On January 15, 2014, the Federal Trade Commission (FTC) announced that Apple, Inc. had agreed to pay a minimum of $32.5 million in full refunds to consumers to settle allegations that the company was billing customers for purchases that children made from the company’s App Store without parental consent.¹ According to the FTC, since at least 2011, thousands of children had unwittingly racked up significant App Store charges without their parents’ knowledge because the company’s billing procedures allowed users to incur unlimited in-app charges for a 15-minute window after downloading new software onto a device.²

The billing issue gained public attention when The Washington Post ran a February 2011 story on the topic.³ Apple quickly responded by upgrading its operating system to require users to submit an iTunes password to make purchases on newly downloaded apps. However, even after the company required users to enter passwords to make in-app purchases, the users’ accounts remained open for additional purchases for 15 minutes before the password window expired, and the request-for-password pop-up often did not explain that a parent was about to authorize a purchase.⁴ A putative class action lawsuit followed a month later, and the parties entered into a settlement in June 2013, with the company agreeing to offer iTunes credits or cash refunds to parents for children’s unintended in-app charges.⁵ However, the class action settlement did not require the company to make changes to its systems to ensure that consumers were notified that reentering their usernames and passwords to make in-app charges effectively authorized a 15-minute window during which subsequent charges could be made.

The FTC’s Complaint

According to the FTC’s complaint, Apple’s App Store offers hundreds of mobile applications (“apps”), including a category of “Games,” some of which are specifically subcategorized as intended for “Family” or “Kids.”⁶ Although several apps are identified as “Free,” the company may still charge account holders for certain user activities within those apps; these are known as “in-app charges.”⁷ Such charges, which are often included in apps targeting children, can range from $0.99 to $99.99, and the company sets no limits on their purchase.⁸

The installation of a new app on a device prompts a user to enter his iTunes username and password.⁹ But, according to the FTC, during the 15-minute period following installation, Apple did not properly display a second password prompt before users could incur in-app charges.¹⁰ As a result, children made in-app charges without their parents’ knowledge simply by pressing the “Buy” button repeatedly on certain apps during that 15-minute window.¹¹ Also, the company’s stated policy is that “all App Store transactions are final,” and to the extent that a parent actually discovers any unauthorized charge made by his child, the company’s refund process is prohibitively “cumbersome.”¹²

The FTC alleged that the company’s billing procedures violated Section 5 of the FTC Act because consumers were not properly alerted that entering a username and password combination to purchase an in-app item also approved any further purchases for an additional 15-minute window without requiring further authorization.¹³ Moreover, the FTC seemed to find fault with the fact that the company had not revised its procedures to fully resolve the issue after receiving “at least tens of thousands of complaints related to unauthorized in-app charges by children” beginning as early as March 2011.¹⁴
Terms of Settlement

The consent decree, which lasts for 20 years, with audit rights lasting for five years, requires the company to implement several new measures in its billing practices by March 31, 2014.¹⁵ These steps include:

• providing clear and conspicuous notice of all material information related to billing, including details about future purchases that can be made after the consumer enters his or her password;¹⁶
• obtaining users’ express, informed consent for all in-app charges; and
• allowing consumers to revoke consent to prospective in-app charges at any time.¹⁷

The consent decree also requires the company to provide full refunds to all account holders it billed for unauthorized in-app charges made by minors by:

• providing electronic notice to any account holders who have made in-app purchases since March 2011, explaining that refunds are available and describing the proper procedure to obtain them;¹⁸ and
• refunding the full purchase price of the in-app charge in question within 14 days to any eligible consumer who requests it.¹⁹

Notably, the company must pay a minimum of $32.5 million in refunds. Further, if it receives less than $32.5 million in consumer requests within the first 12 months of the consent decree, it must remit any balance of the $32.5 million to the FTC.²⁰

Commissioner Wright’s Dissent

FTC commissioners voted 3-1 in favor of the deal,²¹ with Commissioner Joshua T. Wright issuing a lengthy dissent.²² Commissioner Wright opined that because the harm involved a “miniscule percentage of consumers” when compared to the total number of apps downloaded from the App Store, any alleged injury was “insubstantial.”²³ The majority disagreed, explaining that the size of the company and the volume of its App Store business were not proper factors in the analysis: “[T]he FTC Act does not give a company with a vast user base and product offerings license to injure large numbers of consumers or inflict millions of dollars of harm merely because the injury affects a small percentage of its customers or relates to a fraction of its product offerings.”²⁴

Commissioner Wright also argued that the decision would stifle innovation by requiring a company like Apple to try to anticipate “all the things that might go wrong” when it developed a new product, which would be “prohibitively costly” and likely “impossible.”²⁵ However, the majority countered that the company’s actions were not “unfair” because it had failed “to anticipate all things that might go wrong,” but rather, because it repeatedly failed to fix a significant billing issue about which it was “well aware” in 2011.²⁶

Implications

The settlement is the first punishment the FTC has handed to a tech platform over the handling of children’s apps. It demonstrates the growing public and government concern over whether companies are providing parents with the appropriate information and tools to properly supervise their children’s online activities.

The settlement also reinforces the FTC’s long-held principle that companies must fully disclose to consumers all material details to a transaction, and it reemphasizes that disclosures in a company’s terms of service or privacy policy may not be sufficient.²⁷ To avoid following in Apple’s footsteps, companies operating in the mobile sphere should always obtain express consent before billing a consumer for any charge, and should provide “just-in-time disclosures” outside of the terms of the service or privacy policy for material information.

Importantly, companies should take heed that good intentions and remediation efforts may be immaterial to the FTC. The majority stressed that regardless of Apple’s “intent,” its failure to properly disclose the details of the 15-minute window was enough to constitute a law violation.²⁸ Moreover, the fact that the company began trying to fix the issue in March 2011 and had already agreed to refund certain consumers their money in the context of related class action litigation did not stop the FTC from asking the company to pay an additional hefty fee and ensure that its processes met the agency’s standards.

¹ See FTC Release, “Apple Inc. Will Provide Full Consumer Refunds of At Least $32.5 Million to Settle FTC Complaint It Charged for Kids’ In-App Purchases Without Parental Consent—Company Also Will Modify its Billing Practices Under FTC Settlement” (Jan. 15, 2014), available at http://www.ftc.gov/news-events/press-releases/2014/01/apple-inc-will-provide-full-consumer-refunds-least-325-million (last visited Mar. 6, 2014).

² See Cecilia Kang, “In-app purchases in iPad, iPhone, iPod kids’ games touch off parental firestorm,” The Washington Post (Feb. 8, 2011), available at http://www.washingtonpost.com/wp-dyn/content/article/2011/02/07/AR2011020706073_pf.html (last visited Mar. 6, 2014).

³ See id.

⁴ See Statement of Chairwoman Edith Ramirez & Commissioner Julie Brill, In the Matter of Apple Inc., FTC File No. 1123018 (Jan. 15, 2014) (hereinafter “Ramirez & Brill statement”)
(noting that “for well over two-and-a-half years after [Apple added a password prompt to the in-app purchase sequence in March 2011], the password prompt has lacked any information to signal that the account holder is about to open a 15-minute window in which unlimited charges could be made in a children’s app”).

⁵ See Home Page of the In re Apple In-App Purchase Litigation Settlement website, No. 5:11-cv-01758 (N.D. California), available at https://www.itunesinapppurchasesettlement.com/CAClaimForms/AIL/Home.aspx (last visited Mar. 6, 2014).

⁶ FTC Complaint, In the Matter of Apple, Inc., available at http://www.ftc.gov/sites/default/files/documents/cases/140115applecmpt.pdf (hereinafter “complaint”) at ¶ 6.

⁷ Id. ¶ 22.

⁸ Id. ¶ 7.

⁹ See id. ¶¶ 11-13 (describing the app-installation process).

¹⁰ Id. ¶ 16.

¹¹ Id.

¹² Id. ¶ 27.

¹³ See 15 U.S.C. § 45(a) and (n).

¹⁴ Complaint, see supra note 6, ¶ 24.

¹⁵ See Agreement Containing Consent Order, available at  http://www.ftc.gov/sites/default/files/documents/cases/140115appleagree.pdf (last visited Mar. 6, 2014) (hereinafter, “consent order”) at Parts IV & VII.

¹⁶ See id. at ¶ 5 & Part I. “Express, informed consent” is specifically defined as an “affirmative act communicating authorization of an in-app charge (such as entering a password),” made directly before an in-app activity for which a consumer is billed, and a “clear and conspicuous disclosure of material information about the charge.” Id. at 3, ¶ 5.

¹⁷ Id. at Part I.

¹⁸ Id. at Part II.F.

¹⁹ Id. at Part II.

²⁰ Id. at Part II.D.

²¹ Apple Inc.; Analysis of Proposed Consent Order to Aid Public Comment, Fed. Register/Vol. 79, No. 15, File No. 112 3108 (Jan. 23, 2014), available at http://www.ftc.gov/sites/default/files/documents/federal_register_notices/2014/01/140123apple
analysisfrn.pdf (last visited Mar. 6, 2014). Commissioner Maureen K. Ohlhausen joined the majority, but issued her own separate statement. See Statement of Commissioner Maureen K. Ohlhausen, available at http://www.ftc.gov/public-statements/2014/01/statement-commissioner-maureen-k-ohlhausen(last visited Mar. 6, 2014) (hereinafter “Ohlhausen statement”).

²² Dissenting Statement of Joshua T. Wright, available at http://www.ftc.gov/public-statements/2014/01/dissenting-statement-commissioner-joshua-d-wright (last visited Mar. 6, 2014) (hereinafter “dissent”).

²³ Id. at 5; see id. at 5-8.

²⁴ Ramirez & Brill statement, supra note 4 at 3.

²⁵ Id. at 15.

²⁶ Id.; see also Ohlhausen statement, supra note 21 at 1-2 (noting that the action would not “chill an iterative approach to software development” or “unduly burden the creation of complex products”).

²⁷ The majority noted that the company’s disclosure of the 15-minute window in its Terms and Conditions was not sufficient to provide consumers with adequate notice. See Ramirez & Brill statement, supra note 4 at 4.

²⁸ Id. at 2 & n.4.