Golden State Today

California Attorney General Rob Bonta and Los Angeles City Attorney Hydee Feldstein Soto have announced a $500,000 settlement with Tilting Point Media LLC. The settlement resolves allegations that the company violated the California Consumer Privacy Act (CCPA) and the federal Children’s Online Privacy Protection Act (COPPA) by collecting and sharing children’s data without parental consent through their mobile app game "SpongeBob: Krusty Cook-Off."

In addition to paying civil penalties, Tilting Point must adhere to injunctive terms ensuring lawful data collection and disclosure. This includes obtaining parental consent and correctly configuring third-party software in their mobile games.

"Businesses have a legal obligation to protect kids’ data and to comply with important state and federal privacy laws designed to protect children online," said Attorney General Bonta. "Failing to do this puts our kids at risk, leaving them vulnerable to having their personal data collected, tracked, and sold."

Los Angeles City Attorney Hydee Feldstein Soto added, "The 'SpongeBob: Krusty Cook-Off' game is based on some of the most beloved and recognizable characters in children’s entertainment. Tilting Point Media is alleged to have collected and shared its young players' personal data, violating consumer privacy laws and industry guidelines."

"SpongeBob: Krusty Cook-Off" is a cooking simulation game directed at children under 13 as well as older teens and adults. The Children’s Advertising Review Unit (CARU), part of the Better Business Bureau National Programs, initially investigated the app for potential deceptive or inappropriate data collection from children. Despite corrective actions taken by Tilting Point, a joint investigation by the California Department of Justice and Los Angeles City Attorney's Office found continued violations of CCPA and COPPA.

Tilting Point's age screen did not ask age neutrally, leading children not to enter their age correctly. Additionally, misconfigured third-party software development kits (SDKs) resulted in unauthorized data collection.

Tilting Point must now comply with several requirements:

- Adhere to CCPA and COPPA regarding children's data.

- Obtain parental consent before selling or sharing information from users under 13 years old.

- Provide just-in-time notices when collecting children's information.

- Use neutral age screens.

- Configure third-party SDKs properly.

- Implement an SDK governance framework.

- Follow best practices for advertising to minors.

- Monitor compliance through annual reports.

COPPA requires operators of websites directed at children under 13 or those knowingly collecting such information to obtain parental consent before using it. The CCPA grants California consumers increased privacy rights concerning how businesses handle their personal information.

Attorney General Bonta remains committed to enforcing both COPPA and CCPA for children's online safety. This settlement marks his third enforcement action under CCPA:

In March, he joined a bipartisan letter proposing updates to FTC regulations implementing COPPA.

In February, he announced a settlement with DoorDash over similar allegations involving consumer data without notice or opt-out opportunities.

In January, he introduced two bills aiming to limit social media addiction harms and enhance kids' data privacy protections.

In October 2023, Bonta co-led a lawsuit against Meta Platforms over features allegedly designed to addict children detrimentally.

In 2022, he settled with Sephora over undisclosed sales of personal information without processing opt-out requests.

A copy of the complaint and stipulated judgment can be accessed [here]("https://www.oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Complaint.pdf") [and here]("https://www.oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Judgment.pdf").