Should companies that make some of the most popular toys and cartoons in the U.S. be tracking the online habits of kids under 13 years old? New York’s top cop says no, obviously not.
The state’s attorney general, Eric Schneiderman, said on Tuesday that he reached settlements with four companies including Viacom Inc. and Mattel Inc. for violating the Children’s Online Privacy Protection Act by collecting such data. The companies allowed third-party vendors to collect and use the personal information without parental approval, Schneiderman said.
Hasbro Inc. and JumpStart Games Inc. were also involved in the accord, according to a statement by the attorney general. The four companies, behind such brands as SpongeBob SquarePants, Barbie and My Little Pony, agreed to pay penalties totaling $835,000 and put in place extensive procedures to prevent the tracking of such data in the future, Schneiderman said.
The probe into the industry “revealed that some of our nation’s biggest companies failed to protect kids’ privacy” when the legislation was beefed up in 2013, Schneiderman said in the statement. “Federal law demands that children are off-limits to the prying eyes of advertisers.”
The probe relates to the use of so-called online behavioral advertisements, the technology that ensures Internet users who search for a product online will then see ads for that same product on whatever website they’re browsing. The law passed by Congress in 1998 was intended to protect the youngest children from that practice as they gained access to more and more websites tied to toys and cartoons.
The probe, which Schneiderman said is the first of its kind in the U.S., covered sites for Viacom’s Nick Jr. and Nickelodeon brands; Mattel’s Barbie, Hot Wheels, and American Girl toys; Hasbro’s My Little Pony, Littlest Pet Shop, and Nerf; and JumpStart’sNeopets, a virtual pet community it purchased from Viacom in 2014.
Viacom’s share of the penalty is the biggest at $500,000, according to the statement. The law the companies broke was passed at a time when the Internet was still establishing itself in U.S. households, and was amended in 2013 to catch up with new ways data was being collected online, according to Schneiderman’s statement.
Schneiderman began his investigation after discovering that websites operated by the companies enabled marketers to track so-called persistent identifiers, such as cookies and IP addresses, that can be used to recognize a specific user over time and across websites, according to the statement.
The agreement “resolves an investigation of an earlier generation of Nickelodeon websites,” spokesman David Bittler said in a statement from the New York-based company. “Viacom has committed to continue to be at the forefront of children’s safety.”
Julie Duffy, a spokeswoman for Hasbro, said the Pawtucket, Rhode Island-based company cooperated fully with the investigation and is committed to protecting the privacy of its website audience.
“We will be more closely vetting and monitoring companies that work on our behalf,” Duffy said in a statement. “We are rolling out a new, stricter online privacy protection policy for our partners, and enacting new protocols and technology to scan our digital properties for any cookies, widgets or other applications that may violate our policy.”
All the companies agreed to similar reforms, according to Schneiderman’s statement.
Messages left with press representatives for the other companies weren’t immediately returned.