 17 1. Copies of acknowledgments of receipt of this Order required by Sections 18 titled \"Distribution of Order\" and \"Acknowledgment of Receipt of 19 Order\"; 20 2. All reports submitted to the Commission pursuant to the Section titled 21 \"Compliance Reporting\"; 22 3. A sample copy of every materially different fonn, page, or screen through 23 which personal infonnation is collected or disclosed, and a sample copy of 24 each materially different document containing any representation 25 regarding Defendants' collection, use, and disclosure practices pertaining 26 to personal infonnation of a child. Each web page copy shall be 27 accompanied by the URL of the web page where the material was posted 28 onsent Decree and Order Page ,10 of 15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page11 of 15 1 online. Electronic copies shall include all text and graphics files, audio 2 scripts, and other computer files used in presenting information. 3 Provided, however, that Defendants shall not be required to retain any 4 document for longer than two (2) years after the document was created, or 5 to retain a print or electronic copy of any amended form, page, or screen 6 to the extent that the amendment does not affect Defendants' compliance 7 obligations under this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "26", "title": "Distribution of Order", "category": "acknowledgment", "summary": "For three years, Defendants must deliver copies of the Order to relevant personnel and business entities and obtain signed acknowledgments of receipt within 30 days of delivery.", "verbatim_text": "12 A. Corporate Defendant: The Corporate Defendant must deliver a copy of this Order 13 to: (1) all of its principals, officers, directors, and managers; (2) all of its 14 employees, agents, and representatives who have responsibilities related to the 15 operation of any website or online service subject to this Order; and (3) any 16 business entity resulting from any change in structure set forth in Subsection A.2. 17 ofthe Section titled \"Compliance Reporting.\" For current personnel, delivery 18 shall be within five (5) days of service of this Order upon each such Defendant. 19 For new personnel, delivery shall occur prior to their assuming their 20 responsibilities. For any business elltity resulting from any change in structure set 21 forth in Subsection A.2. of the Section titled \"Compliance Reporting,''> delivery 22 shall be at least ten (10) days prior to the change in structure.\n\n23 B. Individual Defendant as control person: For any business engaged in activities 24 related to the subject matter of this Order, and that the Individual Defendant owns 25 a majority interest in or directly or indirectly controls, Individual Defendant must 26 deliver a copy of this Order to: (1) all principals, officers, directors, and managers 27 of that business; (2) all employees, agents, and representatives of that business 28 who engage in activities related to the subject matter of the Order; and (3) any onsent Decree and Order Page 11 of15 Case5:11-cv-03958-PSG Document7 Filed09/08/11 Page12 of 15 1 business entity resulting from any change in structure set forth in Subsection A.2. 2 of the Section titled \"Compliance Reporting.\" For current personnel, delivery 3 shall be within five (5) days of service of this Order upon such Defendant. For 4 new personnel, delivery shall occur prior to their assuming their responsibilities. 5 For any business entity resulting from any change in structure set forth in 6 Subsection A.2. of the Section titled \"Compliance Reporting,\" delivery shall be at 7 least ten (10) days prior to the change in structure.\n\n8 C. Defendants must secure a signed and dated statement acknowledging receipt of 9 the Order, within thirty (30) days of delivery, from all persons receiving a copy of 10 the Order pursuant to this Se.ction. Defendants shall maintain copies of the signed 11 statements, as well as other information regarding the fact and manner of its 12 compliance, including the name and title of each person to whom a copy of the 13 Order has been provided and, upon request, shall make the statements and other 14 information available to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "27", "title": "Acknowledgment of Receipt of Order", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn statement to the Commission acknowledging receipt of the Order within five business days of its entry by the Court.", "verbatim_text": "16 7. IT IS FURTHER ORDERED that each Defendant, within five (5) business days of 17 receipt of this Order as entered by the Court, must submit to the Commission a truthful 18 sworn statement acknowledging receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "28", "title": "Provision of Taxpayer Identifying Numbers", "category": "affirmative_obligation", "summary": "Corporate Defendant must furnish its taxpayer identifying number (employer identification number) to the FTC for purposes of collecting and reporting any delinquent amounts.", "verbatim_text": "20 8. IT IS FURTHER ORDERED that the Corporate Defendant is hereby required, in 21 accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission its 22 taxpayer identifying number (employer identification number), which shall be used for 23 purposes of collecting and reporting any delinquent amount arising out of its relationship 24 with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "29", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for the purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "26 9. This Court shall retain jurisdiction of this matter for the purposes of construction, 27 modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.11_w3_innovations_dba_broken_thumb_apps_and_justin_maples_u.s.", "company_name": "W3 Innovations, LLC", "date_issued": "2011-09-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/102-3251-w3-innovations-llc-dba-broken-thumb-apps-justin-maples-us", "docket_number": "C-11-03958" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained and enjoined from violating the Children's Online Privacy Protection Rule, including failing to provide notice to parents, failing to post online notices, and failing to obtain verifiable parental consent before collecting personal information from children.", "verbatim_text": "A. failing to make reasonable efforts, taking into account available technology, to ensure 3 that a parent of a child receives direct notice of Defendant’s practices with regard to the 4 collection, use, or disclosure of personal information from children, including notice of any 5 material change in the collection, use, or disclosure practices to which the parent has previously 6 consented;\n\nB. failing to post a prominent and clearly labeled link to an online notice of its information 8 practices with regard to children on the home or landing page or screen of its website or online 9 service, and at each area of the website or online service where personal information is collected 10 from children; and\n\nC. failing to obtain verifiable parental consent before any collection, use, or disclosure of 12 personal information from children, including consent to any material change in the collection, 13 use, or disclosure practices to which the parent has previously consented.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "II", "title": "Injunction Concerning Deletion of Children's Personal Information", "category": "prohibition", "summary": "Defendant is permanently restrained from disclosing, using, or benefitting from personal information collected from children prior to entry of this Order, and must delete all such information within ten days.", "verbatim_text": "A. disclosing, using, or benefitting from Personal Information collected from children which 20 Defendant obtained prior to entry of this Order; and\n\n1 B. failing to destroy such Personal Information in all forms in its possession, custody, or 2 control within ten (10) days after entry of this Order. Provided, however, that such Personal Information need not be destroyed, and may be disclosed, to the extent requested by a 3 government agency or required by a law, regulation, or court order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition", "Data Deletion" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $300,000 to the United States Treasury within seven days of entry of this Order.", "verbatim_text": "B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the 9 United States, three hundred thousand dollars ($300,000), which, as Defendant stipulates, its 10 undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such 11 payment must be made within seven (7) days of entry of this Order by electronic fund transfer in 12 accordance with instructions previously provided by a representative of Plaintiff.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "IV", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain and submit acknowledgments of receipt of this Order from itself, from specified personnel, and from any business entity resulting from structural changes.", "verbatim_text": "A. Defendant, within seven (7) days of entry of this Order, must submit to the Commission 3 an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For seven (7) years after entry of this Order, Defendant, must deliver a copy of this Order 5 to: (1) all principals, officers, directors, and managers; (2) all employees, agents, and 6 representatives having supervisory responsibilities relating to the collection, retention, storage, or 7 security of personal information, and to all employees, agents, and representatives having 8 supervisory responsibilities relating to the operation of any of Defendant’s websites or online 9 services; and (3) any business entity resulting from any change in structure as set forth in the 10 Section titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this 11 Order for current personnel. To all others, delivery must occur before they assume their 12 responsibilities.\n\n13 C. From each individual or entity to which a Defendant delivered a copy of this Order, that 14 Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "V", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit compliance reports and notices to the Commission, including an annual compliance report one year after entry of the Order and notices of changes in structure or bankruptcy within specified timeframes.", "verbatim_text": "A. One year after entry of this Order, Defendant must submit a compliance report, sworn 19 under penalty of perjury. In such report, Defendant must: 20 21 Page 9 of 16 22 STIPULATED ORDER 3:14-cv-4164 Case3:14-cv-04164-JSC Document4 Filed09/16/14 Page10 of 16 1 1. identify the primary physical, postal, and email address and telephone number, as 2 designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Defendant; 3 2. identify all of Defendant’s businesses by all of their names, telephone numbers, 4 and physical, postal, email, and Internet addresses; 5 3. describe the activities of each business, including the goods and services offered, 6 the means of advertising, marketing, and sales; 7 4. describe in detail whether and how Defendant is in compliance with each Section 8 of this Order; 9 5. provide a copy of each different version of any privacy notice posted on each 10 website or online service operated by Defendant or sent to parents of children that register on 11 each website or online service; 12 6. provide a statement setting forth in detail the methods used to obtain verifiable 13 parental consent prior to any collection, use, and/or disclosure of personal information from 14 children; 7. provide a statement setting forth in detail the means provided for parents to 15 review the personal information collected from their children and to refuse to permit its further 16 use or maintenance; and 17 8. provide a copy of each Order Acknowledgment obtained pursuant to this Order, 18 unless previously submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, 20 sworn under penalty of perjury, within fourteen (14) days of any change in: (a) any designated 21 Page 10 of 16 22 STIPULATED ORDER 3:14-cv-4164 Case3:14-cv-04164-JSC Document4 Filed09/16/14 Page11 of 16 1 point of contact; or (b) the structure of Defendant or any entity that Defendant has any ownership 2 interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, 3 parent, or affiliate that engages in any acts or practices subject to this Order.\n\nC. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 5 insolvency proceeding, or similar proceeding by or against Defendant within fourteen (14) days 6 of its filing.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "VI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain specified records for ten years after entry of the Order, with each record retained for five years, including all compliance records, consumer complaints, and documents relating to personal information collection practices.", "verbatim_text": "A. all records necessary to demonstrate full compliance with each provision of this Order, 21 Page 11 of 16 22 STIPULATED ORDER 3:14-cv-4164 Case3:14-cv-04164-JSC Document4 Filed09/16/14 Page12 of 16 1 including all submissions to the Commission;\n\n2 B. copies of all consumer complaints relating to Defendant’s collection of personal information whether received directly or indirectly, such as through a third party, and any 3 response; and\n\nC. a copy of each materially different form, page, or screen created, maintained, or 5 otherwise provided by Defendant through which Defendant collects personal information, and a 6 copy of each materially different document containing any representation regarding Defendant’s 7 collection, use, and disclosure practices pertaining to personal information. Each webpage copy 8 shall be accompanied by the URL of the webpage where the material was posted online. 9 Electronic copies shall include all text and graphics files, audio scripts, and other computer files 10 used in presenting information on the Internet. Provided, however, that for purposes of this 11 subsection, VI.C., Defendant shall not be required to retain any document for longer than two (2) 12 years after the document was created, or to retain a print or electronic copy of any amended web 13 page or screen to the extent that the amendment does not affect Defendant’s compliance 14 obligations under this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "VII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through various means including requesting additional reports, depositions, document production, interviews, and posing as consumers or other entities.", "verbatim_text": "A. Within 14 days of receipt of a written request from a representative of the Commission or 18 Plaintiff, Defendant must: submit additional compliance reports or other requested information, 19 which must be sworn under penalty of perjury; appear for depositions; and produce documents 20 for inspection and copying. The Commission and Plaintiff are also authorized to obtain 21 Page 12 of 16 22 STIPULATED ORDER 3:14-cv-4164 Case3:14-cv-04164-JSC Document4 Filed09/16/14 Page13 of 16 1 discovery, without further leave of court, using any of the procedures prescribed by Federal 2 Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are authorized to 3 communicate directly with Defendant. Defendant must permit representatives of the 4 Commission and Plaintiff to interview any employee or other person affiliated with Defendant 5 who has agreed to such an interview. The person interviewed may have counsel present.\n\nC. The Commission and Plaintiff may use all other lawful means, including posing, through 7 its representatives as consumers, suppliers, or other individuals or entities, to Defendant or any 8 individual or entity affiliated with Defendant, without the necessity of identification or prior 9 notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, 10 pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. § § 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "VIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "12 IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 13 purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.14_tinyco", "company_name": "TinyCo, Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3209-tinyco-inc", "docket_number": "3:14-cv-04164" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained and enjoined from violating COPPA requirements, including failing to provide notice to parents, failing to post prominent links to privacy notices, failing to obtain verifiable parental consent, and violating the COPPA Rule.", "verbatim_text": "A. failing to make reasonable efforts, taking into account available technology, to ensure 18 that a parent of a child receives direct notice of Defendant’s practices with regard to the 19 collection, use, or disclosure of personal information from children, if any, including notice of 20 any material change in the collection, use, or disclosure practices to which the parent has 21 previously consented; 22\n\n23 B. failing to post a prominent and clearly labeled link to an online notice of its information 24 practices with regard to children, if any, on the home or landing page or screen of its Web site or 25 online service, and at each area of the Web site or online service where personal information is 26 collected from children, if such information is collected; 27\n\nC. failing to obtain verifiable parental consent before any collection, use, or disclosure of 28 7 STIPULATED ORDER 3:14-CV-4163 Case3:14-cv-04163-JCS Document5 Filed09/16/14 Page8 of 16 1 personal information from children, including consent to any material change in the collection, 2 use, or disclosure practices to which the parent has previously consented; and\n\nD. violating the Children’s Online Privacy Protection Rule, 16 C.F.R. Part 312, a copy of 4 which is attached hereto as Appendix A.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "II", "title": "Injunction Concerning Deletion of Children's Personal Information", "category": "prohibition", "summary": "Defendant is permanently restrained from disclosing, using, or benefitting from personal information collected from children under 13 who registered with Yelp prior to entry of this Order, and must destroy such information within 30 days.", "verbatim_text": "A. disclosing, using, or benefitting from personal information collected from children under 12 13 who registered or attempted to register with Yelp prior to entry of this Order; and; 13\n\nB. failing to destroy personal information collected from children under 13 who registered 14 15 or attempted to register with Yelp that is in their possession, custody, or control within 30 days 16 after entry of this Order. Provided, however, that such personal information need not be 17 disposed of, and may be disclosed, to the extent requested by a government agency or required 18 by law, regulation, or court order. 19", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition", "Data Deletion" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $450,000 to the United States within 7 days of entry of this Order.", "verbatim_text": "B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the 4 United States, Four Hundred Fifty Thousand Dollars ($450,000). Such payment must be made 5 within seven (7) days of entry of this Order by electronic fund transfer in accordance with 6 instructions previously provided by a representative of Plaintiff.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "IV", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain acknowledgments of receipt of this Order from itself, from specified personnel for 10 years, and obtain signed acknowledgments from those who receive copies.", "verbatim_text": "A. Defendant, within 7 days of entry of this Order, must submit to the Commission an 21 acknowledgment of receipt of this Order sworn under penalty of perjury.\n\nB. For ten (10) years after entry of this Order, Defendant, must deliver a copy of this Order 23 24 to: (1) all principals, officers, and directors, (2) all employees, agents, and representatives 25 having supervisory responsibilities relating to the collection, retention, storage, or security of 26 personal information from children, if any, or who are responsible for preventing Yelp from 27 collecting information from children; and (3) any business entity resulting from any change in 28 9 STIPULATED ORDER 3:14-CV-4163 Case3:14-cv-04163-JCS Document5 Filed09/16/14 Page10 of 16 1 structure as set forth in the Section titled Compliance Reporting. Delivery must occur within 2 seven (7) days of entry of this Order for current personnel. To all others, delivery must occur 3 before they assume their responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this Order, that 5 Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this 6 Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "V", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit compliance reports to the Commission, including an initial report one year after entry of this Order and notices of changes for 10 years.", "verbatim_text": "A. One year after entry of this Order, Defendant must submit a compliance report, sworn 12 under penalty of perjury. In such report, Defendant must: 13 1. identify the primary physical, postal, and email address and telephone number, as 14 designated points of contact, which representatives of the Commission and Plaintiff may use to 15 16 communicate with Defendant; 17 2. identify any businesses started by Defendant since entry of this Order by all of 18 their names, telephone numbers, and physical, postal, email, and Internet addresses; 19 3. describe the activities of each such business, including the goods and services 20 offered, the means of advertising, marketing, and sales; 21 4. describe in detail whether and how Defendant is in compliance with each Section 22 of this Order; 23 24 5. provide a copy of each different version of any privacy notice posted on each 25 English language Web site or online service operated by Defendant or sent to parents of children 26 that register on each Web site or online service; 27 28 10 STIPULATED ORDER 3:14-CV-4163 Case3:14-cv-04163-JCS Document5 Filed09/16/14 Page11 of 16 1 6. provide a statement setting forth in detail the methods used to obtain verifiable 2 parental consent prior to any collection, use, and/or disclosure of personal information from 3 children or the methods used to avoid collecting, using, and/or disclosing personal information 4 from children; 5 7. provide a statement setting forth in detail the means provided for parents to 6 review the personal information collected from their children and to refuse to permit its further 7 8 use or maintenance; and 9 8. provide a copy of each Order Acknowledgment obtained pursuant to this Order, 10 unless previously submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, Defendant must submit a compliance notice, 12 sworn under penalty of perjury, within 14 days of any change in: (a) any designated point of 13 contact; or (b) the structure of Defendant or any entity that Defendant has any ownership interest 14 in or controls directly or indirectly that may affect compliance obligations arising under this 15 16 Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or 17 affiliate that engages in any acts or practices subject to this Order. 18\n\nC. Defendant must submit to the Commission notice of the filing of any bankruptcy petition, 19 insolvency proceeding, or similar proceeding by or against Defendant within 14 days of its filing.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "VI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain records for 10 years after entry of the Order, including compliance records, user affirmations, consumer complaints, and copies of forms collecting children's personal information.", "verbatim_text": "9 A. all records necessary to demonstrate full compliance with each provision of this Order, 10 including all submissions to the Commission;\n\nB. pursuant to Section II.C of this Order, all affirmations from users that they were under 13 12 at the time of registration; 13\n\nC. copies of all consumer complaints received relating to Defendant’s collection of personal 14 information from children and any responses; and 15\n\n16 D. a copy of each materially different form, page, or screen created, maintained, or 17 otherwise provided by Defendant through which Defendant collects personal information from 18 children, if such information is collected, and a copy of each materially different document 19 containing any representation regarding Defendant’s collection, use, and disclosure practices 20 pertaining to personal information from children. Each Web page copy shall be accompanied by 21 the URL of the Web page where the material was posted online. Electronic copies shall include 22 all text and graphics files, audio scripts, and other computer files used in presenting information 23 24 on the Internet.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "VII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through various means including requesting additional reports, depositions, document production, interviews, and posing as consumers.", "verbatim_text": "1 A. Within 14 days of receipt of a written request from a representative of the Commission or 2 Plaintiff, Defendant must: submit additional compliance reports or other requested information, 3 which must be sworn under penalty of perjury; appear for depositions; and produce documents 4 for inspection and copying. The Commission and Plaintiff are also authorized to obtain 5 discovery, without further leave of court, using any of the procedures prescribed by Federal 6 Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\n8 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 9 communicate directly with Defendant. Defendant must permit representatives of the 10 Commission and Plaintiff to interview any employee or other person affiliated with Defendant 11 who has agreed to such an interview. The person interviewed may have counsel present. 12", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "VIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for 20 purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.14_yelp", "company_name": "Yelp Inc.", "date_issued": "2014-09-15", "year": 2014, "administration": "Obama", "legal_authority": "Sections 13(b), 16(a)(1), and 19 of the Federal Trade Commission Act, 15 U.S.C. §§ 53(b), 56(a)(1), and 57b; Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d); and the Commission's Children's Online Privacy Protection Rule, 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/132-3066-yelp-inc", "docket_number": "3:14-CV-4163" }, { "provision_number": "I", "title": "Injunction Concerning Designating Content on the YouTube Service as Directed to Children", "category": "affirmative_obligation", "summary": "Defendants are permanently enjoined from failing to develop and maintain a system for Channel Owners to designate content as directed to Children, and from failing to provide annual COPPA training for personnel managing Channel Owner relationships.", "verbatim_text": "A. Failing to develop, implement, and maintain a system for Channel Owners to designate whether their Content on the YouTube Service is directed to Children. Such system 10 Case 1:19-cv-02642-BAH Document 5 Filed 09/10/19 Page 11 of 32 shall include a Clear and Conspicuous notice that Content made available on the Y ouTube Service that is directed to Children may be subject to the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A) and that Channel Owners are obligated to designate such Content as directed to Children; and\n\nB. Failing to provide annual training regarding complying with the Children's Online Privacy Protection Rule, 16 C.F .R. Part 312 ( attached as Appendix A), for each Person responsible for managing Defendants' relationships with Channel Owners on the You Tube Service.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "II", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently enjoined from failing to provide direct notice to parents, failing to post a prominent privacy notice link, failing to obtain verifiable parental consent, and from violating the COPPA Rule, in connection with operating a Website or Online Service Directed to Children on the YouTube Service.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available technology, to ensure that a Parent of a Child receives direct notice of Defendants' practices with regard to the Collection, use, or Disclosure of Personal Information from Children, including notice of any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented, unless the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to providing such notice;\n\nB. Failing to post a prominent and clearly labeled link to an online notice of its infonnation practices with regard to Children on the home or landing page or screen of its 11 Case 1:19-cv-02642-BAH Document 5 Filed 09/10/19 Page 12 of 32 website or online service, and at each area of the website or online service where Personal Info1mation is Collected from Children, unless the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to providing such notice;\n\nC. Failing to Obtain Verifiable Parental Consent before any Collection, use, or Disclosure of Personal Information from Children, including consent to any material change in the Collection, use, or Disclosure practices to which the Parent has previously consented, unless the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to Obtaining Verifiable Parental Consent; and\n\nD. Violating the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "III", "title": "Injunction Concerning Use of Previously Collected Personal Information", "category": "prohibition", "summary": "Defendants must refrain from disclosing, using, or benefitting from Personal Information previously collected from users of Content designated as directed to Children, within 90 days of the Compliance Date, with an exception for government-required disclosures.", "verbatim_text": "TT IS FURTHER ORDERED that Defendants, Defendants' officers, agents, employees, and attorneys, and all other Persons in active concert or participation with any of them, who receive actual notice of this Order, are ordered to refrain, within ninety (90) days of the Compliance Date, from Disclosing, using, or benefitting from Personal Information previously Collected from users of Content that is designated as directed to Children by a Channel Owner under the system required under Section I.A. above, as long as such designation occurs within sixty (60) days of the Compliance Date. Provided, however, that such Personal lnfonnation may be Disclosed to the extent requested by a government agency or required by law, regulation, or court order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "IV", "title": "Civil Penalty and Other Monetary Relief", "category": "affirmative_obligation", "summary": "Defendants are ordered to pay $136,000,000 to the FTC and $34,000,000 to the State of New York as civil penalties and damages, both within 30 days of entry of this Order.", "verbatim_text": "A. Judgment in the amount of one hundred and thirty six million dollars ($136,000,000) is entered in favor of Plaintiff FTC against Defendants, jointly and severally, as a civil penalty.\n\nB. Defendants are ordered to pay to Plaintiff FTC one hundred thirty six million dollars ($136,000,000), which, as Defendants stipulate, their undersigned counsel holds in escrow for no purpose other than payment to the Commission. Such payment must be made within thirty (30) days of entry of this Order by electronic fund transfer in accordance with instructions previously provided by a representative of the Commission.\n\nC. Judgment in the amount of thirty four million dollars ($34,000,000) is entered in favor of Plaintiff State of New York against Defendants,jointly and severally, as damages, restitution, or other compensation to its residents.\n\nD. Defendants are ordered to pay to Plaintiff State ofNew York, by making payment to State of New York Department of Law, thirty four million dollars ($34,000,000). Such payment must be made within thirty (30) days of entry of this Order by wire transfer in accordance with instructions provided by a representative of Plaintiff State of New York.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "V", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendants relinquish all rights to transferred assets, agree that Complaint facts may be used in future proceedings, and must submit their Taxpayer Identification Numbers to the Commission.", "verbatim_text": "A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all assets transferred pursuant to this Order and may not seek the return of any assets.\n\nB. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Commission or the State of New York in a proceeding to enforce its rights to any payment or monetary judgment pursuant to this Order.\n\nC. The facts alleged in the Complaint establish all elements necessary to sustain an action by the Commission or the State of New York pursuant to Section 523(a)(2)(A) of the Banlauptcy Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel effect for such purposes.\n\nD. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants must submit to the Commission, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "VI", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendants must submit sworn acknowledgments of receipt of the Order, deliver copies to key personnel, and obtain signed acknowledgments within specified timeframes.", "verbatim_text": "A. Each Defendant, within seven (7) days of entry of this Order, must submit to the Commission and the State of New York an acknowledgment ofreceipt of this Order sworn under penalty of perjury.\n\nB. For five (5) years after entry of this Order, each Defendant must deliver a copy of this Order to: ( 1) all principals, officers, directors, and LLC managers and members; (2) all employees, agents, and representatives who have supervisory responsibilities relating to the subject matter of Sections I and II of this Order; and (3) any business entity resulting from any change in structure as set forth in the Section titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.\n\nC. From each individual or entity to which a Defendant delivered a copy of this Order, that Defendant must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "VII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit an annual compliance report one year after the Compliance Date, timely notices of structural or contact changes for 10 years, bankruptcy notices within 14 days, and all sworn submissions must comply with specific formatting and delivery requirements.", "verbatim_text": "A. One year after the Compliance Date, each Defendant must submit a compliance report, sworn under penalty of perjury. In such report, each Defendant must: 1. Identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and the State of New York may use to communicate with that Defendant; 2. Identify all of Defendant's businesses involved in operating the YouTube Service or in Collecting, using, or Disclosing Personal Information from Children on or from the Y ouTube Service by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; 3. Describe the activities of each such business directly involved with operating the Y ouTube Service, including the goods and services offered and the means of advertising, marketing, and sales; 4. Describe in detail whether and how Defendants are in compliance with each Section of this Order; 5. Provide a copy of each materially different version of any privacy notice posted on or otherwise applicable to the Y ouTube Service or sent to users of the Y ouTube Service; 15 Case 1:19-cv-02642-BAH Document 5 Filed 09/10/19 Page 16 of 32 6. Describe in detail the methods used, if any, to track Child users.of the YouTube Service (including methods used for passive tracking and means for users to control or opt out of tracking), and the measures taken to avoid tracking Children; 7. Describe in detail the methods used to Obtain Verifiable Parental Consent prior to any Collection, use, and/or Disclosure of Personal Information from Children through the Y ouTube Service; 8. Describe in detail the means provided for Parents to review the Personal Information Collected from their Children through the YouTube Service and to refuse to permit its furthe1; use or maintenance; and 9. Provide a copy of each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, each Defendant must submit a compliance notice, sworn under penalty of perjury, within fourteen ( 14) days of any change in: ( 1) any designated point of contact; or (2) the structure of that Defendant or any entity that Defendant has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.\n\nC. Each Defendant must submit to the Commission and the State of New York notice of the filing of any banlauptcy petition, insolvency proceeding, or similar proceeding by or against such Defendant within fourteen (14) days of its filing.\n\nD. Any submission to the Commission and the State of New York required by this Order to be sworn under penalty of pe1jury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: \"I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: __\" and supplying the date, signatory's full name, title (if applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania A venue NW, Washington, DC 20580. The subject line must begin: FTC v. Google LLC and YouTube, LLC, FTC File No. I 723083.\n\nF. Unless otherwise directed by a State of New York representative in writing, all submissions to the State of New York pursuant to this Order must be emailed to ifraud@ag.ny.gov and sent by overnight courier (not the U.S. Postal Service) to: Bureau Chief, Bureau oflnternet and Technology, New York State Attorney General's Office, 28 Liberty Street, New York, New York 10005. The subject line must begin: FTC v. Google LLC and YouTube, LLC, FTC File No. 1723083.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "VIII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create specified records for ten years after entry of the Order and retain each record for five years, covering accounting, personnel, compliance, consumer complaints, privacy forms, and advertising materials related to the YouTube Service.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants must create certain records for ten (10) years after entry of the Order, and retain each such record for five (5) years. Specifically, each Defendant in connection with operating the YouTube Service must create and retain the following records: A. Accounting records showing the revenues of all goods and services sold;\n\nB. Personnel records showing, for each Person providing services, whether as an employee or otherwise, that Person's: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination;\n\nC. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission and the State of New York;\n\nD. Records of all consumer complaints relating to the unauthorized Collection, use or Disclosure of Personal Information of Children interacting with the You Tube Service, and any response;\n\nE. A copy of each materially different form, page, or screen created, maintained, or otherwise provided by each Defendant through which Personal Information of Children is Collected through the YouTube Service, and a copy of each materially different document containing any representation regarding Collection, use, and Disclosure practices pertaining to Personal Information from Children Collected through the YouTube Service. Each webpage copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting infonnation on the Internet; and\n\nF. A copy of each unique advertisement, other marketing material, telemarketing script, or other representation related to the Collection of Personal Information of Children that is made in connection with promoting or offering for sale the Y ouTube Service.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "IX", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and State of New York are authorized to monitor Defendants' compliance through document requests, depositions, discovery, direct communications, employee interviews, and undercover investigation, with Defendants required to respond within 14 days of written requests.", "verbatim_text": "A. Within fourteen (14) days ofreceipt of a written request from a representative of the Commission or the State of New York, each Defendant must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying. The Commission and the State of New York are also authorized to obtain discovery, without further leave of court, using any of the procedures prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and the State of New York are authorized to communicate directly with each Defendant. Each Defendant must pern1it representatives of the Commission and the State of New York to interview any employee or other Person affiliated with Defendant who has agreed to such an interview. The Person interviewed may have counsel present.\n\nC. The Commission and the State of New York may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Defendants or any individual or entity affiliated with Defendants, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b- 1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "X", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "09.19_google_llc_and_youtube", "company_name": "Google LLC and YouTube, LLC", "date_issued": "2019-09-15", "year": 2019, "administration": "Trump (1st)", "legal_authority": "Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a)(1) of the Federal Trade Commission Act, 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)(1), and Sections 1303(c), 1305(a)(1), and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c), 6504(a)(1), and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/172-3083-google-llc-youtube-llc", "docket_number": "1:19-cv-02642" }, { "provision_number": "6-7", "title": "Injunction Against COPPA Rule Violations and Privacy Policy Misrepresentations", "category": "prohibition", "summary": "Defendant and all persons acting in concert with it are permanently enjoined from violating any provision of the COPPA Rule and from failing to comply with any representations made in privacy policies about the collection, use, or disclosure of children's personal information.", "verbatim_text": "6. Defendant, its successors and assigns, and its officers, agents, servants, employees and attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 2 OF 11 enjoined from violating, directly or through any corporation, subsidiary, division, website, or other device, any provision of the Rule. A copy of the current Rule is attached hereto as “Appendix A” and incorporated herein as if fully set forth verbatim.\n\n7. Defendant, its successors and assigns, and its officers, agents, servants, employees and attorneys, and all persons in active concert or participation with any one or more of them who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined, in connection with the operation of any website or other online service, from failing to comply with any representation, in the website's privacy policy or elsewhere, about the website's collection, use or disclosure of children’s personal information, or about the website's procedures to maintain the confidentiality, security, or integrity of children’s personal information.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "8", "title": "Consumer Education Remedy — FTC KidzPrivacy Notice", "category": "affirmative_obligation", "summary": "For five years from entry of the Consent Decree, defendant must place a clear and conspicuous bold-typeface hyperlink notice pointing to www.ftc.gov/kidzprivacy in both its posted website privacy policy and its direct privacy notices sent to parents.", "verbatim_text": "8. For a period of five (5) years from the date of entry of this Consent Decree, defendant, and its successors and assigns, shall place a clear and conspicuous notice (1) within the privacy policy required to be posted on its website(s) by Section 312.4(b) of the Rule, 16 C.F.R. § 312.4(b); and (2) within the direct privacy notice required to be sent to parents by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c); which states as follows in bold typeface: NOTICE: Visit www.ftc.gov/kidzprivacy for information from the Federal Trade Commission about protecting children’s privacy online. The above notice shall be in the form of a hyperlink to http://www.ftc.gov/kidzprivacy. The Federal Trade Commission may change the hyperlink/URL upon thirty (30) days prior written notice to defendant, its successors or assigns.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "9-11", "title": "Civil Penalty — $30,000 Payment", "category": "affirmative_obligation", "summary": "Defendant must pay a $30,000 civil penalty by certified or cashier's check on the date of entry of the Consent Decree; default triggers accrual of interest on the unpaid balance.", "verbatim_text": "9. Defendant shall pay to plaintiff a civil penalty, pursuant to Section 5(m)(1)(A) of the Federal Trade Commission Act, 15 U.S.C. § 45(m)(1)(A), in the amount of Thirty thousand dollars ($30,000).\n\n10. Defendant shall make the payment required by Paragraph 9 on the date of entry of this Consent Decree by certified or cashier’s check made payable to the Treasurer of the United States and delivered to: the Office of Consumer Litigation, Civil Division, U.S. Department of Justice, Washington, D.C. 20530, for appropriate disposition.\n\n11. In the event of any default in payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. § 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "12", "title": "Deletion of Unlawfully Collected Children's Personal Information", "category": "affirmative_obligation", "summary": "Within ten days of entry, defendant must delete all personal information collected from children without parental authorization through www.lisafrank.com and shop.lisafrank.com from April 21, 2000 through the date of entry.", "verbatim_text": "12. Defendant, and its successors and assigns, within ten (10) days of the date of entry of this Consent Decree, shall delete all personal information collected from children without their parent’s authorization through www.lisafrank.com and shop.lisafrank.com at any time from April 21, 2000 through the date of entry of this Consent Decree.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "13", "title": "Initial Distribution of Consent Decree and Compliance Guide (Current Personnel)", "category": "acknowledgment", "summary": "Within thirty days of entry, defendant must provide copies of the Consent Decree and FTC compliance guide to all current principals, officers, directors, managers, and relevant employees/agents, obtain signed acknowledgments, and submit a compliance statement to the Commission within ten days thereafter.", "verbatim_text": "13. Defendant, and its successors and assigns, within thirty (30) days of the date of entry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How to Comply with the Children’s Online Privacy Protection Rule (Nov. 1999) (“compliance guide”) (attached hereto as “Appendix B”) to each of CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 4 OF 11 its current principals, officers, directors, and managers, and to all current employees, agents, representatives, and attorneys having responsibilities related to the subject matter of this Consent Decree, secure from each such person a signed statement acknowledging receipt of a copy of this\n\nConsent Decree and the compliance guide, and shall, within ten (10) days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of defendant’s compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "14", "title": "Ongoing Distribution of Consent Decree and Compliance Guide (Future Personnel)", "category": "acknowledgment", "summary": "For three years after entry, defendant must provide copies of the Consent Decree and compliance guide to future principals, officers, directors, managers, and relevant employees/agents within thirty days of them assuming their position, obtain signed acknowledgments, and retain those records.", "verbatim_text": "14. Defendant, and its successors and assigns, shall, for a period of three (3) years after the entry of this Consent Decree, provide a copy of this Consent Decree and the compliance guide to each of its future principals, officers, directors, and managers, and to all future employees, agents, representatives, and attorneys having responsibilities related to the subject matter of this Consent Decree, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or responsibilities. Defendant shall maintain copies of the signed statements, as well as other information regarding the fact and manner of its compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Federal Trade Commission. Provided that, compliance with this paragraph will not be required during any period of time when defendant does not operate any web site or online service.\n\n(30) days after the person assumes such position or responsibilities. Defendant shall maintain copies of the signed statements, as well as other information regarding the fact and manner of its compliance, including the name and title of each person to whom a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Federal Trade Commission. Provided that, compliance with this paragraph will not be required during any period of time when defendant does not operate any web site or online service.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "15", "title": "Compliance Reporting to the Commission", "category": "compliance_reporting", "summary": "Within 120 days of entry and at such other times as the FTC requires, defendant must file a detailed written compliance report covering privacy notices, parental consent procedures, information collection practices, and data security procedures.", "verbatim_text": "15. Within one hundred and twenty (120) days after entry of this Consent Decree, and CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 5 OF 11 at such other times as the Federal Trade Commission may require, defendant, and its successors and assigns, shall file with the Commission a written report, setting forth in detail the manner and form in which it has complied and is complying with this Consent Decree. This report shall include but not be limited to:\n\na. a copy of each different privacy notice on any of its websites that are subject to the Rule; b. a statement setting forth in detail each place where the privacy notice on the website is located and a copy of each screen or page on which the website collects personal information; c. a copy of each different privacy notice to parents; d. a statement setting forth in detail when and how notices to parents are provided; e. a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children; f. a statement setting forth in detail the means provided for parents to review the personal information collected from their children and to refuse to permit its further use or maintenance; g. a statement setting forth in detail why each type of information collected is reasonably necessary for the provision of the particular related activity; and CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 6 OF 11 h. a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "16", "title": "Recordkeeping", "category": "recordkeeping", "summary": "For five years after entry, defendant must maintain and make available to the FTC within fifteen days of request print or electronic copies (in HTML format) of all documents demonstrating compliance, including information collection forms, web pages, and representations about data practices.", "verbatim_text": "16. Defendant, and its successors and assigns, shall, for a period of five (5) years after entry of this Consent Decree, maintain and make available to the Federal Trade Commission for inspection and copying within fifteen (15) days of the date of receipt of a written request, a print or electronic copy in HTML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, a sample copy of every information collection form, web page, or screen, and a sample copy of each document containing any representation regarding defendant’s collection, use, and disclosure practices pertaining to personal information. Each web page copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet. Provided, however, that defendant shall not be required by this paragraph to retain a document for longer than three years after the document is created; or retain a print or electronic copy of any amended web page or screen to the extent that the amendment does not affect defendant’s compliance obligations under this Consent Decree.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "17", "title": "Notice of Business Changes", "category": "compliance_reporting", "summary": "Defendant must notify the FTC at least thirty days before any business change that may affect compliance obligations under the Consent Decree, including mergers, dissolutions, bankruptcy filings, and name or address changes.", "verbatim_text": "17. Defendant Lisa Frank, Inc., and its successors and assigns, shall notify the Commission at least thirty (30) days prior to any change in its business that may affect compliance obligations arising under this Consent Decree, including, but not limited to, any merger, incorporation, dissolution, assignment, sale or other action that would result in the CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 7 OF 11 emergence of a successor corporation; the creation or dissolution of a subsidiary, parent, or affiliate; the proposed filing of a bankruptcy petition; or a change in the corporate name or address. Provided, however, that with respect to any proposed change in the corporation about which defendant, its successors and assigns, learns less than thirty (30) days prior to the date such action is to take place, it shall notify the Commission as soon as is practicable after obtaining such knowledge.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "18", "title": "Taxpayer Identifying Number Disclosure", "category": "affirmative_obligation", "summary": "Defendant must furnish its taxpayer identifying number to the FTC in accordance with 31 U.S.C. § 7701 for purposes of collecting and reporting on any delinquent amounts.", "verbatim_text": "18. Defendant Lisa Frank, Inc. is hereby required, in accordance with 31 U.S.C. § 7701, to furnish to the Federal Trade Commission its taxpayer identifying number (social security number or employer identification number), which shall be used for purposes of collecting and reporting on any delinquent amount arising out of its relationship with the government.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "19", "title": "Address for Reports and Notices", "category": "compliance_reporting", "summary": "All reports, submissions, and notices required by Paragraphs 13–18 must be sent by certified mail to the Associate Director, Division of Advertising Practices, Bureau of Consumer Protection, FTC.", "verbatim_text": "19. All reports, submissions, and notices required by Paragraphs 13 - 18 of this Consent Decree shall be sent by certified mail to: Associate Director, Division of Advertising Practices Bureau of Consumer Protection Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Attention: United States v. Lisa Frank, Inc.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "20", "title": "Continuing Jurisdiction", "category": "monitoring", "summary": "The Court retains jurisdiction over this matter to issue further orders for interpretation, modification, enforcement of compliance, or punishment of violations.", "verbatim_text": "20. This Court shall retain jurisdiction of this matter for the purposes of enabling any of the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this CONSENT DECREE AND ORDER FOR CIVIL PENALTIES, INJUNCTIVE, AND OTHER RELIEF, PAGE 8 OF 11 Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "unfair", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.01_frank_lisa", "company_name": "Lisa Frank, Inc.", "date_issued": "2001-10-15", "year": 2001, "administration": "G.W. Bush", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, §§ 6502(c), 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/012-3050-frank-lisa-inc", "docket_number": "Civil Action No. _______________" }, { "provision_number": "8", "title": "Injunction – COPPA Rule Compliance", "category": "prohibition", "summary": "Defendant and all persons acting in concert with it are permanently enjoined from failing to provide required notices to parents, failing to obtain verifiable parental consent before collecting children's personal information, and from violating any provision of the COPPA Rule.", "verbatim_text": "8. Defendant, and its officers agents, servants, reprrsentatives, and employees. and all persons in active concert or participation with it who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined, directly or through any corporation, subsidiary, division, website, or other device, Srorn: a. Failing to provide sufficient notice on any wcbsite or other online service directed to children, or through which it, with actual knowledge, collects, uses, and/or discloses personal information from children, of what information Defendant collects online from children, how it uses such information, its disclosure practices, and all other rcquired contcnt, as 5 required by Section 312.4(b) of the Rule, 16 C.F.R. 3 12.4(b);\n\nb. Failing to provide direct notice to parents of what inhrmation Defendant collects online from children, how it uses such information, its disclosure practices, and all other required content, as required by Section 3 12.4(c) of the Rule, 16 C.F.R. $ 3 12.4(c);\n\nc. Failing to obtain verifiable parental consent before any collection, use, and/or disclosure of personal information tiom children, as required by 5 Section 312.5 of the Rule, 16 C.F.R. 312.5(a)(l); or,\n\nd. Violating any other provision of the Children's Online Privacy Prolectiun Rule, 16 C.F.R. Part 312, and as the Rule may hercafter be amended. A copy of the Rule is attached hereto as \"Appendix A\" and incorporated herein as if fully set forth verbatim.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "9", "title": "Injunction – No Misrepresentations About Children's Data Practices", "category": "prohibition", "summary": "Defendant is enjoined from making any misrepresentation in any website's privacy policy or elsewhere about the website's collection, use, disclosure, or deletion of children's personal information.", "verbatim_text": "9. Defendant, and its officers, agents, servants, representatives, and employees, and all persons in active concert or participation with it who receive actual notice of this Consent Decree by personal service or otherwise, are hereby enjoined. directly or through any corporation, subsidiary, division, website, or other device, in connection with the Case 1:09-cv-08864-MGC Document 2 Filed 11/05/2009 Page 4 of 66 operation of any website or other online service, from making any misrepresentation in the website's privacy policy or elsewhere about the website's collection, use, disclosure, or deletion of children's personal information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "10", "title": "Consumer Education Remedy – OnGuardOnline Notice", "category": "affirmative_obligation", "summary": "For five years, Defendant must place a clear and conspicuous FTC OnGuardOnline.gov notice in its privacy policy, direct parent notices, and at each personal information collection point on websites directed to children or where children's data is collected.", "verbatim_text": "10. For a period of five (5) years from the date of entry of this Consent Decree, Defendant, in connection with the operation of any website or other online service directed to children or through nhich it, with actual knowledge, collects, uses, andlor discloses personal information from children, or that offers users the opportunity to upload writings or images, to create user profiles that can publicly be viewed, or to interact online with other visitors to Defendant's websites shall place 3 clear and conspicuous nolice (I) within the privacy policy required to be posted on its website(s) by Section 3 12.4(b) of the Rule, I6 C.F.R. § 3 12.4(b); (2) within the direct notice required to be sent to parents by Section 3 12.4(c) of the Rule, 16 C.F.R. $ 3 12.4(c); and (3) at each location on its ueSsite(s) where personal information is collected, which states as follows in bold typeface: NOTICE: Visit www.OnGuardOnline.gov for tips from the Federal Trade Commission on protecting kids' privacy online [\"www.OnguardOnline.gov\" must contain a hyperlink to htt~:l/www.oneuardonIine,~ov/topics/kids-privacv.as~x] Defendant shall be required to change the hyperlinksKJRLs within fifteen (15) days after receipt of notice from the Federal Trade Commission of a change to such hyperlinksIURLs.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "11", "title": "Civil Penalty Payment", "category": "affirmative_obligation", "summary": "Defendant must pay a $250,000 civil penalty to the United States within five days of entry of this Consent Decree, via electronic fund transfer.", "verbatim_text": "11. Defendant shall pay to Plaintiffa civil penalty, pirrsuant to Section 5(m)(l)(A) of the FTC Act, I5 U.S.C. 45(m)(l)(A), in the amount of two hundred and fifty thousand ($250,000) due and payable within five (5) days following enrry ofthis Consent Decree. Unless othenvise direcred, payment shall be made by electronic fund transfer in Page 4 of 13 Case 1:09-cv-08864-MGC Document 2 Filed 11/05/2009 Page 5 of 66 accordance with procedures specified by the Ol'lice of Consumer Litigation, Civil Division, U.S. Department ofJustice, U'ashington, DC 20530.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "12", "title": "Default on Civil Penalty Payment", "category": "affirmative_obligation", "summary": "If Defendant defaults on payment for more than ten days beyond the due date, the full unpaid penalty plus statutory interest becomes immediately due and payable.", "verbatim_text": "12. In the event of any dcfault payment, which default continues for ten (10) days beyond the due date of payment, the entire unpaid penalty, together with interest, as computed pursuant to 28 U.S.C. 5 1961, from the date of default to the date of payment, shall immediately become due and payable.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "13", "title": "Relinquishment of Funds Paid", "category": "affirmative_obligation", "summary": "Defendant relinquishes all dominion, control, and title to the funds paid and must make no claim to or demand return of those funds.", "verbatim_text": "13. Defendant relinquishes all dominion, control, and title to the funds paid to the fullest extent permitted by law. Defendant shall make no claim to or demand return of the funds, directly or indirectly, through counsel or otherwise.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "14", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected in violation of the COPPA Rule from April 21, 2000 through the date of entry of the Consent Decree within five days of entry.", "verbatim_text": "14. Defendant, within five (5) days from the date of entry- of this Consent Decree, shall delete all personal information collected and maintained in violation of the Rule at any time from April 21, 2000 through the date of entry of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "15", "title": "Distribution of Order and Compliance Guide – Current Personnel", "category": "acknowledgment", "summary": "Within 30 days of entry, Defendant must distribute the Consent Decree and COPPA compliance guide to all current officers, directors, managers, and relevant employees and agents, obtain signed acknowledgments, and submit a compliance statement to the Commission within 10 days thereafter.", "verbatim_text": "15. Defendant, within thirty (30) days from the date ofentry of this Consent Decree, shall provide a copy of this Consent Decree and the Federal Trade Commission compliance guide entitled How lo Conlply with rhe Children's Online Privacy Prolection Rule (Nov. 1999) (\"compliance guide\") (attached hercto as \"Appendix B\") to: (I) all of its officers. directors, and managers; (2) all of its employees, agents, and representatives who engage in conduct related to the operation of any website or online service subject to this Consent Decree; and (3) any business entity resulting from any change in structure set forth in Subsection a, of the Section titled \"Compliance Reporting by Defendant\"; and secure from each such person a signed statement acknowledging receipt of a copy of this\n\nConsent Decree and the compliance guide. Defendant shall, within ten (I 0)days of complying with this paragraph, submit to the Commission a signed statement setting forth the fact and manner of its compliance, including the name and title of each person Page 5 of 13 Case 1:09-cv-08864-MGC Document 2 Filed 11/05/2009 Page 6 of 66 to ~vl~oam c opy ulrhe Conscnt Dccree and compliance guide has been provided.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "16", "title": "Distribution of Order and Compliance Guide – Future Personnel", "category": "acknowledgment", "summary": "For five years, Defendant must provide the Consent Decree and compliance guide to all future officers, directors, managers, and relevant employees and agents within 30 days of them assuming their positions, obtain signed acknowledgments, and maintain those records available to the Commission on request.", "verbatim_text": "16. Defendant: fur a period of fivc (5) years from the date of entry of this Consent Decree, shall provide a copy or this Consent Dccree and the compliance guide to each of its hture officers and directors; and to all managers and future employees, agents, and representatives haviug responsibilities related to the operation of any website or online sen~icesubject to this Consent Decree, and secure from each such person a signed and dated statement acknowledging receipt of a copy of this Consent Decree and the compliance guide, within thirty (30) days after the person assumes such position or rcsponsibilities. Defendant shall maintain copies oi'the signed statements, as well as\n\nrcsponsibilities. Defendant shall maintain copies oi'the signed statements, as well as other information regarding the fact and manner of its compliance. including the name and title of each person to whorn a copy of the Consent Decree and compliance guide has been provided and, upon request, shall make the statements and other information available to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "17", "title": "Compliance Reporting by Defendant", "category": "compliance_reporting", "summary": "For three years, Defendant must notify the Commission at least 30 days before any corporate structure changes; for five years, Defendant must submit annual sworn written compliance reports to the FTC starting 60 days after entry; and Defendant must notify the Commission within 15 days of any bankruptcy filing.", "verbatim_text": "a. For a period of three (3) years from the date of cntry of this Consent Decree, Defendant shall noti* the Commission of any changes in corporate structure or of any changes in any business entity that Defendant directly or indirectly controls, or has an ownership interest in. that may affect compliance obligations arising under this Order, including but not limited to: incorporation or other organization; a dissolution, assignment, sale, merger, or other action; the creation or dissolution of a subsidiar)., parent, or affiliate that engages in any acts or practices subject to this Order; or a change in the business name or address. at least thirty (30) days prior to such change,provided that, with respect to any proposed change in the business entity about which Defendant learns less than thirty (30) days prior to the date such action is to take place, Defendant shall Case 1:09-cv-08864-MGC Document 2 Filed 11/05/2009 Page 7 of 66 notify the Commission as soon as is practicable after obtaining such knowledge.\n\nb. Sixty (60) days after the date ofentry of this Order, and annually thereafter for a period of five (5) years. Defendant shall provide a written report to the FTC, which is true and accurate and sworn to under penalty of perjury, setting forth in detail the manner and form in which it has complied and is complying with this Order. This report shall include, but not be limited to: a statement setting forth in detail the criteria and process through which I. any of its websites register visitors online for any activity requiring the submission of personal infomiation, and a copy of each different version of screen or page providing or collecting registration information; . . a copy of each different version of' privacy notice posted on any of its 11. websites; ... a statement setting forth in detail each place where the privacy notice on 111. any website is located and a copy of each different version of screen or page on which the website collects personal information; iv, a copy of each different version of privacy notice sent Lo parents; v. a statement setting forth in detail when and how each notice to parents is provided; vi. a statement setting forth in detail the methods used to obtain verifiable parental consent prior to any collection, use, andlor disclosure of personal information from children; Page 7 of 13 Case 1:09-cv-08864-MGC Document 2 Filed 11/05/2009 Page 8 of 66 vii, a statement setting fbrth in detail tne means provided for parcnts to revie* thc personal information collected fiom their children and to refuse to permit its further use or maintenance; viii. a statement setting forth in detail why each type of information collected tiom a child is reasonably necessary for the provision of the particular relaled activity; ix. a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children; x. A copy of' each acknowledgmenl of receipt of this Ordcr, obtained pursuant to the Section titled \"Distribution of Order;\" and xi. Any other changes required to be reported under Subsection a, of this Section.\n\nc. Defendant shall notify the Commission of the filing of a ba~kruptcyp etition within fifteen (15) days of filing.\n\nd. For [he purposes of this Consent Decree, Defendant shall, unless otherwise directed by the Commission's authorized representatives, send by overnight courier all reports and notifications required by this Consent Decree to the Con~missiont,o the following addrcss: Associate Director for Enforcement Federal Trade Commission 600 Pennsylvania Avenue. N.W., Room NJ-2122 Washington, D.C. 20580 RE: U S v Iconix Brand Group, Inc. Provided that, in lieu of overnight courier, Defendant may send such rcports or notifications hy first-class mail, but only if it contemporaneously sends an electronic version of such report or notification to the Commission at: DERrief@,ftc.gov.\n\ne. For purposes of the compliance reptifling and monitoring required by this Consent Decree; the Commission is authorized to cornmunicate directly with Defendant. Defendant may request to have counsel present. Provided, however, that nothing in this provision shall limit the Commission's authority to pose as a consumer.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "18", "title": "Recordkeeping", "category": "recordkeeping", "summary": "For three years from entry, Defendant must create and retain specified records demonstrating compliance with this Consent Decree, including acknowledgments, reports, sample web pages, and representations about children's data practices, with individual documents retained for at least two years from creation.", "verbatim_text": "18. For a period of thrcc (3) years from the date of entry ofthis Consent Dccrec, Defendant, and its agents, employees, officers, corporations, and those persons in active concert or participation with them who receive actual notice ofthis Consent Decree by personal service or otherwise, are hereby restrained and cnjoined from failing to create and retain the following records: a print or electronic copy in iI'I-ML format of all documents demonstrating compliance with the terms and provisions of this Consent Decree, including, but not limited to, copies of acknowledgments of receipt of this Conscnt Decree; all reports submitted to the Commission pursuant to this Consent Dccrce: a sample copy of every materially different form, web page, or screen through which personal information is collected; and a sample copy of each materially different document containing any representation regarding Defendant's collection, use, and disclosure practices pertaining to personal information of a child. Each web page copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics liles, audio scripts, and othcr computer files used in presenting information on the Internet. Provided,however, that Defendant shall not be required to retain any document for longer than two (2) years after the document was created, or to retain a print or electronic copy of any amended web page or screen to the extent that the aniendment does nor affect Defendant's compliance obligations under this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "19", "title": "Inspection and Copying of Records", "category": "monitoring", "summary": "Defendant must make all required records available to the FTC for inspection and copying within 14 days of receiving a written request.", "verbatim_text": "19. Defendant, and its agents. employees, officers, corporations, and those persons in active concert or participation with them wllo receive actual notice of this Consent Dccree by personal service or othenvise, shall make available to the Federal Trade Commission for inspcction and copying within fourteen (14) days of the date of receipt of a written request, all documents required to be maintained pursuant to Paragraph 18 of this Consent Decree.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "20", "title": "Provision of Taxpayer Identifying Number", "category": "affirmative_obligation", "summary": "Defendant must furnish its taxpayer identifying number (employer identification number) to the FTC in accordance with 31 U.S.C. § 7701 for use in collecting and reporting any delinquent amounts.", "verbatim_text": "20. Defendant is hereby required, in accordance with 31 U.S.C. 5 7701, to furnish to the Fcderal Trade Comn~issionit s taxpayer identifying number (employer identification number), which shall be used for purposes of collecting and reporting any delinquent amount arising out of its relationship with the government.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "21", "title": "Continuing Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter indefinitely for the purposes of interpretation, modification, enforcement, and punishment of violations of this Consent Decree.", "verbatim_text": "21. This Court shall retain jurisdiction of this matter for the purposes of enabling the parties to this Consent Decree to apply to the Court at any time for such further orders or directives as may be necessary or appropriate for the interpretation or modification of this Consent Decree, for the enforcement of compliance therewith, or for the punishment of violations thereof.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.09_iconix_brand_group", "company_name": "Iconix Brand Group, Inc.", "date_issued": "2009-10-15", "year": 2009, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), 16(a) and 19 of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), 56(a) and 57(b)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/iconix-brand-group-inc", "docket_number": "09 Civ. 8864 (MGC)" }, { "provision_number": "II", "title": "Injunction Against COPPA Violations", "category": "prohibition", "summary": "Defendant is permanently enjoined from violating COPPA requirements, including failing to provide parental notice, failing to obtain verifiable parental consent, making misrepresentations about data practices, and violating any provision of the Children's Online Privacy Protection Rule.", "verbatim_text": "A. Failing to provide direct notice to parents of\\vhat information Defendant-collects online from children, how it uses such infoffi1ation, its disclosure practices, and all other required content, in com1ection with any website or online service that is directed to children. or any website or online service through which Defendant, \\';ith actual knovdedge. collects, uses, and/or discloses personal information from children, as required by Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c);\n\nB. Failing to obtain verifiable parental consent before any collection, use. andlor disclosure of personal infoJ111ation from children, in connection \\\\ith any website or online service ov-;ned. operated, Of managed by or on behalf of Defendant tbat is directed to children. Of on any website or online service through which Defendant, with actual lmowledge. collects, uses, and/or discloses personal information from children. as required by Section 312.5 of the Rule, 16 C.F.R. § 312.5{a)(l); and\n\nC. Violating any other provision of the Rule, 16 C.F.R. Part 312, and as the Rule may hereaf1er be amended. A copy of the Rule is attached to this Order as \"Appendix A\" and incorporated in this Order as if fully set forth verbatim.\n\n14. IT IS FURTHER ORDERED that Defendant and its officers. agents, representatives. and employees. and all persons in active conce11 or participation with it who receive actual notice of this Order by personal service or otherwise, are hereby enjoined, directly or through any corporation, subsidiary, division. website. or other device. in connection with Defendant's operation of any website or online service. from making any misrepresentation in its parental riotices. privacy policies, or elsewhere about the website or online service's collection, use, disclosure. or deletion of children's personal information.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "III", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected and maintained in violation of the Rule from April 21, 2000 through the date of order entry.", "verbatim_text": "15. IT IS FURTHER ORDERED that Defendant \\\\'ithin ten days from the date of entry of this Order, shall delete all personal information collected and maintained, within its possession, custody, or contro!' in \\'iolalion of the Rule at any time from April 21, :2000 through the date of entry of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "IV", "title": "Consumer Education Remedy", "category": "affirmative_obligation", "summary": "For five years, Defendant must place a clear and conspicuous notice in privacy policies, parental notices, and at data collection points directing users to FTC resources on protecting kids' privacy online.", "verbatim_text": "16. IT IS FURTHER ORDERED that for a period of five years from the date of entry of this Order. Defendant, in connection \\\",i1h its operation of any website or online service directed to children, and any website or online service through which Defendant, with actual knO\\vledge. collects, uses. andlor discloses personal information from children, shall place a clear and conspicuous notice: (1) within the pri vacy policy required to be posted by Section 312.4(b) of the Rule. 16 C.F.R. § 3 J 2.4(b): (2) within the direct notice required 10 be sent to parents by Section 4 ofl3 Case 1:12-cv-07386-JGK Document 2 Filed 10/03/12 Page 5 of 15 312.4(c) of the Rule, 16 C.F.R. § 312A(c); and (3) at each location on the website or online service ,,,·here personal i11fo1111atio11 is collected, which states as fo11o\"':s in bold typeface: NOTICE: Visit w·ww.OnGuardOnline.gov for tips from the Federal Trade Commission on protecting kids~ pri\"'acy online t,,,,,\\\\'W.OnGuardOnline.Q.ov must contain a hyperlink 10 http://ww\\v.onguardonline.gov/topics/kids-privacy,aspx)\n\nDefendant shall be required to change the byperlinks/URLs \\\\'ithin 15 days after receipt of notice (v,!hich shall also be sent to Defendant's counsel) from the Federal Trade Commission of a change to such hyperlinks/URLs.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "V", "title": "Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of one million dollars to the United States within five days of receipt of notice of order entry.", "verbatim_text": "17. IT IS FURTHER ORDERED that Defendant shall pay to Plaintiff a civil penalty, pursuant to Section 5(m)(l )(/\\.) of the FTC Act, l5 U.s.c. § 45(m)(1 )(A), in the amount of one million dollars ($1 million), due and payable \\\\'ithin five days ofreceipt of notice ohIle entry of this Order. Unless otherwise directed. payment shall be made by electronic fund transfer in accordance \\vith procedures specified by the Consumer Protection Branch, Civil Division, U.S. Department of Justice, \\Vashington, DC 20530.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "VI", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain acknowledgment of receipt of this Order from itself, from all relevant personnel and managers for three years, and must collect signed acknowledgments from recipients within 30 days.", "verbatim_text": "A. Defendant within 7 days of entry of this Order, must submit to the Commission an acknO\\\\'ledgment of receipt of this Order s\\\\'om under penalty ofpeJjury.\n\nB. F onhree years after entry of this Order. Defendant must deliver a copy of this Order to (1) all principals. officers. directors. and managers of any business oVlTIed. operated. or managed by or on behalf of Defendant engaged in conducl related to the subject matter addressed in Section II of this Order; (2) all Defendant's employees. agents, and representatives v\\'ho have responsibilities related to the operation of any \\~'ebsite or online service subject to Section II of this Order; and (3) any business entity resulting from any change in structure as set f011h in the Section titled Compliance Reporting. Delivery must occur within 7 days of entry of this Order for CUlTent personnel. To all others, deli\\'ery must occur before they assume their responsibilities.\n\nC. From each individual or entity to \\\",hich Defendant delivered a copy oftbis Order. that Defendant must oblain, within 30 days, a signed and dated acknowledgment of receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "VII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit compliance reports to the Commission, including an initial report one year after order entry and ongoing notices for 10 years regarding changes in contact information or corporate structure.", "verbatim_text": "A. One year after entry of this Order, Defendant must submit a compliance report. sworn under penalty of perjury 10: (a) designate at least one telephone number and an email, physicaL and postal address as points of contac1, which representatives of the Commission and Plaintiff may use to communicate \\vith Defendant; (b) identify all of Defendant's businesses by all of their names, telephone numbers. and physical, postaL email, and Intemet addresses: (c) describe the activities of each business, including the products and services offered. and the means of advertising, marketing., and sales; (d) describe in detail \\\\'hether and hoy\\, Defendant is in compliance with each section of this Order; and (e) provide a copy oftlle Order Acknowledgment obtained pursuant to this Order. unless previously submitted to the Commission.\n\nB. For 10 years following entry of1his Order, Defendant must submit a compliance notice. s'wom under penalty of perjury, \\vithin 14 days of any change in the follov\"ing: (a) any designated point of contact; or (b) the structure of Defendant or any entity that Defendant has any O\\\\11ership interest in or directly or indirectly c.ontrols that may affect compliance obligations arising under this Order, including the creation, merger. sale, or dissolution orlhe entity or any subsidiary, parent. or aftlliate that engages in any acts or practices subject to lhis Order.\n\nC. Defendant must submit to the Commission notice of the llling of any bankruptcy petition, insolvency proceeding. or any similar proceeding by or against Defendant within 14 days of its filing.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "VIII", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and maintain records for 10 years after order entry and retain each record for 5 years, including accounting records, personnel records, complaints, compliance documents, and samples of data collection forms.", "verbatim_text": "A Accounting records shov,·ing the revenues fro111 all goods or services provided through any website or online service subject to Section II of this Order, all costs incurred in generating those revenues. and the resulting net profit or loss:\n\nB. Personnel records showing. for each person who has responsibilities related to the operation of any website or online service subject to Section II of this Order. whether as an employee or otherwise, that person's name, addresses, and telephone numbers: job title or position; dates of service; and. if applicable, the reason for tem1ination:\n\nC. Complaints relating to the information collection, use, maintenance. or disclosure practices of any website or online service subject to Section Il oft1115 Order, whether received directly or indirectly, sllch as through a third pa11y. and any response;\n\nD. All records necessary to demonstrate full compliance with each provision of this Order. inc luding all submissions to the Conmlission; and\n\nE. A sample copy of every materially different form. page, or screen through which a website or online service subject to Section II of this Order collects or discloses personal information is collected or disclosed, and a sanlp]e copy of each materially different documem containing any representation to the public regarding Defendant's collection, use, and disclosure practices pertaining to persona] infol1113tion of a child. Each \\veb page copy shall be accompanied by the URL of the web page where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in preseming information on the Intemet. Provided. however, that Defendant shall not be required to retain any document for longer than two years after the document was created, or to retain a print or electronic copy of any amended form, page, or screen to the extent that the amendment does not affect Defendant's compliance obligations under this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "IX", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor compliance through additional reports, depositions, document production, employee interviews, and posing as consumers without prior notice.", "verbatim_text": "A. \\;\"'ithil1 14 days of receipt of a written request from a representatiw of the Commission or Plaintiff, Defendant must submit additional compliance reports or other requested information that must be sworn under pena1ty of peljury, appear for depositions, and produce documents for inspection and copying. The Commission and Plaintiff are also authorized to obtain disc()\\'ery. without flu1.her leave of court, using any 9 of 13\n\nB. For matters conceming this Order, the Commission and Plaintiff are authorized to communicate directly with Defendant '\\\"ith prior notice to Defendant's counsel. Defendant must permit representatives of the Commission and Plaintiff to inter\\'ie\\\\ any en1p\\oyee or other person affiliated with Defendant who has agreed to such an inter\\'iew. The person intervie\\ved may have counsel present.\n\nC. The Commission and Plaintiff may use all other lawful means, including posing. through its representatives, as consumers, suppliers. or other individuals or entities. to Defendant or any individual or entity affiliated with Defendant, ,\\ithout the necessity of identification or prior notice. Nothing in this Order limits the Cornmission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.c. §§ 49, 57b- 1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "X", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "25. IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement oft11is Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.12_artist_arena_llc_united_states_of_america", "company_name": "Artist Arena LLC", "date_issued": "2012-10-15", "year": 2012, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act, 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/112-3167-artist-arena-llc-united-states-america-federal-trade-commission", "docket_number": "12 Civ. 07386" }, { "provision_number": "I", "title": "Injunction Concerning the Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained from failing to provide parental notice, failing to post required privacy links, failing to obtain verifiable parental consent, failing to delete children's data upon parental request, retaining children's data longer than necessary, and violating the COPPA Rule.", "verbatim_text": "3 A. Failing to make reasonable efforts, taking into account available technology, to 4 ensure that a Parent of a Child receives direct notice of Defendant’s practices with regard to the 5 Collection, use, or Disclosure of Personal Information from Children, including notice of any 6 material change in the Collection, use, or Disclosure practices to which the Parent has previously 7 consented, unless the COPPA Rule (attached as Appendix A), provides an exception to 8 providing such notice;\n\n9 B. Failing to post a Clear and Conspicuous link to an online notice of Defendant’s 10 information practices with regard to Children on the home or landing page or screen of its 11 website or online service, and at each area of the website or online service where Personal 12 Information is Collected from Children, unless the COPPA Rule (attached as Appendix A), 13 provides an exception to providing such notice;\n\n14 C. Failing to obtain Verifiable Parental Consent before any Collection, use, or 15 Disclosure of Personal Information from Children, including consent to any material change in 16 the Collection, use, or Disclosure practices to which the Parent has previously consented, unless 17 the COPPA Rule (attached as Appendix A), provides an exception to obtaining Verifiable 18 Parental Consent;\n\n19 D. Failing to Delete a Child’s Personal Information at the request of a Parent;\n\n20 E. Retaining Personal Information Collected online from a Child for longer than 21 reasonably necessary to fulfill the purpose for which the information was Collected; and\n\n22 F. Violating the COPPA Rule (attached as Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "II", "title": "Injunction Concerning Children's Personal Information Previously Collected", "category": "affirmative_obligation", "summary": "Within 60 days of entry of the Order, Defendant must delete all Personal Information associated with Affected Users (unless verifiable parental consent was obtained) and provide a sworn written statement to the Commission detailing its compliance actions.", "verbatim_text": "1 A. Delete all Personal Information that is associated with anyAffected User, unless 2 Defendant has provided direct notice and obtained Verifiable Parental Consent.\n\n3 B. Provide a written statement to the Commission, sworn under penalty of perjury, 4 that: 5 1. Describes all processes through which Defendant provided direct notice 6 and sought to obtain Verifiable Parental Consent for any users covered by this Section;\n\n7 2. Identifies the total number of users for whom (a) direct notice was 8 provided; (b) Defendant obtained Verifiable Parental Consent; (c)Verifiable Parent 9 Consent was affirmatively declined; and (d) no response was provided;\n\n10 3. Describes in detail any Personal Information Defendant retains, the basis 11 for such retention, and, as applicable, the specific government agency, law, regulation, or 12 court order that requires such retention; and\n\n13 4. Confirms that all Personal Information required to be Deleted by this 14 Section has been Deleted.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "III", "title": "Monetary Judgment and Suspension", "category": "affirmative_obligation", "summary": "A $500,000 civil penalty judgment is entered against Defendant but suspended based on Defendant's sworn financial representations; the suspension is lifted if Defendant made material misstatements, and Defendant must submit its TIN within 7 days.", "verbatim_text": "17 A. Judgment in the amount of Five Hundred Thousand Dollars ($500,000) is entered 18 in favor of Plaintiff against Defendant as a civil penalty.\n\n19 B. The judgment is suspended subject to the Subsections below. 20 C. The Commission’s and Plaintiff’s agreement to the suspension of the judgment is 21 expressly premised upon the truthfulness, accuracy, and completeness of Defendant’s sworn 22 financial statements and related documents (collectively, “financial representations”) submitted 23 to the Commission, namely: the Financial Statement of Defendant Apitor Technology Co., Ltd. 24 signed on June 5, 2025, including the attachments.\n\n25 D. The suspension of the judgment will be lifted as to Defendant if, upon motion by 26 the Commission or Plaintiff, the Court finds that Defendant failed to disclose any material asset, 27 materially misstated the value of any asset, or made any other material misstatement or omission 28 in the financial representations identified above.\n\n1 E. If the suspension of the judgment is lifted, the judgment becomes immediately 2 due as to that Defendant in the amount specified in Subsection A above (which the parties 3 stipulate only for purposes of this Section represents the amount of the civil penalty for the 4 violations alleged in the Complaint), less any payment previously made pursuant to this Section, 5 plus interest computed from the date of entry of this Order.\n\n6 F. Defendant relinquishes dominion and all legal and equitable right, title, and 7 interest in all assets transferred pursuant to this Order and may not seek the return of any assets.\n\n8 G. The facts alleged in the Complaint will be taken as true, without further proof, in 9 any subsequent civil litigation by or on behalf of the Commission, including in a proceeding to 10 enforce its rights to any payment or monetary judgment pursuant to this Order.\n\n11 H. Defendant acknowledges that its United States Employer Identification Number, 12 Social Security Number, or other Taxpayer Identification Number (“TIN”), if any, must be 13 submitted to Plaintiff within 7 days of entry of this Order. The Commissionand Plaintiffmay 14 use any such TIN for reporting and other lawful purposes, including collecting on any delinquent 15 amount arising out of this Order in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "IV", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit a sworn acknowledgment of receipt within 7 days, deliver copies of the Order to key personnel within 7 days and to future personnel before they assume responsibilities, and obtain signed acknowledgments from all recipients within 30 days.", "verbatim_text": "19 A. Defendant, within 7 days of entry of this Order, must submit to the Commission 20 an acknowledgment of receipt of this Order sworn under penalty of perjury.\n\n21 B. For 5 years after entry of this Order, Defendant must deliver a copy of this Order 22 to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees 23 having managerial responsibilities for conduct related to the subject matter of the Order and all 24 agents and representatives who participate in conduct related to the subject matter of the Order; 25 and (3) any business entity resulting from any change in structure as set forth in the Section titled 26 Compliance Reporting. Delivery must occur within 7 days of entry of this Order for current 27 personnel. For all others, delivery must occur before they assume their responsibilities.\n\n28 C. From each individual or entity to which Defendant delivered a copy of this Order, STIP.ORDER FOR PERM.INJUNCTION,CIV.PENALTY JUDGMENT &OTHER RELIEF Case No. 3:25-cv-07363 -11- Case 3:25-cv-07363-MMC Document 9 Filed 09/29/25 Page 12 of 25 1 Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this 2 Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "V", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit a sworn annual compliance report, provide sworn notices within 14 days of material changes for 10 years, notify the Commission of bankruptcy filings within 14 days, ensure all sworn submissions comply with 28 U.S.C. § 1746, and submit all materials to the designated Commission address.", "verbatim_text": "6 A. One year after entry of this Order, Defendant must submit a compliance report, 7 sworn under penalty of perjury. Defendant must: (a) identify the primary physical, postal, and 8 email address and telephone number, as designated points of contact, which representatives of 9 the Commission and Plaintiff may use to communicate with Defendant; (b) identify all of 10 Defendant’s businesses by all of their names, telephone numbers, and physical, postal, email, and 11 Internet addresses; (c) describe the activities of each business, including the goods and services 12 offered and the means of advertising, marketing, and sales; (d) describe in detail whether and 13 how Defendant is in compliance with each Section of this Order; and (e) provide a copy of each 14 Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the 15 Commission.\n\n16 B. For 10 years after entry of this Order, Defendant must submit a compliance 17 notice, sworn under penalty of perjury, within 14 days of any change in the following: Defendant 18 must report any change in: (a) any designated point of contact; or (b) the structure of any entity 19 that Defendant has any ownership interest in or controls directly or indirectly that may affect 20 compliance obligations arising under this Order, including: creation, merger, sale, or dissolution 21 of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to 22 this Order.\n\n23 C. Defendant must submit to the Commission notice of the filing of any bankruptcy 24 petition, insolvency proceeding, or similar proceeding by or against Defendant within 14 days of 25 its filing.\n\n26 D. Any submission to the Commission required by this Order to be sworn under 27 penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by 28 concluding: “I declare under penalty of perjury under the laws of the United States of America STIP.ORDER FOR PERM.INJUNCTION,CIV.PENALTY JUDGMENT &OTHER RELIEF Case No. 3:25-cv-07363 -12- Case 3:25-cv-07363-MMC Document 9 Filed 09/29/25 Page 13 of 25 1 that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s 2 full name, title (if applicable), and signature.\n\n3 E. Unless otherwise directed by a Commission representative in writing, all 4 submissions to the Commission pursuant to this Order must be emailed to DEbrief@ftc.gov or 5 sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, 6 Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 7 Washington, DC 20580. The subject line must begin: United States v. Apitor Technology Co., 8 Ltd., FTC matter 2423058.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "VI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create specified records for 10 years after entry of the Order and retain each such record for 5 years, covering accounting records, personnel records, consumer complaints related to privacy practices, and all records necessary to demonstrate full compliance.", "verbatim_text": "10 IT IS FURTHER ORDERED that Defendant must create certain records for 10 years 11 after entry of the Order, and retain each such record for 5 years. Specifically, Defendant must 12 create and retain the following records: 13 A. Accounting records showing the revenues from all goods or services sold;\n\n14 B. Personnel records showing, for each person providing services, whether as an 15 employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; 16 dates of service; and (if applicable) the reason for termination;\n\n17 C. Records of all consumer complaints and refund requests related to Defendant’s 18 privacy practices, whether received directly or indirectly, such as through a third party, and any 19 response; and\n\n20 D. All records necessary to demonstrate full compliance with each provision of this 21 Order, including all submissions to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "VII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance through requests for reports and documents, depositions, direct communication with Defendant's personnel, and other lawful investigative means including undercover contact.", "verbatim_text": "4 A. Within 14 days of receipt of a written request from a representative of the 5 Commission or Plaintiff, Defendant must: submit additional compliance repo1is or other 6 requested infonnation, which must be sworn under penalty of pe1jmy; appear for depositions; 7 and produce docmnents for inspection and copying. The Commission and Plaintiff are also 8 authorized to obtain discove1y, without fmiher leave of comi, using any of the procedmes 9 prescribed by Federal Rules of Civil Procedme 29, 30 (including depositions by remote means), 10 31, 33, 34, 36, 45, and 69.\n\n11 B. For matters concerning this Order, the Commission and Plaintiff are authorized to 12 communicate directly with Defendant. Defendant must permit representatives of the 13 Commission and Plaintiff to inte1view any employee or other person affiliated with Defendant 14 who has agreed to such an inte1view. The person inte1viewed may have counsel present.\n\n15 C. The Commission and Plaintiff may use all other lawful means, including posing, 16 through its representatives as consmners, suppliers, or other individuals or entities, to Defendant 17 or any individual or entity affiliated with Defendant, without the necessity of identification or 18 prior notice. Nothing in this Order limits the Commission's lawful use of compulso1y process, 19 pmsuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "VIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "21 IT IS FURTHER ORDERED that this Comi retains jmisdiction of this matter for 22 pmposes of constrnction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "10.25_apitor", "company_name": "Apitor Technology Co., Ltd.", "date_issued": "2025-10-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a), and the Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/apitor", "docket_number": "3:25-cv-07363" }, { "provision_number": "13", "title": "Injunction – COPPA Compliance Requirements", "category": "prohibition", "summary": "Defendant and those acting in concert with him are permanently enjoined from failing to provide required privacy notices, direct parental notice, and verifiable parental consent, and from violating any other provision of the COPPA Rule.", "verbatim_text": "AA.. FFaaiilliinngg,, oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee ddiirreecctteedd ttoo cchhiillddrreenn,, oorr oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee tthhrroouugghh wwhhiicchh hhee,, wwiitthh aaccttuuaall kknnoowwlleeddggee,, ccoolllleeccttss,, uusseess,, aanndd//oorr ddiisscclloosseess ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, ttoo pprroovviiddee ssuuffffiicciieenntt nnoottiiccee ooff tthhee iinnffoorrmmaattiioonn DDeeffeennddaanntt ccoolllleeccttss oonnlliinnee ffrroomm cchhiillddrreenn,, hhooww hhee uusseess ssuucchh iinnffoorrmmaattiioonn,, hhiiss ddiisscclloossuurree pprraaccttiicceess,, aanndd aallll ootthheerr ccoonntteenntt,, aass rreeqquuiirreedd bbyy SSeeccttiioonn 331122AA((bb)) ooff tthhee RRuullee,, 1166 CC..FF..RR.. §§ 331122AA((bb));;\n\nBB.. FFaaiilliinngg,, oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee ddiirreecctteedd ttoo cchhiillddrreenn,, oorr oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee tthhrroouugghh wwhhiicchh hhee,, wwiitthh aaccttuuaall kknnoovvvvJJeeddggee;; ccoolllleeccttss,, uusseess,, aanndd//oorr ddiisscclloosseess ppeerrssoonnaall iinnffoorrmmaattiioonn ££II--oomm cchhiillddrreenn,, ttoo pprroovviiddee ddiirreecctt nnoottiiccee ttoo ppaarreennttss ooff wwhhaatt iinnffoorrmmaattiioonn DDeeffeennddaanntt ccooHHeeccttss oonnlliinnee ffrroomm cchhiillddrreenn,, hhooww hhee uusseess ssuucchh iinnffoorrmmaattiioonn)) hhiiss ddiisscclloossuurree pprraaccttiicceess,, aanndd aallll ootthheerr rreeqquuiirreedd ccoonntteenntt,, aass rreeqquuiirreedd bbyy SSeeccttiioonn 331122..44((cc)) ooff tthhee RRuullee,, 1166 CC,,FF..RR.. §§ 331122..44((cc));;\n\nCC.. FFaaiilliinngg,, oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee ddiirreecctteedd ttoo cchhiillddrreenn,, oorr oonn aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee tthhrroouugghh wwhhiicchh hhee,, \\\\vviitthh aaccttuuaall kknnoowwlleeddggee,, ccoonneeccttss,, UUsseess)) aanndd//oorr ddiisscclloosseess ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, ttoo oobbttaaiinn vveerriiffiiaabbllee ppaarreennttaall ccoonnsseenntt bbeeffoorree aannyy ccoolllleeccttiioonn,, uussee,, aanndd//oorr ddiisscclloossuurree ooff ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, aass rreeqquuiirreedd bbyy SSeeccttiioonn 331122..55 ooff tthhee RRuullee,, 1166 CC..FF,,RR.. §§ 331122..55((aa))(( 11));; oorr,,\n\nDD,, VViioollaattiinngg aannyy ootthheerr pprroovviissiioonn ooff tthhee CChhiillddrreenn''ss OOnnlliinnee PPrriivvaaccyy PPrrootteeccttiioonn RRuullee,, ..1166 CC..FF..RR.. PPaarrtt 331122,, aanndd aass tthhee RRuullee mmaayy hheerreeaafftteerr bbee aarrnneennddeedd.. AA ccooppyy ooff tthhee RRuuttee iiss aattttaacchheedd hheerreettoo aass \"\"AAppppeennddiixx AA~~'' aanndd iinnccoorrppoorraatteedd hheerreeiinn aass iiff ffuullllyy sseett ffoorrtthh vveerrbbaattiimm..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "14", "title": "Prohibition on Misrepresentations About Children's Personal Information", "category": "prohibition", "summary": "Defendant is enjoined from making any misrepresentation in any website or online service's privacy policy or elsewhere about the collection, use, disclosure, or deletion of children's personal information.", "verbatim_text": "1144.. IITT IISS ::FFUURRTTHHEERR OORRDDEERREEDD tthhaatt DDeeffeennddaanntt,, aanndd hhiiss ooffffiicceerrss,, aaggeennttss,, rreepprreesseennttaattiivveess~~ aanndd eemmppllooyyeeeess,, aanndd aallll ppeerrssoonnss iinn aaccttiivvee ccoonncceerrtt oorr ppaarrttiicciippaattiioonn vvvviitthh hhiimm wwhhoo rreecceeiivvee aaccttuuaall nnoottiiccee ooff tthhiiss OOrrddeerr bbyy ppeerrssoonnaall sseerrvviiccee oorr ootthheerrwwiissee,, aarree hheerreebbyy eennjjooiinneedd,, ddiirreeccttllyy oorr tthhrroouugghh aannyy ccoorrppoorraattiioonn,, ssuubbssiiddiiaarryy,, ddiivviissiioonn,, wweebbssiittee,, oorr ootthheerr ddeevviiccee,, iinn ccoonnnneeccttiioonn wwiitthh tthhee ooppeerraattiioonn ooff aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee,, ffrroomm mmaakkiinngg aannyy mmiissrreepprreesseennttaattiioonn iinn tthhee wweebbssiittee oorr oonnlliinnee sseerrvviiccee~~ss pprriivvaaccyy ppoolliiccyy oorr eellsseewwhheerree aabboouutt tthhee wweebbssiittee oorr oonnlliinnee sseerrvviiccee))ss ccoolllleeccttiioonn,, uussee,, ddiisscclloossuurree,, oorr PPaaggee 44 ooff 2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 5 of 17 ddeelleettiioonn ooff cchhiillddrreenn''ss ppeerrssoonnaall iinnffoorrmmaattiioonn..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "15", "title": "Deletion of Children's Personal Information", "category": "affirmative_obligation", "summary": "Defendant must delete all personal information collected in violation of the Rule from April 21, 2000 through the date of Order entry, within five days of receiving notice of the Order.", "verbatim_text": "1155.. IITT IISS FFUURRTTHHEE]]~~ OORRDDEERREEII)) tthhaatt DDeeffeennddaanntt,, wwiitthhiinn ffiivvee ((55)) ddaayyss ff}}''oomm tthhee ddaattee ooff rreecceeiipptt ooff nnoottiiccee ooff tthhee eennttrryy ooff tthhiiss OOrrddeerr,, sshhaallll ddeelleettee aallll ppeerrssoonnaall iinnffoorrmmaattiioonn ccoolllleecctteedd aanndd rrnnaaiinnttaallnneedd iinn vviioollaattiioonn ooff tthhee RRuullee aatt aannyy ttiimmee ffrroomm AApprriill 2211>> 22000000 tthhrroouugghh tthhee ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "16", "title": "Consumer Education Remedy – FTC Notice Posting", "category": "affirmative_obligation", "summary": "For five years from the Order's entry date, Defendant must post a clear and conspicuous FTC consumer education notice linking to OnGuardOnline.gov within required privacy policies, direct parental notices, and at each location where personal information is collected.", "verbatim_text": "1166.. IITT IISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt,, ffoorr aa ppeerriioodd ooff ffiivvee ((55)) yyeeaarrss ffrroomm tthhee ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr,, DDeeffeennddaanntt;; iinn ccoonnnneeccttiioonn wwiitthh hhiiss ooppeerraattiioonn ooff aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee ddiirreecctteedd ttoo cchhiillddrreenn,, aanndd aannyy wweebbssiittee oorr oonnlliinnee sseerrvviiccee tthhrroouugghh wwhhiicchh DDeeffeennddaanntt,, wwiitthh aaccttuuaall kknnoowwlleeddggee,, ccoolllleeccttss,, uusseess,, aanndd//ooff ddiisscclloosseess ppeerrssoonnaall iinnffoorrmmaattiioonn ffrroomm cchhiillddrreenn,, sshhaallll ppllaaccee aa cclleeaarr aanndd ccoonnssppiiccuuoouuss nnoottiiccee:: (('' 11)) wwiitthhiinn tthhee pprriivvaaccyy ppoolliiccyy rreeqquuiirreedd ttoo bbee ppoosstteedd bbyy SSeeccttiioonn 331122..44((bb)) ooff tthhee RRuullee,, 1166 CC..FF..RR.. §§ 331122AA((bb));; ((22)) wwiitthhiinn tthhee ddiirreecctt nnoottiiccee rreeqquuiirreedd ttoo bbee sseenntt ttoo ppaarreennttss bbyy SSeeccttiioonn 331122..44(( cc)) ooff ttnnee RRuullee,, 1166 CC..FF ..RR.. §§ 331122..44(( cc));; aanndd,, ((33)) aatt eeaacchh llooccaattiioonn oonn tthhee wweebbssiittee oorr oonnlliinnee sseerrvviiccee wwnneerree ppeerrssoonnaall iinnffoorrmmaattiioonn iiss ccoolllleecctteedd,, wwhhiicchh ssttaatteess aass ffoolllloowwss iinn bboolldd ttyyppeeffaaccee:: NNOOTTIICCEE:: VViissiitt \\\\\"\"\"\",,,,,,,,,,,,..OOnnGGuuaarrddOOnnlliinnee..ggoovv ffoorr ttiippss ffrroomm tthhee FFeeddeerraall TTrraaddee CCoommmmiissssiioonn ,, oonn pprrootteeccttiinngg kkiiddss'',, pprriivvaaccyy oo,,nnIIiinnee rr\"\"\\\\vvwwww,,OOnngguuaarrddOOnnllmmee..ggoovv\"\" mmuusstt ccoonnttaamm aa hhyyppeerrllmmkk ttoo hhttttpp::////wwwwww ..oonngguuaarrddoonnll iinnee.. ggOOYY II ttooppiiccss//kkiiddss--pprriivvaaccyy ..aassppxx]]\n\nDDeeffeennddaanntt sshhaaHH bbee rreeqquuiirreedd ttoo cchhaannggee tthhee hhyyppeerrIIiinnkkss//UURRLLss wwiitthhiinn ffiifftteeeenn ((1155)) ddaayyss aafftteerr rreecceeiipptt ooff nnoottiiccee ttII''oomm tthhee FFeeddeerraall TTrraaddee CCoommmmiissssiioonn ooff aa cchhaannggee ttoo ssuucchh hhyyppeerrlliinnkkss//UURRLLss..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Redress" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "17", "title": "Civil Penalty", "category": "affirmative_obligation", "summary": "Defendant must pay a civil penalty of $100,000, of which all but $1,000 is suspended subject to conditions, including compliance with the Retention of Children's Online Privacy Professional and Right to Reopen provisions.", "verbatim_text": "1177.. IITT IISS FFUURRTTHH}}::RR OORRDDEERREEDD tthhaatt DDeeffeennddaanntt sshhaallll ppaayy ttoo PPII..aaiinnttiiffff aa cciivviill ppeennaallttyy,, ppuurrssuuaanntt ttoo SSeeccttiioonn 55 ((mm))((11 ))((AA)) ooff tthhee FFTTCC AAcctt,, 1155 UU..SS,,CC.. §§ 4455((mm))((ll ))((AA )),, iinn tthhee aammoouunntt ooff oonnee hhuunnddrreedd tthhoouussaanndd ddooll11aarrss (($$110000,,000000));; pprroovviiddeeccll ,, hhoowweevveerr,, tthhaatt uuppoonn ssaattiissffaaccttiioonn ooff ppaayymmeenntt aass oouuttlliinneedd iinn PPaarraaggrraapphh 1188,, aallll bbuutt oonnee tthhoouussaanndd ddoollllaarrss (($$ll}}OOOOOO)) ooff tthhiiss aammoouunntt sshhaallll bbee ssuussppeennddeedd,, ssuubbjjeecctt ttoo tthhee ccoonnddiittiioonnss sseett ffoorrtthh iinn tthhee SSeeccttiioonnss ooff tthhiiss OOrrddeerr eennttiittiieedd \"\"RREETTEENNTTIIOONN OOFF CCHHIILLDDRREENN''SS OONNLLIINNEE PPRRIIVVAACCYY PPRROOFFEESSSSIIOONNAALL\"\" aanndd \"\"RRIIGGHHTT TTOO RREEOOPPEENN..\"\"", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "18", "title": "Civil Penalty Payment", "category": "affirmative_obligation", "summary": "Defendant must pay the $1,000 non-suspended civil penalty within five days of receipt of notice of entry of the Order by wire transfer or certified cashier's check payable to the Treasurer of the United States.", "verbatim_text": "1188.. DDeeffeennddaanntt sshhaallll mmaakkee tthhee ppaayymmeenntt rreeqquuiirreedd bbyy PPaarraaggrraapphh 1177 ooff tthhiiss OOrrddeerr aass ffoolllloowwss:: WWiitthhiinn ffiivvee ((55)) ddaayyss ooff rreecceeiipptt ooff nnoottiiccee ooff tthhee eennttrryy ooff tthhiiss OOttddeerr,, DDeeffeennddaanntt sshhaallll ttrraannssffeerr tthhee ssuumm ooff oonnee tthhoouussaanndd ddoollllaarrss (($$11,,000000)) iinn tthhee ffoorrmm ooff aa wwiirree ttrraannssffeerr oorr cceerrttiiffiieedd ccaasshhiieerr''ss cchheecckk mmaaddee ppaayyaabbllee ttoo tthhee TTrreeaassuurreerr ooff tthhee UUnniitteedd SSttaatteess.. TThhee cchheecckk aannddlloorr wwrriitttteenn ccoonnffiirrmmaattiioonn ooff tthhee wwiirree ttrraannssffeerr sshhaaHH bbee ddeelliivveerreedd iinn aaccccoorrddaannccee \"\"''lliitthh pprroocceedduurreess ssppeecciiff11eedd bbyy tthhee CCoonnssuummeerr PPrrootteeccttiioonn BBrraanncchh,, CCiivviill DDiivviissiioonn,, UU..SS.. DDeeppaarrttmmeenntt ooff JJuussttiiccee,, \\\\VVaasshhiinnggttoonn,, DDCC 2200553300..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "19-22", "title": "Civil Penalty Terms – Relinquishment, Acknowledgment, and Default", "category": "affirmative_obligation", "summary": "Defendant relinquishes all control over funds paid, agrees the facts in the complaint are true for future enforcement proceedings, acknowledges the penalty is not dischargeable in bankruptcy, and agrees the full penalty becomes immediately due upon default continuing more than ten days.", "verbatim_text": "1199.. DDeeffii::mmddaanntt rreelliinnqquuiisshheess aallll ddoommiinniioonn}} ccoonnttrrooll,, aanndd ttiittllee ttoo tthhee ffuunnddss ppaaiidd ttoo tthhee ffuulllleesstt eexxtteenntt ppeerrmmiitttteedd bbyy llaaww.. DDeeffeennddaanntt sshhaallll mmaakkee nnoo ccllaaiimm ttoo oorr ddeemmaanndd rreettuurrnn ooff tthhee ffuunnddss,, ddiirreeccttllyy oorr iinnddiirreeccttllyy,, tthhrroouugghh ccoouunnsseell oorr ootthheerrwwiissee,,\n\n2200.. DDeeffeennddaanntt aaggrreeeess tthhaatt tthhee ffaaccttss aass aalllleeggeedd iinn tthhee CCoommppllaaiinntt ttIIlleedd iinn tthhiiss aaccttiioonn sshhaallll bbee ttaakkeenn aass ttrruuee,, wwiitthhoouutt ffuurrtthheerr pprrooooff}} iinn aannyy ssuubbsseeqquueenntt cciivviill lliittiiggaattiioonn ffiilleedd bbyy oorr oonn bbeehhaallff ooff tthhee CCoommmmiissssiioonn ttoo eennffoorrccee iittss rriigghhtt ttoo aannyy PPaaggee 66 00[[ 2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 7 of 17 -- --vv-- .. __II__VV ppaayymmeenntt ooff mmoonneeyy jjuuddggmmeenntt ppuurrssuuaanntt ttoo tthhiiss oorrddeerr..\n\n2211.. DDeeffeennddaanntt aaggrreeeess tthhaatt tthhee jjuuddggmmeenntt rreepprreesseennttss aa cciivviill ppeennaallttyy oowweedd ttoo tthhee UUnniitteedd SSttaatteess GGoovveerrnnmmeenntt aanndd,, iiss nnoott ccoommppeennssaattiioonn ffoorr aaccttuuaall ppeeccuunniiaarryy lloossss}} aanndd tthheerreeffoorree,, aass ttoo tthhee DDeeffeennddaanntt,, iitt iiss nnoott ssuubbjjeecctt ttoo ddiisscchhaarrggee uunnddeerr tthhee BBaannkkrruuppttccyy CCooddee ppuurrssuuaanntt ttoo 1111 UU,,SS..CC.. §§ 552233((aa))((77))..\n\n2222.. IInn tthhee eevveenntt ooff aannyy ddeeffaauulltt iinn ppaayymmeenntt~~ wwhhiicchh ddeeffaauulltt ccoonnttiinnuueess ffoorr tteenn ((1100)) ddaayyss bbeeyyoonndd tthhee dduuee ddaattee ooff ppaayymmeenntt}} tthhee eennttiirree uunnppaaiidd ppeennaallttyy,, ttooggeetthheerr wwiitthh iinntteerreesstt,, aass ccoommppuutteedd ppuurrssuuaanntt ttoo 2288 UU..SS..CC.. §§ 11996611 ((aaccccrruueedd ffrroomm tthhee ddaattee ooff ddeeffaauulltt ttoo tthhee ddaattee ooff ppaayymmeenntt)) sshhaallll iimmmmeeddiiaatteellyy bbeeccoommee dduuee aanndd ppaayyaabbllee..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "23", "title": "Retention of Children's Online Privacy Professional", "category": "assessment", "summary": "Defendant must retain a qualified independent third-party children's privacy professional to conduct annual assessments for five years, or alternatively maintain membership in a Commission-approved COPPA safe harbor program for five years.", "verbatim_text": "AA.. \\\\VViitthhiinn tthhiillttyy ((3300)) ddaayyss ooff sseerrvviiccee ooff tthhiiss OOrrddeerr,, rreettaaiinn aa qquuaalliiffIIeedd,, oobbjjeeccttiivvee,, iinnddeeppeennddeenntt tthhiirrdd--ppaarrttyy pprrooffeessssiioonnaall wwhhoo uusseess pprroocceedduurreess aanndd ssttaannddaarrddss ggeenneerraaHHyy aacccceepptteedd iinn tthhee pprrooffeessssiioonn ttoo ccoonndduucctt iinniittiiaall aanndd aannnnuuaall aasssseessssmmeennttss aanndd rreeppoorrttss ((''~~ AAsssseessssmmeennttss}};;)).. AA ppeerrssoonn oorr eennttiittyy qquuaalliiffiieedd ttoo pprreeppaarree ssuucchh AAsssseessssmmeennttss sshhaallll hhaavvee aa mmiinniimmuumm ooff tthhrreeee ((33)) yyeeaarrss ooff eexxppeerriieennccee iinn tthhee ffiieelldd ooff cchhiillddrreenn oonnlliinnee pprriivvaaccyy ''$$ aanndd iimmpplleemmeennttaattiioonn ooff tthhee RRuullee.. AAllll ppeerrssoonnss ccoonndduuccttiinngg ssuucchh AAsssseessssmmeennttss aanndd pprreeppaarriinngg ssuucchh rreeppoorrttss sshhaallll bbee aapppprroovveedd bbyy tthhee PPaaggee 77 ooff 2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 8 of 17 AAssssoocciiaattee DDiirreeccttoorr ffoorr EEnnffoorrcceemmeenntt,, BBuurreeaauu ooff CCoonnssuummeerr PPrrootteeccttiioonn,, FFeeddeerraall TTrraaddee CCoommmmiissssiioonn,, WWaasshhiinnggttoonn~~ DD..CC.. 2200558800)) iinn hhiiss oorr hheerr ssoollee ddiissccrreettiioonn.. TThhee rreeppoorrttiinngg ppeerriioodd ffoorr tthhee AAsssseessssmmeennttss sshhaallll ccoovveerr tthhee ttllrrsstt ffuullll yyeeaarr aafftteerr sseerrvviiccee ooff tthhee OOrrddeerr,, aanndd eeaacchh ooff tthhee ffoolllloowwiinngg ffoouurr ((44)) yyeeaarrss,, ffoorr aa ttoottaall ooff ffiivvee ((55)) aannnnuuaall AAsssseessssmmeennttss.. EEaacchh\n\n11.. SSeett ttoorrtthh tthhee ssppeecciiffiicc cchh ii llddrreenn'' ss oonnll iinnee pprriivvaaccyy ccoonnttrroollss tthhaatt tthhee DDeeffeennddaanntt hhaass iimmpplleemmeenntteedd aanndd mmaaiinnttaaiinneedd dduurriinngg tthhee rreeppoorrttiinngg ppeerriioodd;; 22.. EExxppllaaiinn hhooww tthhee cchhiillddrreenn''ss oonnlliinnee pprriivvaaccyy ccoonnttrroollss tthhaatt hhaavvee bbeeeenn iimmpplleemmeenntteedd mmeeeett oorr eexxcceeeedd tthhee pprrootteeccttiioonnss rreeqquuiirreedd bbyy tthhee SSeeccttiioonn ooff tthhiiss OOrrddeerr eennttiittlleedd HHIINNJJUUNNCCTTIIOONN//'' aanndd,, 33.. CCeerrttiiffyy tthhaatt tthhee cchhiillddrreenn''ss oonnlliinnee pprriivvaaccyy ccoonnttrroollss aarree ooppeerraattiinngg wwiitthh ssuuffffiicciieenntt eeffffeeccttiivveenneessss ttoo pprroovviiddee rreeaassoonnaabbllee aassssuurraannccee ttoo pprrootteecctt tthhee pprriivvaaccyy aanndd sseeccuurriittyy ooff cchhiillddrreenn''ss ppeerrssoonnaall iinnffoorrmmaattiioonn aanndd tthhaatt tthhee ccoonnttrroollss hhaavvee ssoo ooppeerraatteedd tthhrroouugghhoouutt tthhee rreeppoorrttiinngg ppeerriioodd..\n\nEEaacchh AAsssseessssmmeenntt sshhaallll bbee pprreeppaarreedd aanndd ccoommpplleetteedd wwiitthhiinn ssiixxttyy ((6600)) ddaayyss aafftteerr tthhee eenndd ooff tthhee rreeppoorrttiinngg ppeerriioodd ttoo wwhhiicchh tthhee AAsssseessssmmeenntt aapppplliieess.. DDeeffeennddaanntt sshhaallll pprroovviiddee tthhee iinniittiiaall AAsssseessssmmeenntt ttoo tthhee AAssssoocciiaattee DDiirreeccttoorr ffoorr EEnnffoorrcceemmeenntt)) BBuurreeaauu ooff CCoonnssuummeerr PPrrootteeccttiioonn,, FFeeddeerraall TTrraaddee CCoommmmiissssiioonn,, WWaasshhiinnggttoonn,, DD..CC.. 2200558800,, wwiitthhiinn tteenn ((1100)) ddaayyss aattIIeerr tthhee AAsssseessssmmeenntt hhaass bbeeeenn pprreeppaarreedd.. AAllll ssuubbsseeqquueenntt aannnnuuaall AAsssseessssmmeennttss sshhaallll bbee rreettaaiinneedd bbyy DDeeffeennddaanntt aanndd pprroovviiddeedd ttoo tthhee PPaaggee 88 ooff22 00 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 9 of 17 AAssssoocciiaattee DDiirreeccttoorr ooff EEnnffoorrcceemmeenntt wwiitthhiinn tteenn ((1100)) ddaayyss ooff rreeqquueesstt;; oorr,,\n\nBB.. WWiitthhiinn tthhiirrttyy ((3300)) ddaayyss ooff sseerrvviiccee ooff tthhiiss OOrrddeerr,, bbeeccoommee aa mmeemmbbeerr iinn ggoooodd ssttaannddiinngg ooff oonnee ooff tthhee pprrooggrraammss aapppprroovveedd bbyy tthhee CCoommmmiissssiioonn aass aa ssaaffee hhaarrbboorr pprrooggrraamm ffoorr ppuurrppoosseess ooff iimmpplleemmeennttiinngg tthhee RRuullee.. DDeeffeennddaanntt sshhaallll rreemmaaiinn aa mmeemmbbeerr iinn ggoooodd ssttaannddiinngg ooff aa CCoorrnnmmiissssiioonn aapppprroovveedd CCOOPPPPAA ssaaffee hhaarrbboorr pprrooggrraamm ffoorr aa ppeerriioodd ooff ffiivvee ((55)) yyeeaarrss aafftteerr tthhee ddaattee ooff sseerrvviiccee ooff tthhiiss OOrrddeerr,, oorr uunnttiill ssuucchh ttiimmee aass DDeeffeennddaanntt eelleeccttss ttoo rreettaaiinn aa qquuaalliiffiieedd,, iinnddeeppeennddeenntt tthhiirrdd--ppaarrttyy oobbjjeeccttiivvee~~ pprrooffeessssiioonnaall uunnddeerr PPaarraaggrraapphh 2233.. AA .. ooff tt hhiiss OO rrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "24", "title": "Right to Reopen", "category": "affirmative_obligation", "summary": "The Commission's agreement to this Order is premised on the truthfulness of Defendant's financial statements; if the Court determines Defendant made a material misrepresentation or failed to comply with the privacy professional retention requirements, the Court shall lift the suspension and reinstate the full $100,000 civil penalty.", "verbatim_text": "AA.. TThhee CCoommmmiissssiioonn''ss aaggrreeeemmeenntt ttoo tthhiiss OOrrddeerr iiss eexxpprreessssllyy pprreemmiisseedd uuppoonn tthhee ttrruutthhffuullnneessss,, aaccccuunnttccyy,, aanndd ccoommpplleetteenneessss ooff tthhee FFiinnaanncciiaall SSttaatteemmeenntt ooff IInnddiivviidduuaall DDeeffeennddaanntt,, ssiiggnneedd aanndd ddaatteedd JJuullyy 77,, 22001111,, aanndd tthhee IInnddiivviidduuaall FFiinnaanncciiaall SSttaatteemmeenntt ooff JJoonneess 00,, GGooddwwiinn:: SSuupppplleemmeennttaall AAnnsswweerrss,, ssiiggnneedd aanndd ddaatteedd JJuullyy 1133)) 22001111.. DDeeffeennddaanntt ssttiippuullaatteess tthhaatt aallll ooff tthhee mmaatteerriiaallss tthhaatt DDeeffeennddaanntt ssuubbmmiitttteedd aarree ttrruutthhffuull,, aaccccuurraattee,, aanndd ccoommpplleettee.. TThheessee ddooccuummeennttss ccoonnttaaiinn mmaatteerriiaall iinnffoorrmmaattiioonn uuppoonn wwhhiicchh tthhee CCoommmmiissssiioonn rreelliieedd iinn nneeggoottiiaattiinngg aanndd aaggrreeeeiinngg ttoo tthhee tteerrmmss ooff tthhiiss OOrrddeerr,,\n\nBB.. IIff,, uuppoonn mmoottiioonn bbyy tthhee CCoommmmiissssiioonn)) aa CCoouurrtt ddeetteerrmmiinneess eeiitthheerr tthhaatt DDeeffeennddaanntt:: 11.. MMaaddee aa mmaatteerriiaall mmiissrreepprreesseennttaattiioonn oorr oommiitttteedd mmaatteerriiaall iinnffoorrmmaattiioonn ccoonncceerrnniinngg DDeeffeennddaanntt'' ss ffiinnaanncciiaall ccoonnddiittiioonn;; oorr~~ PPaaggee 99 ooff2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 10 of 17 ll.. ----......11-- 22,, FFaaiilleedd ttoo ccoommppllyy wwiitthh tthhee rreeqquuiirreemmeennttss ooff tthhee SSeeccttiioonn ooff tthhiiss OOrrddeerr eennttiittlleedd \"\"RREETTEENNTTIIOONN OOFF CCHHIILLDDRREENN''SS OONNLLIINNEE PPRRIIVVAACCYY PPRROOFFEESSSSIIOONNAALL//~~ tthheenn tthhee CCoouurrtt sshhaallll lliifftt tthhee ssuussppeennssiioonn ddeessccrriibbeedd iinn tthhee SSeeccttiioonn ooff tthhiiss OOrrddeerr eennttiittlleedd \"\"CCIIVVIILL PPEENNAALLTTYY11 aanndd rreeiinnssttaattee tthhee ffuullll cciivviill ppeennaallttyy aaggaaiinnsstt '' DDeeffeennddaanntt aanndd ffoorr PPllaaiinnttiiffff iinn tthhee aammoouunntt ooff oonnee hhuunnddrreedd tthhoouussaanndd ddoollllaarrss (($$110000,,000000)),, lleessss aannyy aammoouunntt aallrreeaaddyy ppaaiidd bbyy oorr oonn bbeehhaallff ooff DDeeffeennddaanntt ttoo PPllaaiinnttiiffff,,pprroovviiddee dd,, hhOOllvveevveerr,, tthhaatt iinn aallll ootthheerr rreessppeeccttss tthhiiss OOrrddeerr sshhaallll rreemmaaiinn iinn ffuullll ffoorrccee aanndd eeffffeecctt uunnlleessss ootthheerrwwiissee oorrddeerreedd bbyy tthhee CCoouurrtt;; aanneepprroovviiddeedd,, ffuurrtthheerr,, tthhaatt pprroocceeeeddiinnggss iinnssttiittuutteedd uunnddeerr tthhiiss pprroovviissiioonn wwoouulldd bbee iinn aaddddiittiioonn ttoo,, aanndd nnoott iinn lliieeuu ooff,, aannyy ootthheerr cciivviill oorr ccrriimmiinnaall rreemmeeddiieess aass rrnnaayy bbee pprroovviiddeedd bbyy llaaww,, iinncclluuddiinngg bbuutt nnoott lliimmiitteedd ttoo ccoonntteemmpptt pprroocceeeeddiinnggss,, oorr aannyy ootthheerr pprroocceeeeddiinnggss tthhaatt tthhee CCoommmmiissssiioonn mmaayy iinniittiiaattee ttoo eennffoorrccee tthhiiss OOrrddeerr,,", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "25", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission has broad authority to monitor Defendant's compliance, including through written requests, document production, depositions, facility inspections, undercover posing, and interviews of Defendant's personnel.", "verbatim_text": "AA.. WWiitthhiinn tteenn ((1100)) ddaayyss ooff rreecceeiipptt OOLL ll wwrriitttteenn rreeqquueesstt ffrroomm aa rreepprreesseennttaattiivvee ooff tthhee CCoommmmiissssiioonn,, DDeeffeennddaanntt sshhaallll ssuubbmmiitt wwrriitttteenn rreessppoonnsseess,, \\\\::vvhhiicchh aattee ttrruuee aanndd aaccccuurraattee aanndd sswwoorrnn ttoo uunnddeerr ppeennaallttyy ooff ppeelljjuurryy;; pprroodduuccee ddooccuummeennttss ttbbrr iinnssppeeccttiioonn aanndd ccooppyyiinngg;; aappppeeaarr ffoorr ddeeppoossiittiioonn;; aanndd pprroovviiddee eennttrryy dduurriinngg nnoorrmmaall bbuussiinneessss hhoouurrss ttoo aannyy bbuussiinneessss llooccaattiioonn iinn DDeeffeennddaanntt''ss ppoosssseessssiioonn oorr ddiirreecctt oorr iinnddiirreecctt ccoonnttrrooll ttoo iinnssppeecctt tthhee bbuussiinneessss ooppeerraattiioonn..\n\nBB.. IInn aaddddiittiioonn,, tthhee CCoommmmiissssiioonn iiss aauutthhoorriizzeedd ttoo uussee aallll ootthheerr llaawwffuull PPaaggee 1100 ooff22 00 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 11 of 17 mmeeaannss,, iinncclluuddiinngg bbuutt nnoott lliimmiitteedd ttoo:: 11.. OObbttaaiinniinngg ddiissccoovveerryy ffrroomm aannyy ppeerrssoonn,, wwiitthhoouutt ffuurrtthheerr lleeaavvee ooff ccoouurrtt~~ uussiinngg tthhee pprroocceedduurreess pprreessccrriibbeedd bbyy FFeedd.. RR,, CCiivv,, PP.. 3300,, 3311,, 3333 3366,, 4455 aanndd 6699;; 11 22.. HHaavviinngg iittss rreepprreesseennttaattiivveess ppoossee aass ccoonnssuummeerrss aanndd ssuupppplliieerrss ttoo DDeeffeennddaanntt,, hhiiss eemmppllooyyeeeess,, oorr aannyy ootthheerr eennttiittyy mmaannaaggeedd oorr ccoonnttrroolllleedd iinn wwhhoollee oorr iinn ppaarrtt bbyy DDeeffeennddaanntt,, wwiitthh nnuutt tthhee nneecceessssiittyy ooff iiddeennttiiffiiccaattiioonn oorr pprriioorr nnoottiiccee;; aanndd,,\n\nCC.. DDeeffeennddaanntt sshhaaHH ppeerrmmiitt rreepprreesseennttaattiivveess ooff tthhee CCnnmmmmiissssiioonn ttoo iinntteerrvviieeww aannyy eemmppllooyyeerr~~ ccoonnssuullttaanntt,, iinnddeeppeennddeenntt cc((mmttnn~~ccttoorr)) rreepprreesseennttaattiivvee,, aaggeenntt,, oorr eemmppllooyyeeee wwhhoo hhaass aaggrreeeedd ttoo ssuucchh aann iinntteerrvviieeww rreellaattiinngg iinn aannyy wwaayy ttoo aannyy ccoonndduucctt ssuubbjjeecctt ttoo tthhiiss OOrrddeerr.. ll TThhee ppeerrssoonn iinntteerrvviieewweedd mmaayy hhaavvee ccoouunnsseell pprreesseenntt..\n\nDD.. FFoorr ppuuqq))oosseess ooff tthhee ccoommpplliiaannccee rreeppoorrttiinngg aanndd mmoonniittoorriinngg rreeqquuiirreedd bbyy tthhiiss OOrrddeerr,, tthhee CCoommmmiissssiioonn iiss aauuttlllloorriizzeedd ttoo ccoommmmuunniiccaattee ddiirreeccttllyy wwiitthh DDeeffeennddaanntt..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "26", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "For five years, Defendant must notify the Commission of changes to his residence, employment, business structure, and name, and must submit periodic written compliance reports sworn under penalty of perjury, and notify the Commission of any bankruptcy filing.", "verbatim_text": "AA.. FFoorr aa ppeerriioodd ooff ffiivvee ((55)) yyeeaarrss ff))''oomm tthhee ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr:: 11.. TThhee DDeeffeennddaanntt sshhaallll nnoottiiffyy tthhee CCoommmmiissssiioonn ooff tthhee ffoolllloowwiinngg:: aa.. AAnnyy cchhaannggeess iinn tthhee DDeeifeennddaannt}fss rreessiiddeennccee,, mmaaiilliinngg aaddddrreessss~~ aanndd tteelleepphhoonnee nnuummbbeerr)) wwiitthhiinn tteenn ((11 00)) dd~~rryyss ooff tthhee ddaa ttee ooff ssuucchh cchhaannggee;;\n\nbb.. AAnnyy cchhaannggeess iinn tthhee DDeeffeennddaanntt''ss eemmppllooyymmeenntt ssttaattuuss ((iinncc lluuddiinngg sseellff~~eemmppllooyymmeenn tt)) ,, aa nndd aannyy cchhaannggee iinn tthhee DDeeffeennddaannte~ss oo\\\\vvnneerrsshhiipp iinn aannyy bbuussiinneessss eennttiittyy,, wwiitthhiinn tteenn (( 1100 )) ddaayyss ooff tthhee ddaattee ooff ssuucchh cchhaannggee.. SSuucchh nnoottiiccee sshhaaHH iinncclluuddee tthhee nnaammee aanndd aaddddrreessss ooff eeaacchh bbuussiinneessss tthhaatt tthhee DDeeffeennddaanntt iiss aaffffiilliiaatteedd wwiitthh,, eemmppllooyyeedd bbyy,, ccrreeaatteess oorr ffoorrmmss,, oorr ppeerrffoorrmmss sseerrvviicceess ffoorr;; aa ddeettaaiilleedd ddeessccrriippttiioonn ooff tthhee nnaattuurree oofft tnhee bbuussiinneessss;; aanndd aa ddeettaaiilleedd ddeessccrriippttiioonn ooff tthhee DDeeffeennddaanntt''ss dduuttiieess aanndd rreessppoonnssiibbiilliittiieess iinn ccoonnnneeccttiioonn wwiitthh tthhee bbuussiinneessss oorr eemmppffooyyrrlllleenntt;; aanndd))\n\ncc,, AAnnyy cchhaannggeess iinn tthhee ssttrruuccttuurree ooff aannyy bbuussiinneessss eennttiittyy tthhaatt tthhee DDeeffeennddaanntt ddiirreecct tllyy oorr iinnd diirreeccttllyy ccoonntt rroollss oorr hhaass aann oowwnneerrsshhiipp iinntteerreesstt iinn,, tthhaatt mrn.aayy aaffffeecctt ccoommpplliiaannccee oobblliiggaattiioonnss aarriissiinngg uunnddeerr tthhiiss OOrrddeerr,, iinncclluuddiinngg bbuutt nnoott lliimmiitteedd ttoo:: iinnccoorrppoorraattiioonn 0011'' ootthheerr oorrggaanniizzaattiioonn;; aa ddiissssoolluuttiioonn,, aassssiiggnnmmeenntt,, ssaaffee,, mmeerrggeerr,, oorr ootthheerr aaccttiioonn;; tthhee PPaaggee 1122 ooff2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 13 of 17 (('' ccrreeaattiioonn oorr ddiissssoolluuttiioonn ooff aa ssuubbssiiddiiaarryy,, ppaarreenntt,, oorr aaffffiilliiaattee tthhaatt eennggaaggeess iinn aannyy aaccttss oorr pprraaccttiicceess ssuubbjjeecctt ttoo tthhiiss OOrrddeerr;; oorr aa cchhaannggee iinn tthhee bbuussiinneessss nnaammee oorr aaddddrreessss,, aatt lleeaasstt tthhiirrttyy ((3300)) ddaayyss pprriioorr ttoo ssuucchh cchhaannggee,,pprroovviiddee dd tthhaatt,, wwiitthh rreessppeecctt ttoo aannyy ssuucchh cchhaannggee iinn tthhee bbuussiinneessss eennttiittyy aabboouutt wwhhiicchh tthhee DDeeffeennddaanntt lleeaammss lleessss tthhaann tthhiirrttyy ((3300)) ddaayyss pprriioorr ttoo tthhee ddaattee ssuucchh aaccttiioonn iiss ttoo ttaakkee ppllaaccee,, tthhee DDeeffeennddaanntt sshhaallll nnoottiiffyy tthhee CCoommmmiissssiioonn aass ssoooonn aass iiss pprraaccttiiccaabbllee aafftteerr oobbttaaiinniinngg ssuucchh kknnoowwlleeddggee;; aanndd\n\ndd.. AAnnyy cchhaannggeess iinn tthhee DDeeffeennddaannee ss nnaammee oorr uussee ooff aannyy aalliiaasseess oorr ffiiccttiittiioouuss nnaammeess wwiitthhiinn tteenn ((1100)) ddaayyss ooff tthhee ddaattee ooff ssuucchh cchhaannggee..\n\nBB.. SSiixxttyy ((6600)) ddaayyss aafftteerr tthhee ddaattee ooff eennttrryy oofftt hh11ss OOrrddeerr,, aanndd tthheerreeaafftteerr ffoorr aa ppeerriioodd ooff ffiivv ee ((55)) yyeeaarrss aatt ssuucchh ttiimmeess aass tthhee FFeeddeerraall TTrraaddee CCoommmmiissssiioonn sshhaallll rreeaassoonnaabbllyy rreeqquuiirree,, DDeeffeennddaanntt sshhaallll pprroovviiddee aa wwrriitttteenn rreeppoorrtt ttoo tthhee CCoommmmiissssiioonn,, wwhhiicchh iiss ttrruuee aanndd aaccccuurraattee aanndd sswwoorrnn ttoo uunnddeerr ppeennaallttyy ooff ppeerrjjuurryy ~~ sseettttiinngg ffoorrtthh iinn ddeettaaiill tthhee mmaannnneerr aanndd ffoorrmm iinn wwhhiicchh eeaacchh hhaass ccoommppJJiieedd aanndd iiss ccoommpp..llyyiinngg wwiitthh tthhiiss OOrrddeerr.. TThhiiss rreeppoorrtt sshhaallll iinncclluuddee,, bbuutt nnoott bbee lliimmiitteedd ttoo:: 11 ''IInnee DDeeffeennddaanntt''ss tthheenn--ccuurrrreenntt rreessiiddeennccee aaddddrreessss,, mmaaiilliinngg << aaddddrreesssseess,, aanndd tteelleepphhoonnee nnuummbbeerrss;; 22.. TThhee DDeeffeennddaanntt''ss tthheenn--ccuurrrreenntt eemmppllooyymmeenntt ssttaattuuss ((iinncclluuddiinngg sseellff--eemmppllooyymmeenntt)),, iinncclluuddiinngg tthhee nnaammee,, aaddddrreesssseess,, aanndd tteelleepphhoonnee nnuummbbeerrss ooff eeaacchh bbuussiinneessss tthhaatt tthhee DDeeffeennddaanntt iiss aaffffiilliiaatteedd wwiitthh)) PPaaggee 1133 ooff22 00 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 14 of 17 -- -- -- -- -- -- -- ----..;;;;..II -- -- -- ---- eemmppllooyyeedd bbyy)) oorr ppeerrffoorrmmss sseerrvviicceess ffoorr;; aa ddeettaaii lleedd ddeessccrriippttiioonn ooff tthhee nnaattuurree ooff tthhee bbuussiinneessss;; aanndd aa ddeettaaiilleedd ddeessccrriippttiioonn ooff tthhee DDeeffeennddaanntt''ss dduuttiieess aanndd rreessppoonnssiibbiilliittiieess iinn ccoonnnneeccttiioonn wwiitthh tthhee bbuussiinneessss oorr eemmppllooyymmeenntt;; aanndd,, 33.. AAnnyy ootthheerr cchhaannggeess rreeqquuiirreedd ttoo bbee rreeppoorrtteedd uunnddeerr PPaarraaggrraapphh 2266..AA,, ooff tthhiiss OOrrddeerr,,\n\nCC,, DDeeffeennddaanntt sshhaallll nnoottiiffYY tthhee CCoommmmiissssiioonn ooff tthhee ffiilliinngg ooff aa bbaannkkrruuppttccyy ppeettiittiioonn wwiitthhiinn ffiifftteeeenn ((1155)) ddaayyss ooff ffllHHnngg..\n\nDD.. FFoorr tthhee ppuurrppoosseess ooff tthhiiss OOrrddeerr,, DDeeffeennddaanntt sshhaaHH,, uunnlleessss ootthheerrwwiissee ddiirreecctteedd bbyy tthhee CCoommmmiissssiioonn''ss aauutthhoorriizzeedd rreepprreesseennttaattiivveess ,, sseenndd bbyy oovveerrnniigghhtt ccoouurriieerr ((nnoott tthhee UU..SS.. PPoossttaall SSeerrvviiccee)) aaUU rreeppoorrttss aanndd nnoottiiffiiccaattiioonnss ttoo tthhee CCoommmmiissssiioonn tthhaatt aarree rreeqquuiirreedd bbyy tthhiiss OOrrddeerr ttoo tthhee ffoollIIoovvlliinngg aaddddrreessss:: AAssssoocciiaattee DDiirreeccttoorr ffoorr EEnnffoorrcceemmeenntt BBuurreeaauu ooff CCoonnssuummeerr PPrrootteeccttiioonn FFeeddeerraall TTrraaddee CCoommmmiissssiioonn 660000 PPeennnnssyyllvvaanniiaa AAvveennuuee,, NNWW WWaasshhii ngton. DD..CC.. 2200558800 rrc RREE:: U U . . s. ~ v. e Sk~idk~ei~kdidss NNeenn11lloorrkk LLC PPrroovviiddeedd tthhaatt,, iinn ll iieeuu ooff oo vveerrnniigghhtt ccoouurriieerr,, DD eeffeennddaanntt mmaayy ss eenndd ssuucchh rreeppoorrttss oorr nnoottiiffiiccaattiioonnss bbyy ffiirrsstt--ccllaassss mmaaiill,, bbuutt oonnllyy iiff DDeeffeennddaanntt ccoonntteemmppoorraanneeoouussllyy sseennddss aann eelleeccttrroonniicc vveerrssiioonn ooff ssuucchh rreeppoorrtt oorr nnoottiiffiiccaattiioonn ttoo tthhee CCoommmmiissssiioonn aatt:: DDEEBBrriieeff@@ffttcc..ggoovv ..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "27", "title": "Record-Keeping Provisions", "category": "recordkeeping", "summary": "For eight years from the Order's entry date, Defendant must create and retain records sufficient to demonstrate full compliance with this Order, including acknowledgment copies, compliance reports, and sample web pages and documents regarding collection practices.", "verbatim_text": "IITT ]ISS FFUURRTTHHEERR OORRDDEERREEDD tthhaatt ffoorr aa ppeerriioodd ooff eeiigghhtt ((88)) yyeeaarrss ffrroomm tthhee 11 ddaattee ooff eennttrryy ooff tthhiiss OOrrddeerr,, DDeeffeennddaanntt,, ffoorr aannyy bbuussiinneessss ffoorr wwhhiicchh hhee iiss tthhee PPaaggee 1144 ooff 2200 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 15 of 17 ..~~ ........ ______ AAnnnn..llll,,...... ..,,........,,-- -- mmaajjoorriittyy oowwnneerr oorr ddiirreeccttllyy oorr iinnddiirreeccttllyy ccoonnttrroollss,, iiss hheerreebbyy rreessttrraaiinneedd aanndd eennjjooiinneedd ffrroomm ffaaiilliinngg ttoo ccrreeaattee aanndd rreettaaiinn tthhee ffoolllloowwiinngg rreeccoorrddss:: AA.. AA pprriinntt oorr eelleeccttrroonniicc ccooppyy ooff aallll ddooccuummeennttss nneecceessssaarryy ttoo ddeemmoonnssttrraattee ffuullll ccoommppIIii<<::llnnccee wwiitthh eeaacchh pprroovviissiioonn ooff tthhii55 OOrrddeerr,, iinnccllUUddiinngg,, bbuutt nnoott lliimmiitteedd ttoo:: 11.. CCooppiieess ooff aacckknnoowwlleeddggmmeennttss ooff rreecceeiipptt ooff tthhiiss OOrrddeerr rreeqquuiirreedd bbyy tthhee SSeeccttiioonnss ttiittlleedd \"\"DDIISSTTRRIIBBUUTTIIOONN OOFF OORRDDEERR\"\" aanndd \"\"AACCKKNNOOWWLLEEDDGGMMEENNTT OOFF RREECCEEIIPPTT OOFF OORRDDEERRll '';; 22.. AAllll rreeppoorrttss ssuubbmmiitttteedd ttoo tthhee CCoommmmiissssiioonn ppuurrssuuaanntt ttoo tthhee SSeeccttiioonn ttiittlleedd \"\"CCOOMMPPLLIIAANNCCEE RREEPPOORRTTIINNGG\"\";; 33.. AA ssaamm ppIIee ccooppyy ooff eevveerryy mmaatteerriiaaJJJJyy ddiiffffeerreenntt ffoorrmm ppaaggee,, oorr rr ssccrreeeenn tthhrroouugghh wwhhiicchh ppeerrssoonnaall iinnffoorrmmaattiioonn iiss ccoolllleecctteedd oorr ddiisscclloosseedd,, aanndd aa ssaammppllee ccooppyy ooff eeaacchh mmaatteerriiaallllyy ddiiffffeerreenntt ddooccuummeenntt ccoonnttaaiinniinngg aannyy rreepprreesseennttaattiioonn rreeggaarrddiinngg DDeeffeennddaanntt''ss ccoolllleeccttiioonn.. uussee,, aanndd ddiisscclloossuurree pprraaccttiicceess ppeerrttaaiinniinngg ttoo ppeerrssoonnaall iinnffoorrmmaattiioonn ooff aa cchhiilldd,, EEaacchh ''wweebb ppaaggee ccooppyy sshhaallll bbee aaccccoommppaanniieedd bbyy tthhee UURRLL ooff tthhee wweebb ppaaggee wwhheerree tthhee mmaatteerriiaall vvvvaass ppoosstteedd oonnlliinnee.. EElleeccttrroonniicc ccooppiieess sshhaallll iinncclluuddee aallll tt eexxtt aanndd ggrraapphhiiccss ffiilleess,, aauuddiioo ssccrriippttss~~ aanndd ootthheerr ccoommppuutteerr ffiilleess uusseedd iinn pprreesseennttii nngg iinnffoorrmmaattiioonn oonn tthhee IInntteerrnneett.. PPrroovviiddeedd ,, hhoowweevveerr)) tthhaatt DDeeffeennddaanntt sshhaaHH nnoott bbee rreeqquuiirreedd ttoo rreettaaiinn aannyy ddooccuummeenntt ffoorr lloonnggeerr tthhaann ttwwoo ((22)) yyeeaarrss aafftteerr tthhee ddooccuummeenntt wwaass ccrreeaatteedd,, oorr ttoo rreettaaiinn aa pprriinntt oorr eelleeccttrroonniicc ccooppyy ooff aannyy aammeennddeedd ffoonnttll ppaaggee,, oorr 11 ssccrreeeenn ttoo tthhee eexxtteenntt tthhaatt tthhee aammeennddmmeenntt ddooeess nnoott aaffffeecctt DDeeffeennddaannffss ccoommpplliiaannccee oobblliiggaattiioonnss uunnddeerr tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "28", "title": "Distribution of Order", "category": "acknowledgment", "summary": "For five years from the Order's entry date, Defendant must deliver copies of the Order to principals, managers, and relevant employees of any business he controls, and to principals and managers of any business where he engages in relevant conduct, and must obtain signed acknowledgments within thirty days of delivery.", "verbatim_text": "AA.. DDeeffeennddaanntt aass aa ccoonnttrrooll ppeerrssoonn:: FFoorr aannyy bbuussiinneessss tthhaatt tthhee DDeeffeennddaanntt ccoonnttrroollss,, ddiirreeccttllyy oorr iinnddiirreeccttllyy,, oorr iinn wwhhiicchh tthhee DDeeffeennddaanntt hhaass aa mmaajjoorriittyy oowwnneerrsshhiipp iinntteerreesstt,, tthhee DDeeffeennddaanntt mmuusstt ddeelliivveerr aa ccooppyy ooff tthhiiss OOrrddeerr ttoo:: ((11)) aallll pprriinncciippaallss,, ooffffiicceerrss,, ddiirreeccttoorrss,, aanndd mmaannaaggeerrss;; aanndd ((22)) aaUU eemmppllooyyeeeess,, aaggeennttss,, aanndd rreepprreesseennttaattiivveess wwhhoo hhaavvee rreessppoonnssiibbiilliittiieess rreellaatteedd ttoo tthhee ooppeerraattiioonn ooff aannyy \\\\vveebbssiittee oorr oonnlliinnee sseerrvviiccee ssuubbjjeecctt ttoo tthhiiss OOrrddeerr aanndd ((33)) aannyy bbuussiinneessss eennttiittyy rreessuullttiinngg ffrroomm aannyy cchhaannggee iinn ssttrruuccttuurree sseett ffoorrtthh iinn PPaarraaggrraapphh 2266..AA..22.. ooff tthhee SSeeccttiioonn ttiittlleedd \"\"CC0011vvllPPLLIIAANNCCEE RREEPPOORRTTIINNGG..\"\" FFoorr ccuurrrreenntt ppeerrssoonnnneell ddeelliivveerryy tt sshhaallll bbee wwiitthhiinn ffiivvee ((55)) ddaayyss ooff sseerrvviiccee ooff tthhiiss OOrrddeerr uuppoonn tthhee DDeeffeennddaanntt.. FFoorr nneeww ppeerrssoonnnneell,, ddeelliivveerryy sshhaallll ooccccuurr pprriioorr ttoo tthheeiirr aassssuummiinngg tthheeiirr rreessppoonnssiibbiilliittiieess..\n\nBB,, DDeeffeennddaanntt aass eemmppllooyyeeee oorr nnoonn--ccoonnttrrooll ppeerrssoonn:: FFoorr aannyy bbuussiinneessss wwhheerree tthhee DDeeffeennddaanntt iiss nnoott aa ccoonnttrroolllliinngg ppeerrssoonn ooff aa bbuussiinneessss bbuutt ootthheerrwwiissee eennggaaggeess iinn ccoonndduucctt rreellaatteedd ttoo tthhee ssuubbjjeecctt mmaatttteerr ooff tthhiiss OOrrddeerr,, tthhee DDeeffeennddaanntt mmuusstt ddeelliivveerr aa ccooppyy ooff tthhiiss OOrrddeerr ttoo aallll pprriinncciippaallss aanndd mmaannaaggeerrss ooff ssuucchh bbuussiinneessss bbeeffoorree eennggaaggiinngg iinn ssuucchh ccoonndduucctt\n\nCC.. DDeeffeennddaanntt mmuusstt sseeccuurree aa ssiiggnneedd aanndd ddaatteedd ssttaatteemmeenntt aacckknnoowwlleeddggiinngg rreecceeiipptt ooff tthhee OOrrddeerr,, \\\\vviitthhiinn tthhiirrttyy ((3300)) ddaayyss ooff ddeelliivveerryy,, ffrroomm aallll PPaaggee 1166 ooff22 00 Case 1:11-cv-03846-JOF Document 3 Filed 02/01/12 Page 17 of 17 CCaassee 11:: 1111--ccvv--0033884466--JJOOFF ~~ hhii ppeerrssoonnss rreecceeii vviinngg aa ccooppyy ooff tthhee OOrrddeerr ppuurrssuuaanntt ttoo tthhiiss SSeeccttiioonn.. DDeeffeennddaanntt sshhaallll mmaaiinnttaaiinn ccooppiieess ooff tthhee ssiiggnneedd ssttaatteemmeennttss,, aass wweellll aass ootthheerr iinnffoorrmmaattiioonn rreeggaarrddiinngg tthhee ff11iicctt aanndd mmaannnneerr ooff iittss ccoommpplliiaannccee,, iinncclluuddiinngg tthhee nnaammee aanndd ttiittllee ooff eeaacchh ppeerrssoonn ttoo wwhhoomm aa ccooppyy ooff tthhee OOrrddeerr hhaass bbeeeenn pprroovviiddeedd aanndd,, uuppoonn rreeqquueesstt,, sshhaallll mmaakkee tthhee ssttaatteemmeennttss aanndd ootthheerr iinnffoorrrrnnaattiioonn aavvaaiillaabbllee ttoo tthhee CCoommmmiissssiioonn..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "29", "title": "Acknowledgment of Receipt of Order", "category": "acknowledgment", "summary": "Defendant must submit a truthful sworn statement to the Commission acknowledging receipt of this Order within five business days of receiving it.", "verbatim_text": "2299.. IITT IISS FFUUHHTTHHEEHH OORRDDEEHHEE!!)) tthhaatt DDeeffeennddaanntt,, wwiitthhiinn ffiivvee ((55)) bbuussiinneessss ddaayyss ooff rreecceeiipptt ooffttll11iiss OOrrddeerr aass eenntteerreedd bbyy tthhee CCoouurrtt,, mmuusstt ssuubbmmiitt ttoo tthhee CCoommmmiissssiioonn aa ttrruutthhtthhll sswwoorrnn ssttaatteemmeenntt aacckknnoowwlleeddggiinngg rreecceeiipptt ooffttll11iiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "30", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for the purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "3300.. TThhiiss CCoouurrtt sshhaallll rreettaaiinn jjuurriissddiiccttiioonn ooff tthhiiss mmaatttteerr ffoorr tthhee ppuurrppoosseess ooff ccoonnssttrruuccttiioonn,, mmooddiiffiiccaattiioonn,, aanndd eennffoorrcceemmeenntt ooff tthhiiss OOrrddeerr..", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "11.11_godwin_jones_o._dba_skidekids.com", "company_name": "Jones O. Godwin", "date_issued": "2011-11-15", "year": 2011, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6501-6506, 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 41-58, 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1123033-godwin-jones-o-dba-skidekidscom", "docket_number": "Civil Action No. 1:11-cv-03846-JOF" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant and those acting in concert with it are permanently restrained from violating the COPPA Rule, specifically from failing to provide direct parental notice, failing to post a prominent privacy notice link, and failing to obtain verifiable parental consent before collecting personal information from children.", "verbatim_text": "7 A. failing to make reasonable efforts, taking into account available technology, 8 to ensure that a parent of a child receives direct notice of Defendant’s practices 9 with regard to the collection, use, or disclosure of personal information from 10 children, including notice of any material change in the collection, use, or 11 disclosure practices to which the parent has previously consented;\n\n12 B. failing to post a prominent and clearly labeled link to an online notice of its 13 information practices with regard to children on the home or landing page or 14 screen of its website or online service, and at each area of the website or online 15 service where personal information is collected from children; and\n\n16 C. failing to obtain verifiable parental consent before any collection, use, or 17 disclosure of personal information from children, including consent to any material 18 change in the collection, use, or disclosure practices to which the parent has 19 previously consented.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "II", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Judgment of $60,000 in civil penalties is entered against Defendant, which must be paid within 7 days of entry of the Order by electronic fund transfer; Defendant relinquishes all rights to the transferred assets and acknowledges its Taxpayer Identification Number may be used to collect any delinquent amounts.", "verbatim_text": "4 A. Judgment in the amount of sixty thousand dollars ($60,000) is entered in 5 favor of Plaintiff against Defendant as a civil penalty.\n\n6 B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer 7 of the United States, sixty thousand dollars ($60,000), which, as Defendant 8 stipulates, its undersigned counsel holds in escrow for no purpose other than 9 payment to Plaintiff. Such payment must be made within seven (7) days of entry 10 of this Order by electronic fund transfer in accordance with instructions previously 11 provided by a representative of Plaintiff.\n\n12 C. Defendant relinquishes dominion and all legal and equitable right, title, and 13 interest in all assets transferred pursuant to this Order and may not seek the return 14 of any assets.\n\n15 D. The facts alleged in the Complaint will be taken as true, without further 16 proof, in any subsequent civil litigation by or on behalf of the Commission, 17 including in a proceeding to enforce its rights to any payment or monetary 18 judgment pursuant to this Order.\n\n19 E. Defendant acknowledges that its Taxpayer Identification Number, which 20 Defendant must submit to the Commission, may be used for collecting and 10 Case 2:15-cv-09691 Document 2-1 Filed 12/17/15 Page 11 of 19 Page ID #:55 1 reporting on any delinquent amount arising out of this Order, in accordance with 2 31 U.S.C. § 7701.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "III", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must submit a sworn acknowledgment of receipt of the Order within 7 days, deliver copies to principals, officers, employees, and agents within 7 days (and to new personnel before they assume responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "6 A. Defendant, within seven (7) days of entry of this Order, must submit to the 7 Commission an acknowledgment of receipt of this Order sworn under penalty of 8 perjury.\n\n9 B. For three (3) years after entry of this Order, Defendant must deliver a copy 10 of this Order to: (1) all principals, officers, directors, and managers; (2) all 11 employees, agents, and representatives having supervisory responsibilities relating 12 to the collection, retention, storage, or security of personal information, and to the 13 operation of any of Defendant’s websites or online services; and (3) any business 14 entity resulting from any change in structure as set forth in the Section titled 15 Compliance Reporting. Delivery must occur within seven (7) days of entry of this 16 Order for current personnel. To all others, delivery must occur before they assume 17 their responsibilities.\n\n18 C. From each individual or entity to which Defendant delivered a copy of this 19 Order, Defendant must obtain, within thirty (30) days, a signed and dated 20 acknowledgment of receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "IV", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit a sworn compliance report one year after entry of the Order covering contact information, business activities, compliance status, privacy notices, and parental consent methods; must submit notices within 14 days of structural or contact changes for 10 years; must notify the Commission of any bankruptcy filing within 14 days; and must submit all required filings by email or overnight courier to the designated FTC address.", "verbatim_text": "4 A. One year after entry of this Order, Defendant must submit a compliance 5 report, sworn under penalty of perjury. In such report, Defendant must: 6 1. identify the primary physical, postal, and email address and telephone 7 number, as designated points of contact, which representatives of the Commission 8 and Plaintiff may use to communicate with Defendant; 9 2. identify all of Defendant’s businesses by all of their names, telephone 10 numbers, and physical, postal, email, and Internet addresses; 11 3. describe the activities of each business, including the goods and 12 services offered, the means of advertising, marketing, and sales; 13 4. describe in detail whether and how Defendant is in compliance with 14 each Section of this Order; 15 5. provide a copy of each different version of any privacy notice posted 16 on each website or online service operated by Defendant or sent to parents of 17 children that register on each website or online service; 18 6. provide a statement setting forth in detail the methods used to obtain 19 verifiable parental consent prior to any collection, use, and/or disclosure of 20 personal information from children; 12 Case 2:15-cv-09691 Document 2-1 Filed 12/17/15 Page 13 of 19 Page ID #:57 1 7. provide a statement setting forth in detail the means provided for 2 parents to review the personal information collected from their children and to 3 refuse to permit its further use or maintenance; and 4 8. provide a copy of each Order Acknowledgment obtained pursuant to 5 this Order, unless previously submitted to the Commission.\n\n6 B. For ten (10) years after entry of this Order, Defendant must submit a 7 compliance notice, sworn under penalty of perjury, within fourteen (14) days of 8 any change in: (a) any designated point of contact; or (b) the structure of 9 Defendant or any entity that Defendant has any ownership interest in or controls 10 directly or indirectly that may affect compliance obligations arising under this 11 Order, including: creation, merger, sale, or dissolution of the entity or any 12 subsidiary, parent, or affiliate that engages in any acts or practices subject to this 13 Order.\n\n14 C. Defendant must submit to the Commission notice of the filing of any 15 bankruptcy petition, insolvency proceeding, or similar proceeding by or against 16 Defendant within fourteen (14) days of its filing.\n\n17 D. Any submission to the Commission required by this Order to be sworn under 18 penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, 19 such as by concluding: “I declare under penalty of perjury under the laws of the 20 United States of America that the foregoing is true and correct. Executed on: 13 Case 2:15-cv-09691 Document 2-1 Filed 12/17/15 Page 14 of 19 Page ID #:58 1 _____” and supplying the date, signatory’s full name, title (if applicable), and 2 signature.\n\n3 E. Unless otherwise directed by a Commission representative in writing, all 4 submissions to the Commission pursuant to this Order must be emailed to 5 DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 6 Associate Director for Enforcement, Bureau of Consumer Protection, Federal 7 Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The 8 subject line must begin: United States v. LAI Systems, LLC.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "V", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create certain records for ten years after entry of the Order and retain each record for five years, including all compliance records and Commission submissions, consumer complaints and responses, and copies of all forms or screens through which personal information is collected along with related representations.", "verbatim_text": "10 IT IS FURTHER ORDERED that Defendant must create certain records for 11 ten (10) years after entry of the Order, and retain each such record for five (5) 12 years. Specifically, Defendant must create and retain the following records: 13 A. all records necessary to demonstrate full compliance with each provision of 14 this Order, including all submissions to the Commission;\n\n15 B. copies of all consumer complaints relating to Defendant’s collection of 16 personal information whether received directly or indirectly, such as through a 17 third party, and any response; and\n\n18 C. a copy of each materially different form, page, or screen created, maintained, 19 or otherwise provided by Defendant through which personal information is 20 collected, and a copy of each materially different document containing any 14 Case 2:15-cv-09691 Document 2-1 Filed 12/17/15 Page 15 of 19 Page ID #:59 1 representation made directly or indirectly by Defendant regarding collection, use, 2 and disclosure practices pertaining to personal information. Each webpage copy 3 shall be accompanied by the URL of the webpage where the material was posted 4 online. Electronic copies shall include all text and graphics files, audio scripts, and 5 other computer files used in presenting information on the Internet. Provided, 6 however, that for purposes of this subsection V.C, Defendant shall not be required 7 to retain any document for longer than two (2) years after the document was 8 created, or to retain a print or electronic copy of any amended webpage or screen 9 to the extent that the amendment does not affect Defendant’s compliance 10 obligations under this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "VI", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendant's compliance by requiring submission of additional reports, depositions, and document production within 14 days of written request; conducting direct communications and interviews with Defendant's personnel; and using all other lawful means including undercover approaches.", "verbatim_text": "14 A. Within fourteen (14) days of receipt of a written request from a 15 representative of the Commission or Plaintiff, Defendant must: submit additional 16 compliance reports or other requested information, which must be sworn under 17 penalty of perjury; appear for depositions; and produce documents for inspection 18 and copying. The Commission and Plaintiff are also authorized to obtain 19 discovery, without further leave of court, using any of the procedures prescribed by 20 15 Case 2:15-cv-09691 Document 2-1 Filed 12/17/15 Page 16 of 19 Page ID #:60 1 Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 2 34, 36, 45, and 69.\n\n3 B. For matters concerning this Order, the Commission and Plaintiff are 4 authorized to communicate directly with Defendant. Defendant must permit 5 representatives of the Commission and Plaintiff to interview any employee or other 6 person affiliated with Defendant who has agreed to such an interview. The person 7 interviewed may have counsel present.\n\n8 C. The Commission and Plaintiff may use all other lawful means, including 9 posing, through its representatives as consumers, suppliers, or other individuals or 10 entities, to Defendant or any individual or entity affiliated with Defendant, without 11 the necessity of identification or prior notice. Nothing in this Order limits the 12 Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of 13 the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "VII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of the Order.", "verbatim_text": "15 IT IS FURTHER ORDERED that this Court retains jurisdiction of this 16 matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.15_lai_systems", "company_name": "LAI Systems, LLC", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3261-lai-systems-llc", "docket_number": "2:15-cv-9691" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently restrained from violating the COPPA Rule, including failing to provide direct notice to parents, failing to post a prominent privacy notice link, and failing to obtain verifiable parental consent before collecting personal information from children.", "verbatim_text": "7 A. failing to make reasonable efforts, taking into account available technology, 8 to ensure that a parent of a child receives direct notice of Defendants’ practices 9 with regard to the collection, use, or disclosure of personal information from 10 children, including notice of any material change in the collection, use, or 11 disclosure practices to which the parent has previously consented;\n\n12 B. failing to post a prominent and clearly labeled link to an online notice of its 13 information practices with regard to children on the home or landing page or 14 screen of its website or online service, and at each area of the website or online 15 service where personal information is collected from children; and\n\n16 C. failing to obtain verifiable parental consent before any collection, use, or 17 disclosure of personal information from children, including consent to any material 18 change in the collection, use, or disclosure practices to which the parent has 19 previously consented.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "II", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A civil penalty judgment of $300,000 is entered against Defendants, payable within 7 days of entry of the Order by electronic fund transfer; Defendants relinquish all rights to transferred assets and acknowledge use of their Taxpayer Identification Numbers for delinquency reporting.", "verbatim_text": "4 A. Judgment in the amount of three hundred thousand dollars ($300,000) is 5 entered in favor of Plaintiff against Defendants as a civil penalty.\n\n6 B. Defendants are ordered to pay to Plaintiff, by making payment to the 7 Treasurer of the United States, three hundred thousand dollars ($300,000), which, 8 as Defendants stipulate, their undersigned counsel holds in escrow for no purpose 9 other than payment to Plaintiff. Such payment must be made within seven (7) days 10 of entry of this Order by electronic fund transfer in accordance with instructions 11 previously provided by a representative of Plaintiff.\n\n12 C. Defendants relinquish dominion and all legal and equitable right, title, and 13 interest in all assets transferred pursuant to this Order and may not seek the return 14 of any assets.\n\n15 D. The facts alleged in the Complaint will be taken as true, without further 16 proof, in any subsequent civil litigation by or on behalf of the Commission, 17 including in a proceeding to enforce its rights to any payment or monetary 18 judgment pursuant to this Order.\n\n19 E. Defendants acknowledge that their Taxpayer Identification Numbers, which 20 Defendants must submit to the Commission, may be used for collecting and 10 Case 5:15-cv-02569 Document 2-1 Filed 12/17/15 Page 11 of 19 Page ID #:65 1 reporting on any delinquent amount arising out of this Order, in accordance with 2 31 U.S.C. § 7701.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "III", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendants must submit a sworn acknowledgment of receipt of the Order within 7 days, deliver copies to officers, relevant employees, and new business entities within 7 days (or before assuming responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "6 A. Defendants, within seven (7) days of entry of this Order, must submit to the 7 Commission an acknowledgment of receipt of this Order sworn under penalty of 8 perjury.\n\n9 B. For five (5) years after entry of this Order, Defendants must deliver a copy 10 of this Order to: (1) all principals, officers, directors, and managers; (2) all 11 employees, agents, and representatives having supervisory responsibilities relating 12 to the collection, retention, storage, or security of personal information, and to the 13 operation of any of Defendants’ websites or online services; and (3) any business 14 entity resulting from any change in structure as set forth in the Section titled 15 Compliance Reporting. Delivery must occur within seven (7) days of entry of this 16 Order for current personnel. To all others, delivery must occur before they assume 17 their responsibilities.\n\n18 C. From each individual or entity to which Defendants delivered a copy of this 19 Order, Defendants must obtain, within thirty (30) days, a signed and dated 20 acknowledgment of receipt of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "IV", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit a sworn compliance report one year after entry of the Order detailing contact information, business activities, compliance status, privacy notices, consent methods, and parental review mechanisms; must also file sworn notices within 14 days of structural or contact changes for 10 years, report any bankruptcy filings within 14 days, and submit all filings to the FTC via specified channels.", "verbatim_text": "4 A. One (1) year after entry of this Order, Defendants must submit a compliance 5 report, sworn under penalty of perjury. In such report, Defendants must: 6 1. identify the primary physical, postal, and email address and telephone 7 number, as designated points of contact, which representatives of the Commission 8 and Plaintiff may use to communicate with Defendants; 9 2. identify all of Defendants’ businesses by all of their names, telephone 10 numbers, and physical, postal, email, and Internet addresses; 11 3. describe the activities of each business, including the goods and 12 services offered, the means of advertising, marketing, and sales; 13 4. describe in detail whether and how Defendants are in compliance with 14 each Section of this Order; 15 5. provide a copy of each different version of any privacy notice posted 16 on each website or online service operated by Defendants or sent to parents of 17 children that register on each website or online service; 18 6. provide a statement setting forth in detail the methods used to obtain 19 verifiable parental consent prior to any collection, use, and/or disclosure of 20 personal information from children; 12 Case 5:15-cv-02569 Document 2-1 Filed 12/17/15 Page 13 of 19 Page ID #:67 1 7. provide a statement setting forth in detail the means provided for 2 parents to review the personal information collected from their children and to 3 refuse to permit its further use or maintenance; and 4 8. provide a copy of each Order Acknowledgment obtained pursuant to 5 this Order, unless previously submitted to the Commission.\n\n6 B. For ten (10) years after entry of this Order, Defendants must submit a 7 compliance notice, sworn under penalty of perjury, within fourteen (14) days of 8 any change in: (a) any designated point of contact; or (b) the structure of 9 Defendants or any entity that Defendants have any ownership interest in or 10 controls directly or indirectly that may affect compliance obligations arising under 11 this Order, including: creation, merger, sale, or dissolution of the entity or any 12 subsidiary, parent, or affiliate that engages in any acts or practices subject to this 13 Order.\n\n14 C. Defendants must submit to the Commission notice of the filing of any 15 bankruptcy petition, insolvency proceeding, or similar proceeding by or against 16 Defendants within fourteen (14) days of its filing.\n\n17 D. Any submission to the Commission required by this Order to be sworn under 18 penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, 19 such as by concluding: “I declare under penalty of perjury under the laws of the 20 United States of America that the foregoing is true and correct. Executed on: 13 Case 5:15-cv-02569 Document 2-1 Filed 12/17/15 Page 14 of 19 Page ID #:68 1 _____” and supplying the date, signatory’s full name, title (if applicable), and 2 signature.\n\n3 E. Unless otherwise directed by a Commission representative in writing, all 4 submissions to the Commission pursuant to this Order must be emailed to 5 DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 6 Associate Director for Enforcement, Bureau of Consumer Protection, Federal 7 Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The 8 subject line must begin: United States v. Retro Dreamer and Craig E. Sharpe and 9 Gavin S. Bowman.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "V", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create certain records for 10 years and retain each for 5 years, including all compliance records and Commission submissions, consumer complaints and responses, and copies of each materially different form or page through which personal information is collected along with related representations.", "verbatim_text": "11 IT IS FURTHER ORDERED that Defendants must create certain records for 12 ten (10) years after entry of the Order, and retain each such record for five (5) 13 years. Specifically, Defendants must create and retain the following records: 14 A. all records necessary to demonstrate full compliance with each provision of 15 this Order, including all submissions to the Commission;\n\n16 B. copies of all consumer complaints relating to Defendants’ collection of 17 personal information whether received directly or indirectly, such as through a 18 third party, and any response; and\n\n19 C. a copy of each materially different form, page, or screen created, maintained, 20 or otherwise provided by Defendants through which personal information is 14 Case 5:15-cv-02569 Document 2-1 Filed 12/17/15 Page 15 of 19 Page ID #:69 1 collected, and a copy of each materially different document containing any 2 representation regarding collection, use, and disclosure practices pertaining to 3 personal information. Each webpage copy shall be accompanied by the URL of 4 the webpage where the material was posted online. Electronic copies shall include 5 all text and graphics files, audio scripts, and other computer files used in presenting 6 information on the Internet. Provided, however, that for purposes of this 7 subsection V.C, Defendants shall not be required to retain any document for longer 8 than two (2) years after the document was created, or to retain a print or electronic 9 copy of any amended webpage or screen to the extent that the amendment does not 10 affect Defendants’ compliance obligations under this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "VI", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through written requests for reports, depositions, and document production (with 14-day response obligation), direct communication and employee interviews, and all other lawful means including undercover contact.", "verbatim_text": "14 A. Within fourteen (14) days of receipt of a written request from a 15 representative of the Commission or Plaintiff, Defendants must: submit additional 16 compliance reports or other requested information, which must be sworn under 17 penalty of perjury; appear for depositions; and produce documents for inspection 18 and copying. The Commission and Plaintiff are also authorized to obtain 19 discovery, without further leave of court, using any of the procedures prescribed by 20 15 Case 5:15-cv-02569 Document 2-1 Filed 12/17/15 Page 16 of 19 Page ID #:70 1 Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 2 34, 36, 45, and 69.\n\n3 B. For matters concerning this Order, the Commission and Plaintiff are 4 authorized to communicate directly with Defendants. Defendants must permit 5 representatives of the Commission and Plaintiff to interview any employee or other 6 person affiliated with Defendants who has agreed to such an interview. The person 7 interviewed may have counsel present.\n\n8 C. The Commission and Plaintiff may use all other lawful means, including 9 posing, through its representatives as consumers, suppliers, or other individuals or 10 entities, to Defendants or any individual or entity affiliated with Defendants, 11 without the necessity of identification or prior notice. Nothing in this Order limits 12 the Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 13 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "VII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "15 IT IS FURTHER ORDERED that this Court retains jurisdiction of this 16 matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "deceptive", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.15_retro_dreamer", "company_name": "Retro Dreamer", "date_issued": "2015-12-15", "year": 2015, "administration": "Obama", "legal_authority": "Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d), and Sections 5(a)(1), 5(m)(1)(A), 13(b), and 16(a) of the Federal Trade Commission Act (FTC Act), 15 U.S.C. §§ 45(a)(1), 45(m)(1)(A), 53(b), and 56(a)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/142-3262-retro-dreamer", "docket_number": "5:15-cv-2569" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendant is permanently restrained from collecting, using, and disclosing personal information from child-directed properties without verifiable parental consent, and from violating COPPA.", "verbatim_text": "13 employees, and attorneys who receive actual notice of this Order, whether acting 14 directly or indirectly, in connection with Defendant operating a Web site or Online 15 Service Directed to Children or operating a Web site or online service that has 16 actual knowledge that it is Collecting or maintaining Personal Information from a 17 Child, are hereby permanently restrained and enjoined from (A) Collecting, using, 18 and Disclosing Personal Information from Child-directed properties without 19 Verifiable Parental Consent unless the Children's Online Privacy Protection Rule, 20 16 C.F.R. Part 312 (attached as Appendix A), provides an exception to Obtaining 21 Verifiable Parental Consent, or (B) violating the Children’s Online Privacy 22 Protection Rule, 16 C.F.R. Part 312 (attached as Appendix A). 23 II. INJUNCTION PROHIBITING MISREPRESENTATIONS", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "II", "title": "Injunction Prohibiting Misrepresentations", "category": "prohibition", "summary": "Defendant must not materially misrepresent consumers' opt-out abilities, data collection practices, COPPA compliance, or privacy protections.", "verbatim_text": "1 A. Consumers’ ability to opt out of Defendant’s Collection, maintenance, 2 use, Disclosure of, or provision of access to Covered Information;\n\n3 B. The extent to which Defendant Collects, maintains, uses, Discloses, or 4 provides access to Covered Information;\n\n5 C. The extent to which Defendant complies with the COPPA Rule and the 6 measures Defendant takes to comply with the COPPA Rule; or\n\n7 D. The extent to which Defendant otherwise protects the privacy, security, 8 availability, confidentiality, or integrity of Covered Information.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "III", "title": "Injunction Requiring Consent for Collection of Location Information", "category": "prohibition", "summary": "Defendant is permanently restrained from collecting location information through SDKs without confirming consumer has provided affirmative express consent and has not revoked it through device settings.", "verbatim_text": "14 collecting Location Information through Defendant’s software development kit(s) 15 for mobile applications without first confirming that: 16 A. The consumer has provided Affirmative Express Consent for the 17 collection of Location Information to the mobile application that has 18 integrated Defendant's software development kit(s);\n\n19 B. The consumer has not expressed, through any applicable operating 20 system, device, or mobile application permission or setting, that the 21 consumer does not consent to, or revokes consent to, the collection of 22 Location Information from such mobile application; and\n\n23 C. The consumer has not expressed through any applicable operating 24 system, device, or mobile application permission or setting, that the 25 consumer’s consent to the collection of Location Information from such 26 mobile application is limited to a level of accuracy that is less precise 27 than the Location Information that is to be collected or inferred by 28 Defendant.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "IV", "title": "Mandated Privacy Program", "category": "affirmative_obligation", "summary": "Defendant must establish and maintain a comprehensive privacy program that protects covered information collected through ad tech services.", "verbatim_text": "2 IT IS FURTHER ORDERED that Defendant, and any business that 3 Defendant controls directly, or indirectly, in connection with the Collection, 4 maintenance, use, or Disclosure of, or provision of access to, Covered Information 5 through an Ad Tech Service operated by Defendant, must, within sixty (60) days of 6 issuance of this Order, establish and implement, and thereafter maintain, a 7 comprehensive privacy program (“Privacy Program”) that protects the privacy of 8 such Covered Information. To satisfy this requirement, Defendant must, at a\n\n10 A. Document in writing the content, implementation, and maintenance of 11 the Privacy Program;\n\n12 B. Provide the written program and any evaluations thereof or updates 13 thereto to Defendant’s board of directors or governing body or, if no such 14 board or equivalent governing body exists, to a senior officer of 15 Defendant responsible for Defendant’s Privacy Program at least once 16 every twelve (12) months;\n\n17 C. Designate a qualified employee or employees to coordinate and be 18 responsible for the Privacy Program;\n\n19 D. Assess and document, at least once every twelve (12) months, internal 20 and external risks to the privacy of Covered Information that could result 21 in the unauthorized Collection, maintenance, use, or Disclosure of, or 22 provision of access to, Covered Information;\n\n23 E. Design, implement, maintain, and document safeguards that control for 24 the material internal and external risks Defendant identifies to the privacy 25 of Covered Information identified in response to sub-Provision IV.D. 26 Each safeguard must be based on the volume and sensitivity of the 27 Covered Information that is at risk, and the likelihood that the risk could 28 be realized and result in the unauthorized Collection, maintenance, use, Page 10 of 25 STIPULATED ORDER Case 2:21-cv-09693 Document 3-1 Filed 12/15/21 Page 11 of 35 Page ID #:32 1 or Disclosure of, or provision of access to, Covered Information. Such\n\n3 1. Regular privacy and data security training programs for all 4 (1) employees and (2) independent contractors providing services 5 to the Defendant’s technology team, in each case on at least an 6 annual basis, updated to address any identified internal or external 7 risks and safeguards implemented pursuant to this Order; 8 2. Policies, procedures, and technical measures to comply with\n\n9 COPPA and the COPPA Rule; 10 3. Policies, procedures, and technical measures to prevent the 11 Collection, maintenance, use, or Disclosure of, or provision of\n\n12 access to, Covered Information inconsistent with Defendant’s 13 representations to consumers; 14 4. For those apps that Defendant manually reviews for inclusion in\n\n15 Defendant’s app categorization database, conduct an additional 16 review of a subset of such included apps at least once every twelve 17 (12) months with the first additional review occurring within forty- 18 five (45) days of entry of this Order, to determine whether any 19 apps participating in an Ad Tech Service operated by Defendant 20 should be removed from participating in the Ad Tech Service 21 because they are child-directed; 22 5. Create a record of the child-directed apps that Defendant has\n\n23 banned or removed from participating in its Ad Tech Service; and 24 6. Provide COPPA training, at least once every twelve (12) months,\n\n25 with respect to the proper identification of child-directed Web sites 26 and apps, to assist employees and independent contractors who 27 analyze such sites and apps, including the traffic quality analysts, 28 in performing their duties; Page 11 of 25\n\n1 F. Assess, at least once every twelve (12) months, the sufficiency of any 2 safeguards in place to address the internal and external risks to the 3 privacy of Covered Information, and modify the Privacy Program based 4 on the results;\n\n5 G. Test and monitor the effectiveness of the safeguards at least once every 6 twelve (12) months, and modify the Privacy Program based on the 7 results;\n\n8 H. Select and retain Service Providers capable of safeguarding Personal 9 Information they access through or receive from Defendant, and 10 contractually require Service Providers to implement and maintain 11 safeguards sufficient to address the internal and external risks to the 12 privacy of Personal Information; and\n\n13 I. Evaluate and adjust the Privacy Program in light of any changes to 14 Defendant’s operations or business arrangements, new or more efficient 15 technological or operational methods to control for the risks identified in 16 Provision IV.D of this Order, or any other circumstances that Defendant 17 knows or has reason to know may have an impact on the effectiveness of 18 the Privacy Program or any of its individual safeguards. At a minimum, 19 Defendant must evaluate the Privacy Program at least once every twelve 20 (12) months and modify the Privacy Program based on the results.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "V", "title": "Privacy Assessments by a Third Party", "category": "assessment", "summary": "Defendant must obtain initial and biennial third-party privacy assessments for twenty years from qualified, independent assessors.", "verbatim_text": "25 A. The Assessments must be obtained from a qualified, objective, 26 independent third-party professional (“Assessor”), who: (1) uses 27 procedures and standards generally accepted in the profession; 28 (2) conducts an independent review of the Privacy Program; (3) retains Page 12 of 25 STIPULATED ORDER Case 2:21-cv-09693 Document 3-1 Filed 12/15/21 Page 13 of 35 Page ID #:34 1 all documents relevant to each Assessment for five (5) years after 2 completion of such Assessment; and (4) will provide such documents to 3 the Commission within ten (10) days of receipt of a written request from 4 a representative of the Commission. No documents may be withheld on 5 the basis of a claim of confidentiality, proprietary or trade secrets, work 6 product protection, attorney-client privilege, statutory exemption, or any 7 similar claim.\n\n8 B. For each Assessment, Defendant must provide the Associate Director for 9 Enforcement for the Bureau of Consumer Protection at the Federal Trade 10 Commission with the name, affiliation, and qualifications of the proposed 11 Assessor, whom the Associate Director shall have the authority to 12 approve in his or her sole discretion.\n\n13 C. The reporting period for the Assessments must cover: (1) the first 180 14 days after the Privacy Program has been put in place for the initial 15 Assessment; and (2) each two-year period thereafter for twenty (20) years 16 after issuance of the Order for the biennial Assessments.\n\n17 D. Each Assessment must, for the entire assessment period: (1) determine 18 whether Defendant has implemented and maintained the Privacy Program 19 required by Provision IV of this Order, titled Mandated Privacy Program; 20 (2) assess the effectiveness of Defendant’s implementation and 21 maintenance of sub-Provisions IV.A-I; (3) identify any gaps or 22 weaknesses in, or instances of material noncompliance with, the Privacy 23 Program; (4) address the status of gaps or weaknesses in, or instances of 24 material non-compliance with, the Privacy Program that were identified 25 in any prior Assessment required by this Order; and (5) identify specific 26 evidence (including but not limited to documents reviewed, sampling and 27 testing performed, and interviews conducted) examined to make such 28 determinations, assessments, and identifications, and explain why the Page 13 of 25 STIPULATED ORDER Case 2:21-cv-09693 Document 3-1 Filed 12/15/21 Page 14 of 35 Page ID #:35 1 evidence that the Assessor examined is (a) appropriate for assessing an 2 enterprise of Defendant’s size, complexity, and risk profile; and (b) 3 sufficient to justify the Assessor’s findings. No finding of any 4 Assessment shall rely primarily on assertions or attestations by 5 Defendant’s management. The Assessment must be signed by the 6 Assessor, state that the Assessor conducted an independent review of the 7 Privacy Program and did not rely primarily on assertions or attestations 8 by Defendant’s management, and state the number of hours that each 9 member of the assessment team worked on the Assessment. To the extent 10 that Defendant revises, updates, or adds one or more safeguards required 11 under Provision IV of this Order during an Assessment period, the 12 Assessment must assess the effectiveness of the revised, updated, or 13 added safeguard(s) for the time period in which it was in effect, and 14 provide a separate statement detailing the basis for each revised, updated, 15 or additional safeguard.\n\n16 E. Each Assessment must be completed within sixty (60) days after the end 17 of the reporting period to which the Assessment applies. Unless 18 otherwise directed by a Commission representative in writing, Defendant 19 must submit the initial Assessment to the Commission within ten (10) 20 days after the Assessment has been completed via email to 21 DEbrief@ftc.gov or by overnight courier (not the U.S. Postal Service) to 22 Associate Director for Enforcement, Bureau of Consumer Protection, 23 Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, 24 D.C. 20580. The subject line must begin, “United States v. OpenX 25 Technologies, Inc.” All subsequent biennial Assessments must be 26 retained by Defendant until the Order is terminated and provided to the 27 Associate Director for Enforcement within ten (10) days of request.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "VI", "title": "Cooperation with Third-Party Privacy Assessor", "category": "affirmative_obligation", "summary": "Defendant must provide assessors with all relevant information and materials, ensure network visibility, and not misrepresent material facts.", "verbatim_text": "5 A. Provide or otherwise make available to the Assessor all information and 6 material in its possession, custody, or control that is relevant to the 7 Assessment for which there is no reasonable claim of privilege.\n\n8 B. Provide or otherwise make available to the Assessor information about 9 Defendant’s network(s) and all of Defendant’s IT assets so that the 10 Assessor can determine the scope of the Assessment, and visibility to 11 those portions of the network(s) and IT assets deemed in scope; and\n\n12 C. Disclose all material facts to the Assessor, and not misrepresent in any 13 manner, expressly or by implication, any fact material to the Assessor’s: 14 (1) determination of whether Defendant has implemented and maintained 15 the Privacy Program required by Provision IV of this Order, titled 16 Mandated Privacy Program; (2) assessment of the effectiveness of the 17 implementation and maintenance of sub-Provisions IV.A-I; or (3) 18 identification of any gaps or weaknesses in, or instances of material 19 noncompliance with, the Privacy Program.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Third-Party Assessment" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "VII", "title": "Annual Certification", "category": "compliance_reporting", "summary": "Defendant must provide annual certifications from senior management for ten years confirming compliance with the order and disclosing any material noncompliance.", "verbatim_text": "22 A. One year after the issuance date of this Order, and each year thereafter 23 for ten (10) years after entry of the Order, provide the Commission with a 24 certification from a senior corporate manager, or, if no such senior 25 corporate manager exists, a senior officer of Defendant responsible for 26 Defendant’s Privacy Program that: (1) Defendant has established, 27 implemented, and maintained the requirements of this Order; and (2) 28 Defendant is not aware of any material noncompliance that has not been Page 15 of 25 STIPULATED ORDER Case 2:21-cv-09693 Document 3-1 Filed 12/15/21 Page 16 of 35 Page ID #:37 1 (a) corrected or (b) disclosed to the Commission. The certification must 2 be based on the personal knowledge of the senior corporate manager, 3 senior officer, or subject matter experts upon whom the senior corporate 4 manager or senior officer reasonably relies in making the certification.\n\n6 submit all annual certifications to the Commission pursuant to this Order 7 via email to DEbrief@ftc.gov or by overnight courier (not the U.S. Postal 8 Service) to Associate Director for Enforcement, Bureau of Consumer 9 Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 10 Washington, D.C. 20580. The subject line must begin, “United States v. 11 OpenX Technologies, Inc.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "VIII", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "A judgment of $7,500,000 is entered against Defendant, with $2,000,000 to be paid within seven days and the remainder suspended subject to truthfulness of financial attestations.", "verbatim_text": "17 B. Defendant is ordered to pay to Plaintiff, by making payment to the 18 Treasurer of the United States, two million dollars ($2,000,000), which, 19 as Defendant stipulates, its undersigned counsel holds in escrow for no 20 purpose other than payment to Plaintiff. Such payment must be made 21 within seven (7) days of entry of this Order by electronic fund transfer in 22 accordance with instructions previously provided by a representative of 23 Plaintiff. Upon such payment, the remainder of the judgment is 24 suspended, subject to the Subsections below.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "IX", "title": "Additional Monetary Provisions", "category": "affirmative_obligation", "summary": "Defendant relinquishes rights to transferred assets and acknowledges complaint facts will be taken as true in future litigation.", "verbatim_text": "23 A. Defendant relinquishes dominion and all legal and equitable right, title, 24 and interest in all assets transferred pursuant to this Order and may not 25 seek the return of any assets.\n\n3 which Defendant must submit to the Commission, may be used for 4 collecting and reporting on any delinquent amount arising out of this 5 Order, in accordance with 31 U.S.C. § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "X", "title": "Data Deletion", "category": "affirmative_obligation", "summary": "Defendant must delete all ad request data collected prior to entry of the order within ninety days.", "verbatim_text": "8 entry of this Order, shall delete all Ad Request Data collected prior to the entry of 9 this Order, including any sample of the Ad Request Data used for internal 10 analytics.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Data Deletion" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XI", "title": "Notice to Demand-Side Partners", "category": "affirmative_obligation", "summary": "Defendant must transmit notice to all demand-side partners within thirty days and certify completion within thirty-five days.", "verbatim_text": "14 the notice attached hereto as Exhibit A (“Notice”) by email to all of 15 OpenX’s demand-side partners. 16 B. Defendant, within thirty-five (35) days of entry of this Order, shall\n\n17 provide the Commission with a certification, signed by OpenX’s Chief 18 Executive Officer on behalf of OpenX, that OpenX has transmitted the 19 Notice to all of OpenX’s demand-side partners. 20 XII. ORDER ACKNOWLEDGMENTS", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Consumer Notification" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XII", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Defendant must obtain acknowledgments of receipt of order from itself, current and future personnel, and business entities resulting from structural changes.", "verbatim_text": "24 the Commission an acknowledgment of receipt of this Order sworn under 25 penalty of perjury. 26 B. For ten (10) years after entry of this Order, Defendant must deliver a\n\n27 copy of this Order to: (1) all principals, officers, directors, and LLC 28 managers and members; (2) all employees having managerial Page 18 of 25 STIPULATED ORDER Case 2:21-cv-09693 Document 3-1 Filed 12/15/21 Page 19 of 35 Page ID #:40 1 responsibilities relating to the Collection, retention, storage, or security of 2 Covered Information, and all agents and representatives who have 3 managerial responsibility for the operation of any of Defendant’s Web 4 sites or online services; and (3) any business entity resulting from any 5 change in structure as set forth in the Provision titled Compliance 6 Reporting. Delivery must occur within seven (7) days of entry of this 7 Order for current personnel. To all others, delivery must occur before 8 they assume their responsibilities.\n\n9 C. From each individual or entity to which Defendant delivered a copy of 10 this Order, Defendant must obtain, within thirty (30) days, a signed and 11 dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XIII", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendant must submit compliance reports and notices describing its businesses, compliance status, and any changes in structure or designated contacts.", "verbatim_text": "3 managerial responsibility for the operation of any of Defendant’s Web 4 sites or online services; and (3) any business entity resulting from any 5 change in structure as set forth in the Provision titled Compliance 6 Reporting. Delivery must occur within seven (7) days of entry of this 7 Order for current personnel. To all others, delivery must occur before 8 they assume their responsibilities. 9 C. From each individual or entity to which Defendant delivered a copy of 10 this Order, Defendant must obtain, within thirty (30) days, a signed and 11 dated acknowledgment of receipt of this Order. 12 XIII. COMPLIANCE REPORTING 13 IT IS FURTHER ORDERED that Defendant make timely submissions to 14 the Commission: 15 A. One year after entry of this Order, Defendant must submit a compliance 16 report, sworn under penalty of perjury, which does the following: (a) 17 identify the primary physical, postal, and email address and telephone 18 number, as designated points of contact, which representatives of the 19 Commission and Plaintiff may use to communicate with Defendant; (b) 20 identify all of Defendant’s businesses by all of their names, telephone 21 numbers, and physical, postal, email, and Internet addresses; (c) describe 22 the activities of each business; (d) describe in detail whether and how 23 Defendant is in compliance with each Provision of this Order; (e) provide 24 a copy of each different version of any privacy notice posted on each 25 Web site or online service operated by Defendant; (f) provide a statement 26 setting forth OpenX’s treatment of Child-directed Web sites and online 27 services; and (g) provide a copy of each Order Acknowledgment 28 obtained pursuant to this Order, unless previously submitted to the Page 19 of 25\n\n2 B. For ten (10) years after entry of this Order, Defendant must submit a 3 compliance notice, sworn under penalty of perjury, within fourteen (14) 4 days of any change in the following: (a) any designated point of contact; 5 or (b) the structure of Defendant or any entity that Defendant has any 6 ownership interest in or controls directly or indirectly that may affect 7 compliance obligations arising under this Order, including: creation, 8 merger, sale, or dissolution of the entity or any subsidiary, parent, or 9 affiliate that engages in any acts or practices subject to this Order.\n\n10 C. Defendant must submit to the Commission notice of the filing of any 11 bankruptcy petition, insolvency proceeding, or similar proceeding by or 12 against each Defendant within fourteen (14) days of its filing.\n\n13 D. Any submission to the Commission required by this Order to be sworn 14 under penalty of perjury must be true and accurate and comply with 28 15 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury 16 under the laws of the United States of America that the foregoing is true 17 and correct. Executed on: _____” and supplying the date, signatory’s full 18 name, title (if applicable), and signature.\n\n19 E. Unless otherwise directed by a Commission representative in writing, all 20 submissions to the Commission pursuant to this Order must be emailed to 21 DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal 22 Service) to: Associate Director for Enforcement, Bureau of Consumer 23 Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, 24 Washington, D.C. 20580. The subject line must begin: “United States v. 25 OpenX Technologies, Inc.”", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XIV", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendant must create and retain specific records for ten years after entry of order, with each record retained for five years.", "verbatim_text": "5 A. Accounting records showing the revenues from all goods or services 6 sold; 7 B. All records necessary to demonstrate full compliance with each provision 8 of this Order, including all submissions to the Commission;\n\n9 C. Copies of all consumer complaints relating to Defendant’s Collection, 10 maintenance, use, or Disclosure of Covered Information, whether\n\n11 received directly or indirectly, such as through a Third Party, and any 12 response; and 13 D. A copy of each materially different document widely disseminated or 14 caused to be widely disseminated by Defendant containing any\n\n15 representation regarding Defendant’s Collection, maintenance, use, or 16 Disclosure practices pertaining to Covered Information. 17 XV. COMPLIANCE MONITORING", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XV", "title": "Compliance Monitoring", "category": "monitoring", "summary": "Commission and Plaintiff are authorized to monitor compliance through document requests, depositions, interviews, and other lawful means.", "verbatim_text": "21 A. Within fourteen (14) days of receipt of a written request from a 22 representative of the Commission or Plaintiff, Defendant must: submit 23 additional compliance reports or other requested information, which must 24 be sworn under penalty of perjury; appear for depositions; and produce 25 documents for inspection and copying. The Commission and Plaintiff are 26 also authorized to obtain discovery, without further leave of court, using 27 any of the procedures prescribed by Federal Rules of Civil Procedure 29, 28 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.\n\n1 B. For matters concerning this Order, the Commission and Plaintiff are 2 authorized to communicate directly with Defendant. Defendant must 3 permit representatives of the Commission and Plaintiff to interview any 4 employee or other Person affiliated with Defendant who has agreed to 5 such an interview. The Person interviewed may have counsel present.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "XVI", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction for purposes of construction, modification, and enforcement of the order.", "verbatim_text": "13 XVI. RETENTION OF JURISDICTION 14 IT IS FURTHER ORDERED that this Court retains jurisdiction of this", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.21_openx_technologies", "company_name": "OpenX Technologies, Inc.", "date_issued": "2021-12-15", "year": 2021, "administration": "Biden", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998, 15 U.S.C. §§ 6502(c) and 6505(d)", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/1923019-openx-technologies-inc", "docket_number": "2:21-cv-09693" }, { "provision_number": "I", "title": "Injunction Concerning Collection of Personal Information from Children", "category": "prohibition", "summary": "Defendants are permanently enjoined from failing to provide required direct notice to parents, failing to post required online notice of information practices regarding children, failing to obtain verifiable parental consent before collecting personal information from children, and from violating the COPPA Rule.", "verbatim_text": "A. Failing to make reasonable efforts, taking into account available 13 technology, to ensure that a Parent of a Child receives direct notice as required by 14 Section 312.4(c) of the Rule, 16 C.F.R. § 312.4(c). unless the COPPA Rule, 16 15 C.F.R. Part 312 (Appendix A), provides an exception to providing such notice;\n\n17 B. Failing to post a prominent and clearly labeled link to an online notice 18 of Defendants' information practices with regard to Children on the home or 19 landing page or screen of Defendants' website or online service, and at each area 20 of Defendants' website or online service where Personal Information is Collected 21 from Children, unless the COPPA Rule, 16 C.F.R. Part 312 (Appendix A), 22 provides an exception to providing such notice;\n\n1 C. Failing to Obtain Verifiable Parental Consent before any Collection, 2 use, or Disclosure of Personal Information from Children, including consent to any 3 material change in the Collection, use, or Disclosure practices to which the Parent 4 has previously consented, unless COPPA Rule, 16 C.F.R. Part 312 (Appendix A), 5 provides an exception to Obtaining Verifiable Parental Consent; and\n\nD. Violating the COPPA Rule, 16 C.F.R. Part 312 (Appendix A).", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Prohibition" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "II", "title": "Mandated Audience Designation Program", "category": "affirmative_obligation", "summary": "Defendants must establish, implement, and maintain for ten years a program to review each of their YouTube videos to determine whether it is a Kids Video and, if so, designate it as Made for Kids, with specific minimum requirements for documentation, staffing, training, and annual assessment.", "verbatim_text": "IT IS FURTHER ORDERED that Defendants, to the extent Defendants Publish Video(s) to a channel on the YouTube Platform, must, within one-hundred 11 eighty (180) days of the date of entry of this Order, establish and implement, and 12 thereafter maintain for ten (10) years, a program to review whether each of 13 Defendants' Videos on the YouTube Platform is a Kids Video, and, if in 14 15 Defendants' assessment it is, designate the Video as Made for Kids (\"Audience 16 Designation Program\"); however, nothing in this Provision II is required in the 17 event that: (1) the Y ouTube Platform no longer enables content creators to 18 designate the audience for a Video as Made for Kids; or (2) the YouTube Platform 19 implements measures to determine the age, age range, or age category of all 20 YouTube users and either (a) the YouTube Platform restricts the collection of 21 22 Personal Information, consistent with the COPPA Rule, 16 C.F.R. Part 312, from 23 Children, or (b) the Y ouTube Platform enables Defendants to restrict the collection\n\nA. Defendants must document in writing the relevant content, 5 implementation, and maintenance of the Audience Designation Program;\n\nB. Defendants must designate a qualified employee or employees to 7 8 coordinate and be responsible for the Audience Designation Program;\n\nC. Defendants must provide the written Audience Designation Program 10 to a senior employee responsible for the Audience Designation Program at least 11 once every twelve (12) months;\n\nD. Defendants must train employees with roles and responsibilities in 13 Publishing Videos on the Y ouTube Platform on the requirements of the Audience 14 15 Designation Program upon hire and, at least once every twelve (12) months 16 thereafter; and\n\nE. Assess and document, at least every twelve (12) months, the 18 effectiveness of the Audience Designation Program.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Comprehensive Security Program" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "III", "title": "Monetary Judgment for Civil Penalty", "category": "affirmative_obligation", "summary": "Judgment is entered against Defendants for a $10,000,000 civil penalty, which must be paid to the U.S. Treasury within seven days of entry of the Order by electronic fund transfer.", "verbatim_text": "A. Judgment in the amount of ten million dollars ($10,000,000) is 4 entered in favor of Plaintiff against Defendants, as a civil penalty.\n\nB. Defendants are ordered to pay to Plaintiff, by making payment to the 6 Treasurer of the United States, ten million dollars ($10,000,000), which, as 7 8 Defendants stipulate, their undersigned counsel holds in escrow for no purpose 9 other than payment to Plaintiff. Such payment must be made within seven (7) days 10 of entry of this Order by electronic fund transfer in accordance with instructions 11 provided by a representative of Plaintiff.\n\nC. Defendants relinquish dominion and all legal and equitable right, title, 13 and interest in all assets transferred pursuant to this Order and may not seek the 14 15 return of any assets.\n\nD. The facts alleged in the Complaint will be taken as true, without 17 further proof, in any subsequent civil litigation by or on behalf of the Commission 18 in a proceeding to enforce its rights to any payment or monetary judgment pursuan 19 to this Order.\n\nE. Defendants acknowledge that their Taxpayer Identification Numbers, 21 22 which Defendants must submit to the Commission, may be used for collecting and 23 Page 15 of25 PROPOSED ORDE 1 reporting on any delinquent amount arising out of this Order, in accordance with 2 31 U S C § 7701.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Monetary Penalty" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "IV", "title": "Order Acknowledgments", "category": "acknowledgment", "summary": "Each Defendant must submit a sworn acknowledgment of receipt of the Order within 10 days, deliver copies to principals, officers, covered employees, and agents within 10 days (or before they assume responsibilities), and obtain signed acknowledgments from each recipient within 30 days.", "verbatim_text": "7 A. Each Defendant, within ten (10) days of entry of this Order, must 8 submit to the Commission an acknowledgment of receipt of this Order sworn 9 under penalty of perjury.\n\nB. For five (5) years after entry of this Order, each Defendant must 11 deliver a copy of this Order to: (1) all principals, officers, directors, managers and 12 members; (2) all employees of a Covered Entity having managerial 13 14 responsibilities for conduct related to the subject matter of the Order, and all 15 agents and representatives of a Covered Entity who participate in conduct related 16 to the subject matter of the Order; and (3) any business entity resulting from any 17 change in structure as set forth in the Provision titled Compliance Reporting. 18 Delivery must occur within ten (10) days of entry of this Order for current 19 personnel. For all others, delivery must occur before they assume their 20 21 responsibilities.\n\n1 C. From each individual or entity to which a Defendant delivered a copy 2 of this Order, that Defendant must obtain, within thirty (30) days, a signed and 3 dated acknowledgment of receipt of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "V", "title": "Compliance Reporting", "category": "compliance_reporting", "summary": "Defendants must submit an initial sworn compliance report one year after entry, ongoing sworn notices within 14 days of any structural or contact changes for ten years, bankruptcy notices within 14 days of filing, and all submissions must comply with perjury-declaration requirements and be sent to the designated FTC address.", "verbatim_text": "A. One year after entry of this Order, each Defendant must submit a 9 compliance report, sworn under penalty of perjury, in which each Defendant must: 10 (a) identify the primary physical, postal, and email address and telephone number, 11 as designated points of contact, which representatives of the Commission and 12 Plaintiff may use to communicate with that Defendant; (b) identify the Covered 13 14 Entities by all of their names, telephone numbers, and physical, postal, email, and 15 Internet addresses; (c) describe that Defendant's use of each Covered Service to 16 Publish Videos; ( d) describe in detail whether and how that Defendant is in 17 compliance with each Provision of this Order; (e) provide a copy of each 18 materially different version of any Defendant privacy notice for each Covered 19 Service or notice sent to Parents of Children that register for each Covered Service 20 21 unless the COPPA Rule, 16 C.F.R. Part 312 (Appendix A), provides an exception 22 to providing such notice, in which case the Defendant will solely be required to 23 identify the applicable exception; (f) provide a statement setting forth in detail the Page 17 of25 PROPOSED ORDE 1 methods used to Obtain Verifiable Parental Consent prior to any Collection, use, 2 and/or Disclosure of Personal Information from Children in connection with use 3 of each Covered Service, unless the COPPA Rule, 16 C.F.R. Part 312 (Appendix 4 A), provides an exception to providing such Verifiable Parental Consent, in which 5 case the Defendant will solely be required to identify the applicable exception; (g) 6 provide a statement setting forth in detail the means provided for Parents to 7 8 review the Personal Information, if any, Collected by that Defendant from their 9 Children through any Covered Service and to refuse to permit that Defendant's 10 further use or maintenance for each Covered Service; and (h) provide a copy of 11 each Order Acknowledgment obtained pursuant to this Order, unless previously 12 submitted to the Commission.\n\nB. For ten (10) years after entry of this Order, each Defendant must 14 15 submit a compliance notice, sworn under penalty of perjury, within fourteen (14) 16 days of any change in: (a) any designated point of contact; or (b) the structure of 17 Defendant or any entity that Defendant has any ownership interest in or controls, 18 directly or indirectly, that may affect compliance obligations arising under this 19 Order, including: creation, merger, sale, or dissolution of the entity or any 20 subsidiary, parent, or affiliate that engages in any acts or practices related to that 21 22 Defendant's compliance with the COPPA Rule, 16 C.F.R. Part 312 (Appendix A), 23 or that Publishes Videos to a Covered Service subject to this Order.\n\n1 C. Each Defendant must submit to the Commission notice of the filing of 2 any bankruptcy petition, insolvency proceeding, or similar proceeding by or 3 against such Defendant within fourteen (14) days of its filing.\n\nD. Any submission to the Commission required by this Order to be 5 sworn under penalty of perjury must be true and accurate and comply with 28. 6 U S C § 1746, such as by concluding: \"I declare under penalty of perjury under 7 8 the laws of the United States of America that the foregoing is true and correct. 9 Executed on: __\" and supplying the date, signatory's full name, title (if 10 applicable), and signature.\n\nE. Unless otherwise directed by a Commission representative in writing, 12 all submissions to the Commission pursuant to this Order must be emailed to 13 DEbrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: 14 15 Associate Director for Enforcement, Bureau of Consumer Protection, Federal 16 Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The 17 subject line must begin: United States v. Disney Worldwide Services, Inc.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "VI", "title": "Recordkeeping", "category": "recordkeeping", "summary": "Defendants must create specified records for ten years after entry of the Order and retain each such record for five years, covering accounting records, personnel records, consumer complaints, and all records necessary to demonstrate full compliance.", "verbatim_text": "1 A. Accounting records showing any revenues related to a Covered 2 Service;\n\nB. Personnel records showing, for each Person having managerial 4 responsibility for using a Covered Service on behalf of a Covered Entity, whether 5 as an employee or otherwise, that Person's: name; addresses; telephone numbers; 6 job title or position; dates of service; and (if applicable) the reason for 7 8 termination;\n\nC. Records of all consumer complaints relating to that Defendant's 10 Collection of Personal Information from Children through each Covered Service, 11 and any response; and\n\nD. All records necessary to demonstrate full compliance with each 13 Provision of this Order, including all submissions to the Commission.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Recordkeeping" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "VII", "title": "Compliance Monitoring", "category": "monitoring", "summary": "The Commission and Plaintiff are authorized to monitor Defendants' compliance through information requests, depositions, document discovery, direct communications, employee interviews, and undercover methods, with Defendants required to respond within 14 days of written requests.", "verbatim_text": "A. Within fourteen (14) days of receipt of a written request from a 19 representative of the Commission or Plaintiff, each Defendant must: submit 20 21 additional compliance reports or other requested information, which must be 22 sworn under penalty of perjury; appear for depositions; and produce documents 23 for inspection and copying. The Commission and Plaintiff are also authorized to Page 20 of25 PROPOSED ORDE 1 obtain discovery, without further leave of court, using any of the procedures 2 prescribed by Federal Rules of Civil Procedure 29, .1Q. (including telephonic 3 depositions), 31, 33, 34, 36, 45, and 69.\n\nB. For matters concerning this Order, the Commission and Plaintiff are 5 authorized to communicate directly with Defendants. Defendants must permit 6 representatives of the Commission and Plaintiff to interview any employee or 7 8 other Person affiliated with any Defendant who has agreed to such an interview. 9 The Person interviewed may have counsel present.\n\nC. The Commission and Plaintiff may use all other lawful means, 11 including posing, through its representatives, as consumers, suppliers, or other 12 individuals or entities, to Defendant or any individual or entity affiliated with 13 Defendants, without the necessity of identification or prior notice. Nothing in this 14 15 Order limits the Commission's lawful use of compulsory process, pursuant to 16 Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-l.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Compliance Monitoring" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" }, { "provision_number": "VIII", "title": "Retention of Jurisdiction", "category": "duration", "summary": "The Court retains jurisdiction over this matter for purposes of construction, modification, and enforcement of this Order.", "verbatim_text": "IT IS FURTHER ORDERED that this Court retains jurisdiction of this 19 matter for purposes of construction, modification, and enforcement of this Order.", "violation_type": "both", "statutory_topics": [ "COPPA" ], "practice_areas": [ "Privacy" ], "remedy_types": [ "Order Administration" ], "case_id": "12.25_disney", "company_name": "Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC", "date_issued": "2025-12-15", "year": 2025, "administration": "Trump (2nd)", "legal_authority": "Section 5(a) of the Federal Trade Commission Act, 15 U.S.C. § 45(a); Sections 1303(c) and 1306(d) of the Children's Online Privacy Protection Act of 1998 (COPPA), 15 U.S.C. §§ 6502(c) and 6505(d); Children's Online Privacy Protection Rule (COPPA Rule), 16 C.F.R. Part 312", "ftc_url": "https://www.ftc.gov/legal-library/browse/cases-proceedings/disney", "docket_number": "2:25-cv-08223" } ] }