mobile apps

Subscribe to mobile apps

On May 22, 2019, a federal district court largely denied a facial challenge by Disney, Viacom, and several online advertising networks to claims alleging these defendants violated the privacy rights of children by collecting data through online gaming apps.

In McDonald v. Kiloo APS,[1] the defendants consisted of two groups: the developers who created the gaming apps and made them available for download, and the mobile advertising and app monetization companies who provided software code inserted into the gaming apps to collect user data for advertising purposes. The defendants allegedly collected a variety of data from the children’s devices without appropriate consent, including the IP address; the specific device name; IDs for Apple and Android devices; the device’s International Mobile Equipment Identity; the timestamp at which an advertising event was recorded; and device fingerprint data (the user’s language, time zone, country, and mobile network).Continue Reading Federal Court Allows Children’s Online Privacy Claims Against Disney, Viacom, and Online Ad Networks That Collected Data from Gaming Apps to Go Forward

The Federal Trade Commission (FTC) recently granted a petition by Sears Holding Management requesting that the FTC reopen and modify a 2009 FTC order settling charges that Sears failed to disclose adequately the scope of consumers’ personal information it collected via a downloadable software app.

Sears’ 2009 Order

On August 31, 2009, the FTC entered a final order in In the Matter of Sears Holdings Management Corporation after determining that from approximately April 2007 to January 2008, Sears disseminated a desktop software application through its websites that collected sensitive information, such as online bank statements, drug prescription records, and video rental records, yet Sears failed to disclose the scope of the application’s data collection. Among other things, the order required Sears to disseminate all future “tracking applications” in a specified manner, including by making certain disclosures and obtaining express opt-in consent using processes stipulated by the order, for a 20-year term.
Continue Reading FTC Grants Sears’ Petition to Reopen and Modify 2009 Order Concerning Online Browsing Tracking

The U.S. Department of Health and Human Services (HHS) recently issued guidance to help mobile application developers analyze whether the Health Insurance Portability and Accountability Act of 1996 (HIPAA) may apply to them.1 Not every mobile application developer that handles personal health information is subject to HIPAA regulation, and determining whether HIPAA applies is situation-dependent and requires thoughtful analysis. The HHS guidance lists some of the factors to consider when assessing whether HIPAA applies to an app developer and analyzes several scenarios where apps handle health-related information.
Continue Reading HHS Issues HIPAA Guidance for Mobile Health Apps

On January 15, 2014, the Federal Trade Commission (FTC) announced that Apple, Inc. had agreed to pay a minimum of $32.5 million in full refunds to consumers to settle allegations that the company was billing customers for purchases that children made from the company’s App Store without parental consent.1 According to the FTC, since at least 2011, thousands of children had unwittingly racked up significant App Store charges without their parents’ knowledge because the company’s billing procedures allowed users to incur unlimited in-app charges for a 15-minute window after downloading new software onto a device.2
Continue Reading Apple Agrees to Refund at Least $32.5 Million to Settle FTC Complaint Alleging That It Charged Kids’ In-App Purchases Without Parental Consent

In December 2013, the United Kingdom’s Information Commissioner’s Office (ICO) issued “Privacy in Mobile Apps–Guidance for App Developers.”1 According to the ICO, the guidance is not only relevant for apps used on mobile devices such as smartphones and tablets, but also for “other devices using similar app technology, for instance living-room devices such as smart TVs or games consoles.”

The guidance is addressed to organizations developing apps for the UK market, regardless of their location. However, it addresses key EU privacy issues and may be useful for any organization developing apps for individuals located in the European Union (EU). In addition, the ICO guidance should be read together with the opinion on mobile apps issued by the Article 29 Working Party (the body of European data protection regulators) in March 2013, a summary of which we have provided here.2 Listed below are the key takeaways and recommendations from the guidance.
Continue Reading UK Information Commissioner’s Office Issues Guidance for App Development

At a May 9, 2013, hearing, the California Superior Court dismissed the lawsuit that California Attorney General Kamala Harris filed against Delta Airlines in December 2012.1 As reported in the January 2013 issue of Eye on Privacy,2 the state’s lawsuit alleged that the company’s “Fly Delta” mobile application (app) violated the California Online Privacy Protection Act (CalOPPA) by failing to provide required privacy disclosures.3 The AG sought enforcement of CalOPPA through California’s Unfair Competition Law (California UCL).4 According to the AG, Delta violated CalOPPA by “fail[ing] to conspicuously post a privacy policy in its Fly Delta app” despite the AG’s earlier written notice of non-compliance, and because the Fly Delta app failed to comply with the privacy policy posted on Delta’s website.5 The court dismissed the action based on its conclusion that the state law claim was preempted by the Federal Airline Deregulation Act of 1978 (ADA).6
Continue Reading Delta Wins Dismissal of California AG Mobile App Privacy Action