Facts

Since at least 2014, Kurbo, Inc., a subsidiary of WW International, Inc., a weight loss support company, offered a weight management service called Kurbo by WW to children and teens through its website and application. Kurbo by WW allowed children at least 13 years old to enter information about their food intake and daily activities. If the child was under 13, a parent would need to register the account for them. However, children under 13 could claim to be 13 on the initial questionnaire screen and enter their true age later without losing account access. As such, Kurbo by WW collected information from users of any age, including their names, email addresses, height, weight, and food intake. Starting in November 2019, Kurbo by WW would notify parents upon registering their children that the service collected the child's information but did not specify all of the categories of information it collected. Although Kurbo by WW initially retained user information indefinitely, in August 2021, the service began deleting user information after three years unless a parent requested deletion. The United States filed an action alleging that defendants violated the Children's Online Privacy Protection Act (COPPA), which prohibits the unauthorized or unnecessary collection of children's personal information online. It sought a permanent injunction to prevent any future COPPA violations, as well as civil penalties and other equitable relief.

PLAINTIFF'S CONTENTIONS: Plaintiff contended that defendants are subject to COPPA because Kurbo by WW is specifically designed and marketed for use by children as young as 8 years old. It also argued that defendants failed to make any efforts to provide parents direct notice that it was collecting their children's personal information before November 2019 and even after, did not solicit parental consent to collect and disclose this information; failed to post a prominent and clearly labeled link to an online notice of information regarding the collected personal information; and retained the child's personal information for longer than reasonably necessary to fulfill the purpose for which it was collected since Kurbo by WW retained the information even if a user was not active.

DEFENDANT'S CONTENTIONS: Defendants neither admitted nor denied any allegations in the complaint. Defendants waived any claim that they may have under the Equal Access to Justice Act.

Result

The case settled. The settlement order requires defendants to delete personal information collected from children, destroy any personal information already collected, maintain a compliance reporting system for ten years after the order, and pay a $1.5 million penalty.