To settle charges that it violated the Children’s Online Privacy Protection Act (COPPA), a California-based website reached a deal with the New Jersey attorney general that included a civil penalty of just under $100,000.
Unixiz operated the “i-Dressup” website where users could dress, style and put makeup on animated characters. The “social hangout” site also offered games under the headings “Popular,” “Fashion,” “Barbie,” “Room,” “Celebrity,” “Girls” and “Fantasy,” as well as cartoon avatars that appeal to children (such as Snow White).
According to the New Jersey AG, however, Unixiz had actual knowledge that the site collected and maintained the personal information of more than 10,000 children in the state, including their first and last name, email address, birth date, gender and other information volunteered by users. The site also gathered persistent identifiers, the AG said, like first- and third-party cookies and IP addresses. Despite all these collection efforts, Unixiz failed to obtain verifiable parental consent for 2,519 of the children in New Jersey.
In addition, Unixiz failed to appropriately safeguard user account information, the AG said, and a September 2016 data breach exposed approximately 2.2 million usernames and passwords, of which 24,476 were New Jersey users.
To settle the charges that the site ran afoul of COPPA and the New Jersey Consumer Fraud Act, the parties reached a deal. Unixiz promised not to engage in any unfair or deceptive acts or practices and to affirmatively comply with all requirements of both state and federal laws, particularly with regard to any website or online service directed to children (including obtaining verifiable parental consent prior to the collection of information).
Unixiz also agreed to implement policies and procedures to safeguard users’ account information and shut down the “i-Dressup” site. A $98,618 civil penalty will be partially suspended upon payment of $34,000 if the company complies with all aspects of the consent order.
To read the consent order in In the Matter of Unixiz, Inc., click here.
Why it matters: “Children are extremely vulnerable on the internet and we must do all we can to protect them from being exploited by advertisers or tracked by internet predators,” AG Gurbir S. Grewal said in a statement. “We are committed to vigorously enforcing state and federal privacy protections, and we will do everything we can to ensure that website operators comply with their duty to provide an extra layer of security on sites catering to young children.”