FTC Requires Algorithmic Disgorgement as a COPPA Remedy for First Time

On March 4, the Federal Trade Commission (FTC) and Department of Justice (DOJ) announced a settlement agreement with WW International and its subsidiary, Kurbo (Kurbo by WW), after charging the companies with violating the Children’s Online Privacy Protection Act (COPPA) for improperly collecting health information and other data from children as young as eight years old. Among other penalties, the settlement requires the deletion of all “affected work product”–which includes algorithms–resulting from the companies’ collection of children’s data. Significantly, this is the first time that the FTC has imposed an algorithmic disgorgement penalty in a COPPA enforcement action, a measure that reflects the Commission’s increasing focus on algorithmic fairness.

The COPPA Claim

Aimed at protecting children under 13, COPPA applies to online service providers and commercial websites that (1) are directed to children and collect, use, or disclose children’s personal information; (2) have actual knowledge that children use the provider’s online service; or (3) provide a third party service to websites or online service providers that collect information from children. Among other requirements, services subject to COPPA must:

1. Give parental notice before collecting, using, or disclosing child data;
2. Make reasonable efforts to ensure parents receive direct notice of the collection, use, or disclosure of child data; 
3. Obtain verifiable parental consent (VPC) before the collection, use, or disclosure of child data; and 
4. Retain child data no longer than necessary to further the purpose for which the provider collected the information.

Here, the FTC and DOJ alleged that Kurbo by WW, a service marketed to children under 13, failed to provide adequate notice and obtain VPC before collecting personal information including weight, height, food intake, and physical activity. Specifically, the agencies argued that the measures Kurbo by WW did take, such as an age gate, were insufficient under the rule, and even incentivized children to lie about their birthdate to circumvent the measures. Moreover, the agencies alleged Kurbo by WW retained child data indefinitely, and would only delete upon parent request. The settlement imposes multiple remedies, including injunctive relief, monetary fines, engaging in compliance reporting, and, significantly, a requirement that Kurbo by WW delete all work product resulting from the collection of children’s personal information.

The Significance of This Settlement

The significant part of this settlement is the algorithmic disgorgement penalty: the requirement that the companies delete all algorithms resulting–in part or in whole–from the inappropriate collection of children’s data. The FTC imposed this penalty for the first time in 2019 in a final order against Cambridge Analytica. The agency used the remedy again in the 2021 Everalbum settlement, in which the developers of a photo app were required to delete facial recognition algorithms developed through training on data that was improperly collected. In a significant next step, this is the first time we have seen the agency impose the penalty in a COPPA settlement. Like monetary fines, compliance reporting, and other injunctive relief, algorithmic disgorgement is a measure intended to deter companies from improperly collecting and retaining child data. However, the penalty goes a step further than other COPPA remedies by preventing companies from benefiting from the improperly collected data in the future. In the FTC’s press release for the settlement, FTC Chair Lina Khan remarked, “Our order against these companies requires them to delete their ill-gotten data, destroy any algorithms derived from it, and pay a penalty for their lawbreaking.” This strong language from the FTC Chair signals an interest in doing more to hold companies subject to COPPA accountable.

Recently, child privacy has become a trending topic for both policymakers and enforcement agencies. Historically, the FTC tends to bring only a few COPPA cases per year, but the Kurbo by WW settlement marks the FTC’s second COPPA settlement in just three months. Time will tell whether COPPA enforcement actions become more frequent in the wake of increasing calls to protect children’s privacy. Regardless, this settlement stands to impact future COPPA enforcement by setting a new precedent for the penalties the FTC is willing to impose on companies. It also raises important questions about how companies can obtain effective VPC, an issue FPF’s Youth & Education team is exploring in our report on The State of Play: Verifiable Parental Consent and COPPA. Companies with child audiences should pay close attention to this settlement and its penalties, and ensure their practices are complying with COPPA.

Additional Resources:

FTC Blog Post on the Kurbo by WW settlement for Businesses 

For more on COPPA and VPC, see FPF’s Work on Verifiable Parental Consent (VPC) at thestateofplay.org