Disney doesn’t need to create a villain for their latest story.
A class-action lawsuit claims the Walt Disney Company has been collecting and sharing personal data from children without parental consent, according to a report in The Verge.
The suit, filed by California woman Amanda Rushing, alleges that 42 of Disney’s apps contain embedded software designed to collect personal information and sell it to third parties for targeted advertisements. Rushing claims that her daughter had her data tracked and sold while playing the “Disney Princess Palace Pets” app.
If true, the plaintiff says this would be a violation of the Children’s Online Privacy Protection Act. Under COPPA, companies are required to gain permission from parents before collecting and selling personal information from children. As of a 2013 revision, that personal information includes location markers and IP addresses.
The lawsuit also targets three software companies — Upsight, Unity and Kochava — which allegedly helped develop the trackers and install them in the apps.
“These are heavy-duty technologies, industrial-strength data and analytic companies whose role is to track and monetize individuals,” Jeffrey Chester, executive director of the Center for Digital Democracy, told the Washington Post. “These should not be in little children’s apps.”
The apps in question are extremely popular. “Where’s My Water? 2,” one of the apps listed in the suit, has been installed between 100 million and 500 million times, according to the Washington Post.
Disney responded to the claim by saying they have a “robust COPPA compliance program” and that they “look forward to defending this action in court.”
It’s not the first time Disney has been on the wrong end of a COPPA violation. In 2011, the FTC fined Disney subsidiary Playdom $3 million for tracking information from “hundreds of thousands of children under age 13” without parental consent.