‘Invasive and Surreptitious’: Class Action Claims Kochava Secretly Collects Children’s Data Through Disney Mobile Apps

A proposed class action filed this week claims online advertising services firm Kochava, Inc. has used computer code embedded in child-directed mobile apps and games to surreptitiously collect the personal data of children who use the apps, monitor their behavior across the internet, and build detailed profiles of each child to sell for commercial gain.

Among the apps through which Kochava allegedly gathers its data are those developed by The Walt Disney Company, including Princess Palace Pets, Where’s My Water?, Where’s My Water? Lite, Where’s My Water? Free, and Where’s My Water? 2, the case, filed August 9 in Idaho federal court, states. The suit alleges, however, that Kochava collects children’s personal data through “many thousands” of other child-focused apps and thus “secretly and invasively track[s] and monitor[s] hundreds of millions of children, worldwide.”

The 75-page lawsuit centers on the defendant’s software development kit (SDK)—i.e., computer code embedded within child-directed gaming apps—that collects and transmits sensitive data about the user “beneath the surface of the game.” Unbeknownst to the child (and their parents, the suit adds), the SDK gathers what are known as “persistent identifiers,” or a string of unique data points similar to a Social Security number for a particular device, and uses them to monitor a child’s behavior across devices, apps, and websites, the lawsuit alleges.

Using this personalized data, Kochava works with a network of advertisers and data aggregators to build detailed profiles of individual users, most of whom are minors, and commercially exploit the information for data-driven advertising purposes, the case argues. According to the lawsuit, Kochava uses the secretly acquired information to “make money for itself and its clients”—all at the expense of children’s privacy and without their parents’ consent.

“By collecting and sharing Plaintiffs’ personal information in order to assist in profiling and tracking them across multiple online platforms, and failing to obtain Plaintiffs’ permission, Defendants have breached Plaintiffs’ expectations of privacy,” the complaint scathes.

What Information Is Being Collected?

Persistent identifiers, the suit explains, are a unique set of data points that can link one specific user to their activity across all their apps and devices and allows them to be tracked over time. According to the suit, the most common persistent identifiers used by Apple are the ID for Advertisers (IDFA) and ID for Vendors (IDFV), which are used to identify a specific device and the individual who uses that device. The Android operating system, the case says, uses the Android Advertising ID (AAID) and the Android ID.

Per the lawsuit, Kochava uses persistent identifiers to track users and learn additional information about them, including their behaviors, demographics and preferences.

Moreover, the suit adds, Kochava’s SDK also tracks each Apple and Android device’s “Device Fingerprint” data, which includes information about the device’s hardware (i.e., whether it’s an Apple iPhone, Samsung Galaxy, Apple iPad, etc.), software (i.e., iOS or Android), network carrier, whether it’s connected to WiFi, and the device’s “nickname,” such as “Jane Minor’s iPhone.”

The case explains that the data exfiltrated by Kochava can be combined with data collected by third parties – for instance, app usage, geographic location and internet navigation – to generate a detailed profile about a specific child that can be used for the defendant’s financial gain:

Kochava aggregates this data, and also acquires it from and makes it available it to other third parties, all the while amassing more data points on users to build ever-expanding profiles for enhanced targeting. Across the burgeoning online advertising ecosystem – often referred to as the ‘mobile digital marketplace’ – multiple ad networks or other third-parties can buy and sell data, exchanging databases amongst themselves, creating an increasingly sophisticated profile of how, when, and why a child uses her mobile device, along with all of the demographic and psychographic inferences that can be drawn therefrom.”

The lawsuit claims the SDK embedded into certain apps used by children, including the Disney apps mentioned above, tracks specific users’ persistent identifiers as soon as they begin playing the game.

The complaint notes that Disney itself has already been sued by one of the plaintiffs in this case over the entertainment behemoth’s alleged role in surreptitiously collecting children’s data through its gaming apps.

How Does Kochava Use Children’s Data?

Behind Kochava’s alleged data collection and aggregation activities is the lucrative business of targeted advertising, the lawsuit attests.

According to the complaint, Kochava claims to have “the world’s largest independent mobile advertising platform offering precise audience targeting capabilities.” Kochava markets its arsenal of advertising services by touting its vast first-hand collection of individual users’ personal data, which can be used by advertisers to place highly effective ads, the case relays.

Per the suit, children and teens specifically are “prime targets for advertisers” given they often influence the spending habits of their families and “are more vulnerable to deception.”

The lawsuit claims Kochava, developers and third-party advertisers not only use targeted ads to influence children’s behavior and spending patterns, but can leverage their data to “hook” them into continuing to play an app when they may have otherwise grown disinterested. Per the suit, Kochava’s “predictive behavior modeling” technology allows specific children to be targeted with “reengagement efforts” to keep them playing the app more often and for longer periods of time. 

The lawsuit claims targeted ads can have myriad negative effects on children, including “increas[ed] conflict with their parents, cynicism, health issues, and increased materialism,” while targeted reengagement efforts “expos[e] them to the negative outcomes associated with increased mobile device usage.”

According to the lawsuit, the defendant’s conduct, which is allegedly undertaken without the knowledge or consent of children’s parents or guardians, is “highly offensive” and prohibited by various state privacy laws.

Who Does the Lawsuit Look to Cover?

The case looks to represent all parents or legal guardians of individuals residing in Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Georgia, Hawaii, Idaho, Illinois, Iowa, Kansas, Kentucky, Louisiana, Maine, Maryland, Minnesota, Missouri, Nevada, New Hampshire, New Jersey, North Carolina, Ohio, Oklahoma, Oregon, Pennsylvania, South Dakota, Texas, Utah, Vermont, Washington, and West Virginia who are younger than 18, or were younger than 18 when they played a child-directed app containing Kochava’s SDK, and from whom the defendant collected, used or disclosed personal data.

The lawsuit proposes separate, state-specific subclasses of parents and guardians of individuals who fit the above criteria and reside in California, New York and Massachusetts.

How Do I Join the Lawsuit?

There is typically nothing you need to do to join, or be considered a part of, a class action lawsuit. Usually those covered by a class action, i.e., the “class members,” would only need to take action if and when a case settles. In the event of a settlement, class members are usually given an opportunity to file a claim for whatever compensation the court deems appropriate.

In the meantime, one of the most important things you can do is to stay informed. Check back to this page for updates, or sign up for ClassAction.org’s free weekly newsletter here to have news about class action cases and settlements sent straight to your inbox.