In September 2015, the Online Interest-based Advertising Accountability Program (Accountability Program) of the Advertising Self-regulatory Council (ASRC) began enforcing the Digital Advertising Alliance (DAA) Guidelines for Mobile Advertising (Mobile Guidance) and now the inevitable has happened: the Accountability Program has issued three compliance decisions with mobile app publishers whose apps allegedly failed to comply with the Mobile Guidance. Two of those decisions, the Bearbit Studios decision and the Top Free Games decision, reinforce the heightened duties that mobile app publishers take on when developing mobile apps that appeal to children under 13 (children). For more information on the third decision, the Spinrilla decision, and the Accountability Program’s stance on cross-app enhanced notice and precise location data, see our companion post here.
As a bit of an overview, further explored in our prior post, the Mobile Guidance incorporates the DAA’s Online Behavioral Advertising Self-Regulatory Principles (Principles) and covers entities engaged in interest-based advertising (IBA) across websites or mobile apps. If a mobile app publisher allows a third party to collect data through its mobile app, the mobile app publisher is considered a covered entity and must comply with the Mobile Guidance.
The Mobile Guidance provides, by reference to the “Sensitive Data Principle” in the Principles, that where a mobile app publisher has actual knowledge that children use its mobile app or has a mobile app directed to children, the mobile app publisher should not collect “personal information” as defined by the Children’s Online Privacy Protection Act (COPPA) (which definition includes device id, other unique id, geolocation, picture, audio file, phone number and more) for IBA purposes unless as compliant with COPPA. In order to comply with COPPA, as further discussed here, a mobile app publisher must first obtain verified parental consent before collecting children’s personal information for IBA or most other purposes not necessary to operate the basic service; or, if the mobile app publisher’s mobile app has a mixed audience that includes both children and adults, the mobile publisher may implement an age-gating mechanism to flag users under 13 (there are additional nuances to these requirements) and provide children a COPPA-compliant version. Whether a mobile app is directed or appeals to children is determined based on a multifactor test that considers factors such as subject matter, visual content, language, simplicity of operation, how and where the app is marketed, and use of animated characters and other content that appeals to children.