Online Coloring Book App Recolor Settles FTC Allegations It Illegally Collected Kids’ Personal Information

The operators of an online coloring book app will be required to notify parents and offer refunds to current underage subscribers to settle Federal Trade Commission allegations that they violated a children’s privacy law by collecting and disclosing personal information about children who used the app without notifying their parents and obtaining their consent.

In a complaint filed by the Department of Justice on behalf of the FTC, the Commission alleged that the Toronto-based Kuuhuub Inc., along with its Finnish subsidiaries Kuu Hubb Oy and Recolor Oy, violated the Children’s Online Privacy Protection Act Rule (COPPA Rule). The Rule requires websites and apps to provide notice to parents and obtain verifiable parental consent before collecting personal information from children if the website or app—or even a portion of the website or app—is directed at children under 13.

“The law is clear: the personal information of children is off limits, and the FTC will continue to investigate companies like Recolor that break or bend the law,” said Samuel Levine, Acting Director of the FTC’s Bureau of Consumer Protection. “Even if only a portion of an app or website is directed to kids, companies cannot collect their personal information without parental consent, especially if their app or website offers social media features.”

The companies operate the Recolor coloring book app, which provides images that users can digitally color on their mobile devices. While billed as a “coloring book for adults,” a portion of the coloring book app was directed to children. The images are organized in a library with categories such as Movies and Animals. One popular category, called Kids, included images that would appeal to children, such as animated characters and cartoonish animals.

In addition to the coloring feature, the app, which generates revenues from ads and paid subscriptions, offers social media features such as the ability to upload images for others to view, comment on, and like. To access these social media features, users must register for an account by providing an email address, screen name, and an optional profile description and picture, which are made public to other users.

The FTC alleged that some children including those under 13 were able to register for accounts and use some of the social media features. The companies received dozens of complaints from parents and users who said that children were using the app’s social media features such as posting selfies and interacting with other users including adults.

In its complaint, the FTC alleged that the Recolor app collected personal information from children under the age of 13 who used the app’s social media features and allowed third-party advertising networks to collect personal information from users in the form of persistent identifiers, also known as cookies, for targeted ads. The companies failed to instruct the ad networks to refrain from using children’s persistent identifiers for behavioral advertising, according to the complaint. The FTC also alleged that the companies failed to provide notice to parents or obtain verifiable parental consent before collecting personal information from underage users of the Recolor app in violation of the COPPA Rule.

Under the settlement, the companies must delete all the personal information they collected from children under 13 unless they obtain parental consent, and must offer current paid subscribers of the Recolor app a refund if they were under the age of 18 when they signed up for the app. The companies also agreed to a $3 million monetary penalty, which will be suspended upon payment of $100,000 due to their inability to pay the full amount. They will be required to pay the full amount if they have misrepresented their finances. In addition, if they sell the app within a year following entry of the order, they must remit the net proceeds from the sale to the FTC, after the payment of debts and other related expenses.

The companies must notify users of the app about the alleged COPPA Rule violations and the steps that users can take in response to the settlement.

The Commission voted 4-0 to authorize the Department of Justice to file the complaint and stipulated final order. The complaint and proposed consent decree were filed in the U.S. District Court for the District of Columbia.

NOTE: The Commission authorizes the filing of a complaint when it has “reason to believe” that the law has been or is being violated, and it appears to the Commission that a proceeding is in the public interest. Consent decrees have the force of law when approved and signed by the district court judge.