Description

Settlement marks the agencys first childrens privacy and security case involving connected toys

Note: A conference call for media with Tom Pahl, Acting Director of the FTCs Bureau of Consumer Protection, will occur as follows:
Date: January 8, 2018
Time: 1 p.m. ET
Call-in info: (800) 230-1093; Confirmation Number: 442576
Call-in lines, which are for media only, will open 15 minutes prior to the start of the call. FTC staff will be available to take questions from the media.

Electronic toy manufacturer VTech Electronics Limited and its U.S. subsidiary have agreed to settle charges by the Federal Trade Commission that the company violated a U.S. childrens privacy law by collecting personal information from children without providing direct notice and obtaining their parents consent, and failing to take reasonable steps to secure the data it collected. VTech will pay $650,000 as part of the settlement with the FTC.

In a complaint filed by the Department of Justice on behalf of the FTC, the Commission alleges that the Kid Connect app used with some of VTechs electronic toys collected the personal information of hundreds of thousands of children, and that the company failed to provide direct notice to parents or obtain verifiable consent from parents concerning its information collection practices, as required under the Childrens Online Privacy Protection Act (COPPA). In its first childrens privacy case involving Internet-connected toys, the FTC also alleges that VTech failed to use reasonable and appropriate data security measures to protect personal information it collected.

As connected toys become increasingly popular, its more important than ever that companies let parents know how their kids data is collected and used and that they take reasonable steps to secure that data, said Acting FTC Chairman Maureen K. Ohlhausen. Unfortunately, VTech fell short in both of these areas.

COPPA requires that companies collecting personal information from children under 13 online follow steps to ensure that childrens information is protected, including clearly disclosing to parents the information it collects, how the information will be used, and seeking verifiable parental consent. Companies also must take reasonable measures to protect the confidentiality, security and integrity of the personal information they collect about children.

According to the complaint against VTech, the company collected personal information from parents on its Learning Lodge Navigator online platform, where the Kid Connect app was available for download, and also through a now-defunct web-based gaming and chat platform called Planet VTech. Before using Kid Connect or Planet VTech, parents were required to register and provide personal information including their name, email address as well as their childrens name, date of birth and gender. VTech also collected personal information from children when they used the Kid Connect app.

As of November 2015, about 2.25 million parents had registered and created accounts with Learning Lodge for nearly 3 million children. This included about 638,000 Kid Connect accounts for children. In addition, about 134,000 parents in the United States created Planet VTech accounts for 130,000 children by November 2015.

With respect to Kid Connect, VTech failed to provide direct notice of its information collection and use practices to parents and did not link to its privacy policy in each area where personal information was collected from children.

At the same time, the complaint alleges that the company did not take reasonable steps to protect the information it collected through Kid Connect, such as implementing adequate safeguards and security measures to protect transmitted and stored information and implementing an intrusion prevention or detection system to alert the company of an unauthorized intrusion of its network. In November 2015, VTech was informed by a journalist that a hacker accessed its computer network and personal information about consumers including children who used its Kid Connect app.

The FTC also alleges that VTech violated the FTC Act by falsely stating in its privacy policy that most personal information submitted by users through the Learning Lodge and Planet VTech would be encrypted. The company, however, did not encrypt any of this information.

In addition to the monetary settlement, VTech is permanently prohibited from violating COPPA in the future and from misrepresenting its security and privacy practices as part of the proposed settlement. It also is required to implement a comprehensive data security program, which will be subject to independent audits for 20 years.

The FTC collaborated with the Office of the Privacy Commissioner of Canada, which is releasing its own Report of Findings. To facilitate cooperation with its Canadian partner, the FTC relied on key provisions of the U.S. SAFE WEB Act, which allows the FTC to share information with foreign counterparts to combat deceptive and unfair practices that cross national borders.

The Commission vote authorizing the staff to file the complaint and stipulated final order was 2-0. The complaint and stipulated final order was filed in the U.S. District Court for the Northern District of Illinois.

NOTE: The Commission files a complaint when it has reason to believe that the law has been or is being violated and it appears to the Commission that a proceeding is in the public interest. Stipulated final orders have the force of law when approved and signed by the District Court judge.

The Federal Trade Commission works to promote competition, and protect and educate consumers. You can learn more about consumer topics and file a consumer complaint online or by calling 1-877-FTC-HELP (382-4357). Like the FTC on Facebook, follow us on Twitter, read our blogs and subscribe to press releases for the latest FTC news and resources.

Comments
Order by: 
Per page:
 
  • There are no comments yet
   Comment Record a video comment
 
 
 
     
Related Feed Entries
A group of European Union regulators will meet next week to discuss the regulation of cryptocurrencies.Source: Coin Desk - Digital currency
11 minutes ago · From Coin Desk - Digital currency
Only a week. That's how long Crypto All Stars, an ethereum-based collectable game modeled off CryptoKitties, lasted once founder in-fighting started. Source: Coin Desk - Digital currency
11 minutes ago · From Coin Desk - Digital currency
Lisk a decentralized application platform will relaunch today with aspirations of blockchain accessibility front and center. Source: Coin Desk - Digital currency
11 minutes ago · From Coin Desk - Digital currency
Today the Justice Department reached a settlement agreement with Atlantis Events, Inc., (Atlantis), a cruise and resort vacation company with offices in West Hollywood, California, to ensure that individuals who are deaf or hard of hearing are provided effective communication when travelling with the company. Source: Justice News - Cyber-crime
46 minutes ago · From Justice News - Cyber-crime
The Justice Department today announced that the United States District Court for the District of Arizona has approved an agreement between the Department and the state of Arizona to help ensure that military service members, their family members, and U.S. citizens living overseas have an opportunity to participate fully in the upcoming Feb. 27, 2018, special primary election and April 24, 2018, special general election to fill a vacancy in the states 8th Congressional District. The agreement is…
46 minutes ago · From Justice News - Cyber-crime
Rate
0 votes
Info
Michael Blair
Time is your GREATEST asset
08.01.2018 (08.01.2018)
9 Views
0 Subscribers
Recommend
Tags