CDD Charges Mobile Game Company with Violation of COPPA

The Center for Digital Democracy (CDD) filed a complaint with the Federal Trade Commission (FTC) calling for an investigation of and action against the Mobbles Corporation for operating the mobile application Mobbles in violation of the Children’s Online Privacy Protection Act (COPPA).

Mobbles, a game involving virtual pets, is directed at children under age 13. It collects personal information from children without providing any notice to parents (nor even attempting to obtain verifiable parental consent), as required by law. Available since May 2012 on iTunes for the iPhone and from the Google Play store for Android devices, Mobbles has ranked among the top 100 grossing “Entertainment” iTunes apps in 24 countries, and among the top 10 in 10 countries. Between 10,000 and 50,000 users downloaded Mobbles over the last 30 days in the Google Play store alone. An elaborate, location-based game that involves capturing, collecting, trading, and caring for virtual pets, “Mobbles” raises a number of privacy and child-safety issues, CDD’s complaint explains. First, because Mobbles is a location-based game, it uses smart-phone technology both to determine and to share the precise physical location of children playing the game. Second, because users must be within 54 yards of a Mobble to “catch” it, the game encourages children to wander around at all hours to get close enough to capture a particular Mobble (some of which are only available at night). Third, through its newsletter sign-up and registration required for pet trading, Mobbles collects children’s email addresses and other contact information without parental notice or consent. And, finally, although many of the game’s items are available free (as is the game itself), Mobbles encourages the expenditure of actual funds (via credit-card accounts) to acquire virtual items that are only available for purchase.

As CDD’s complaint makes clear, Mobbles violates COPPA’s requirement that any online service directed at children provide notice “of what information it collects from children, how it uses such information, and its disclosure practices for such information,” and obtain parental consent before collecting personal information from a child. Mobbles provides no privacy policies nor does it make any attempt to obtain parental consent before collecting a child’s physical address, online contact information, or the online contact information of a child’s friends.