In a complaint filed by the Department of Justice on behalf of the Federal Trade Commission, the agency alleged that WW International, Inc., formerly known as Weight Watchers, and a subsidiary called Kurbo, Inc., marketed a weight loss app for use by children as young as eight years old, then collected their personal information without parental permission. The settlement order requires WW International and Kurbo to delete personal information unlawfully collected from children under 13, destroy all data-derived algorithms, and pay a $1.5 million fine.

“Weight Watchers and Kurbo marketed weight management services to children as young as eight years old and then unlawfully collected their personal and sensitive health information,” said Federal Trade Commission Chairman Lina M. Khan. “Our order against these companies requires them to delete their ill-gotten data, destroy any algorithms derived from it, and pay a fine for their breach of the law.”

“Parents have the right to know and consent before companies collect their children’s personal information,” said Senior Assistant Deputy Attorney General Brian M. Boynton, Chief of the Justice Department’s Civil Division. “The department is committed to enforcing protections against the unauthorized collection of information from consumers, especially children.”

WW International and Kurbo market a health and wellness app and website called Kurbo by WW for children as young as eight years old, in addition to teens and families. The app tracks their food intake, activity, and weight, and also collects personal information such as names, email addresses, and birth dates. Until the end of 2019, users could register for Kurbo by WW’s service on the app or on the website by indicating that they were a parent registering for their child or a child over the age of 13. registering for himself.

The FTC’s Children’s Online Privacy Protection Act Rule (COPPA Rule) requires that websites, applications, and online services that target children or knowingly collect personal information from children inform parents and obtain their consent before collecting, using or disclosing personal information from children under 13.

The complaint alleged that Kurbo by WW’s registration process encouraged young users to falsely claim they were over 13, despite text stating that children under 13 must register through from a relative. In fact, from 2014 to 2019, hundreds of users who signed up for the app claiming to be over 13 then changed their date of birth on their profile to say they were really under 13, according to the complaint. These users nonetheless continued to have access to the app until FTC staff contacted the companies.

In 2020, the registration option for children over 13 was revised, but problems with the registration process remained, according to the complaint. Kurbo also failed to provide a mechanism to ensure that those choosing the parent sign-up option were indeed parents and not a child trying to circumvent the age limit, according to the complaint.

In addition, the complaint alleged that parents who register their children on the Company’s website or on an affiliate’s website only receive notice of the information collection if they click on a hyperlink buried in a series of other links. Despite changes to its direct privacy notice in 2019, Kurbo by WW still failed to comply with the notification requirements of the COPPA rule, according to the complaint.

Finally, the complaint alleged that WW and Kurbo violated the data retention provisions of the COPPA Rule by retaining children’s personal information indefinitely and only deleting it at the request of a parent. Under the regulations, companies are also prohibited from retaining data collected in the future from children under 13 for longer than one year after WW last used Kurbo.

The settlement order also requires companies to destroy any previously collected personal information that did not comply with the parental notice and consent requirements of the COPPA rule, unless the companies subsequently obtained parental consent to retain such data. The regulations also require companies to destroy any affected work product that uses data unlawfully collected from children in violation of COPPA.

The Commission’s vote to refer the civil penalty complaint to the DOJ for filing was 5-0. The Department of Justice filed the complaint and the stipulated order in the United States District Court for the Northern District of California. The Court approved the order on March 3, 2022.