Some Disney smartphone apps collect kids' personal information without parents' permission and use that information to make money, a San Francisco woman and her child claim in a class-action lawsuit filed last week.
The suit claims that Amanda Rushing never gave permission for the app Disney Princess Palace Pets to collect information on her child when she downloaded it starting in 2014, and was never asked for her consent. Nevertheless, the app used a personal identifier that marketers would be able to use to build a profile to return tailored advertising to the child, referred to in the suit as L.L.
According to the lawsuit, the practice violates the federal Children's Online Privacy Protection Act, or COPPA, which prevents the collection of personal information of children under 13 without parental consent. The suit was filed Thursday in a federal court in Northern California.
"Defendants' tracking and collection of L.L.'s personal information without her verifiable parental consent is highly offensive to Ms. Rushing and constitutes an invasion of her child's privacy and of Ms. Rushing's right to protect her child from this invasion," the suit says.
A Walt Disney Company representative told NBC News that the lawsuit misinterprets the law.
"Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families. The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in Court," they said in a statement.
The lawsuit also names as a defendant a software company whose kits were used to develop the game. The company's software was also used in many other other Disney game apps, like Disney Build It Frozen and Moana Island Life, the suit claims.
Information gathered by apps like these is used to make money, privacy expert Bob Sullivan told NBC's "Today" show.
"Virtually all apps do this kind of data collection because that's the reason that companies make apps," Sullivan said. "If they're not charging you for them, they have to make money somehow, and they all make money by collecting data and selling it."
He said the suit was one of the first he's seen to call such data collection an invasion of privacy.