Filed: Mar. 27, 2019
Latest Update: Mar. 27, 2019
Summary: STIPULATED ORDER FOR CIVIL PENALTIES, PERMANENT INJUNCTION, AND OTHER RELIEF OTIS D. WRIGHT, II , District Judge . Plaintiff, the United States of America, acting upon notification and on behalf of the Federal Trade Commission ("Commission"), filed its Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief, ("Complaint"), pursuant to Sections 13(b), and 16(a)(1) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. 53(b), and 56(a)(1), the Children's Online
Summary: STIPULATED ORDER FOR CIVIL PENALTIES, PERMANENT INJUNCTION, AND OTHER RELIEF OTIS D. WRIGHT, II , District Judge . Plaintiff, the United States of America, acting upon notification and on behalf of the Federal Trade Commission ("Commission"), filed its Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief, ("Complaint"), pursuant to Sections 13(b), and 16(a)(1) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. 53(b), and 56(a)(1), the Children's Online P..
More
STIPULATED ORDER FOR CIVIL PENALTIES, PERMANENT INJUNCTION, AND OTHER RELIEF
OTIS D. WRIGHT, II, District Judge.
Plaintiff, the United States of America, acting upon notification and on behalf of the Federal Trade Commission ("Commission"), filed its Complaint for Civil Penalties, Permanent Injunction, and Other Equitable Relief, ("Complaint"), pursuant to Sections 13(b), and 16(a)(1) of the Federal Trade Commission Act ("FTC Act"), 15 U.S.C. §§ 53(b), and 56(a)(1), the Children's Online Privacy Protection Act, 15 U.S.C. §§ 6502(c) and 6505(d), and the Commission's Children's Online Privacy Protection Rule ("COPPA Rule"), 16 C.F.R. Part 312. Defendants have waived service of the summons and the Complaint. Plaintiff and Defendants stipulate to the entry of this Stipulated Order for Permanent Injunction and Civil Penalty Judgment ("Order") to resolve all matters in dispute in this action between them.
THEREFORE, IT IS ORDERED as follows:
FINDINGS
1. This Court has jurisdiction over this matter.
2. The Complaint charges that Defendants violated the COPPA Rule and the FTC Act by failing to post a privacy policy on its online service providing clear, understandable, and complete notice of its information practices; failing to provide direct notice of its information practices to parents; failing to obtain verifiable parental consent prior to collecting, using, and/or disclosing personal information from children; failing to delete personal information at the request of parents; and retaining personal information longer than reasonably necessary to fulfill the purpose for which the information was collected.
3. Defendants neither admit nor deny any of the allegations in this Complaint, except as specifically stated in this Order. Only for purposes of this action, Defendants admit the facts necessary to establish jurisdiction.
4. Defendants waive any claim they may have under the Equal Access to Justice Act, 28 U.S.C. § 2412, concerning the prosecution of this action through the date of this Order, and agree to bear their own costs and attorney fees.
5. Defendants and Plaintiff waive all rights to appeal or otherwise challenge or contest the validity of this Order.
ORDER
DEFINITIONS
For the purpose of this Order, the following definitions apply:
A. "Child" means an individual under the age of 13 residing in the U.S.
B. "Collects" or "collection" means, for the purposes of Parts I, II, V, VI and VII of this Order only, the gathering of any personal information from a child by any means, including but not limited to:
1. Requesting, prompting, or encouraging a child to submit personal information online;
2. Enabling a child to make personal information publicly available in identifiable form; or
3. Passive tracking of a child online.
C. "Defendants" means Musical.ly and Musical.ly, Inc., and their successors and assigns.
D. "Delete" means to remove personal information such that it is not maintained in retrievable form and cannot be retrieved in the normal course of business.
E. "Disclose" or disclosure" means, with respect to personal information:
1. The release of personal information collected by an operator from a child in identifiable form for any purpose, except where an operator provides such information to a person who provides support for the internal operations of the Web site or online service; and
2. Making personal information collected by an operator from a child publicly available in identifiable form by any means, including but not limited to a public posting through the Internet, or through a personal home page or screen posted on a Web site or online service; a pen pal service; an electronic mail service; a message board; or a chat room.
F. "Internet" means collectively the myriad of computer and telecommunication facilities, including equipment and operating software, which comprises the interconnected world-wide network of networks that employ the Transmission Control Protocol/Internet Protocol, or any predecessor or successor protocols to such protocol, to communicate information of all kinds by wire, radio, or other methods of transmission.
G. "Obtaining verifiable consent" means making any reasonable effort (taking into consideration available technology) to ensure that before personal information is collected from a child, a parent of the child:
1. Receives notice of the operator's personal information collection, use, and disclosure practices; and
2. Authorizes any collection, use, and/or disclosure of the personal information.
H. "Online contact information" means an email address or any other substantially similar identifier that permits direct contact with a person online, including but not limited to, an instant messaging user identifier, a voice over internet protocol (VOIP) identifier, or a video chat identifier.
I. "Operator" means any person who operates a Web site located on the Internet or an online service and who collects or maintains personal information from or about the users of or visitors to such Web site or online service, or on whose behalf such information is collected or maintained, or offers products or services for sale through the Web site or online service, where such Web site or online service is operated for commercial purposes involving commerce among the several States, or with one or more foreign nations; in any territory of the United States or in the District of Columbia, or between any such territory and another such territory or any State or nation; or between the District of Columbia and any State, territory, or foreign nation.
J. "Parent" includes a legal guardian.
K. "Person" means any individual, partnership, corporation, trust, estate, cooperative, association, or other entity.
L. "Personal information" means individually identifiable information about an individual collected online, including:
1. A first and last name;
2. A home or other physical address including street name and name of a city or town;
3. Online contact information as defined in this section;
4. A screen or user name where it functions in the same manner as online contact information, as defined in this section;
5. A telephone number;
6. A Social Security number;
7. A persistent identifier that can be used to recognize a user over time and across different Web sites or online services. Such persistent identifier includes, but is not limited to, a customer number held in a cookie, an Internet Protocol (IP) address, a processor or device serial number, or unique device identifier;
8. A photograph, video, or audio file where such file contains a child's image or voice;
9. Geolocation information sufficient to identify street name and name of a city or town; or
10. Information concerning the child or the parents of that child that the operator collects online from the child and combines with an identifier described in this section.
M. "Registration information" means the following types of information collected for purposes of registering an account:
1. A user name;
2. A password;
3. An email address; or
4. An account authentication identifier associated with any third party Web site or online service through which a user of Defendants' Web site or online service registered an account.
N. "Release of personal information" means the sharing, selling, renting, or transfer of personal information to any third party.
O. "Support for the internal operations of the Web site or online service" means:
1. Those activities necessary to:
a. Maintain or analyze the functioning of the Web site or online service;
b. Perform network communications;
c. Authenticate users of, or personalize the content on, the Web site or online service;
d. Serve contextual advertising on the Web site or online service or cap the frequency of advertising;
e. Protect the security or integrity of the user, Web site, or online service;
f. Ensure legal or regulatory compliance; or
g. Fulfill a request of a child as permitted by 16 C.F.R. §§ 312.5(c)(3) and (4);
2. So long as the information collected for the activities listed in paragraphs (1)(a)-(g) of this definition is not used or disclosed to contact a specific individual, including through behavioral advertising, to amass a profile on a specific individual, or for any other purpose.
P. "Third party" means any person who is not:
1. An operator with respect to the collection or maintenance of personal information on the Web site or online service; or
2. A person who provides support for the internal operations of the Web site or online service and who does not use or disclose information protected under this part for any other purpose.
Q. "Web site or online service directed to children" means a commercial Web site or online service, or portion thereof, that is targeted to children.
1. In determining whether a Web site or online service, or a portion thereof, is directed to children, the Commission will consider its subject matter, visual content, use of animated characters or child-oriented activities and incentives, music or other audio content, age of models, presence of child celebrities or celebrities who appeal to children, language or other characteristics of the Web site or online service, as well as whether advertising promoting or appearing on the Web site or online service is directed to children. The Commission will also consider competent and reliable empirical evidence regarding audience composition, and evidence regarding the intended audience.
2. A Web site or online service shall be deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another Web site or online service directed to children.
3. A Web site or online service that is directed to children under this criteria set forth in paragraph (1) of this definition, but that does not target children as its primary audience, shall not be deemed directed to children if it:
a. Does not collect personal information from any visitor prior to collecting age information; and
b. Prevents the collection, use, or disclosure of personal information from visitors who identify themselves as under age 13 without first complying with the notice and parental consent provisions of this part.
4. A Web site or online service shall not be deemed directed to children solely because it refers or links to a commercial Web site or online service directed to children by using information location tools, including a directory, index, reference, pointer, or hypertext link.
I. INJUNCTION CONCERNING THE COLLECTION OF PERSONAL INFORMATION FROM CHILDREN
IT IS ORDERED that Defendants and Defendants' officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with being an operator of any Web site or online service directed to children or of any Web site or online service with actual knowledge that it is collecting or maintaining personal information from a child, are hereby permanently restrained and enjoined from violating the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312, including, but not limited to:
A. Failing to make reasonable efforts, taking into account available technology, to ensure that a parent of a child receives direct notice of Defendants' practices with regard to the collection, use, or disclosure of personal information from children, including notice of any material change in the collection, use, or disclosure practices to which the parent has previously consented;
B. Failing to post a prominent and clearly labeled link to an online notice of its information practices with regard to children, if any, on the home or landing page or screen of its Web site or online service, and at each area of the Web site or online service where personal information is collected from children;
C. Failing to obtain verifiable parental consent before any collection, use, or disclosure of personal information from children, including consent to any material change in the collection, use, or disclosure practices to which the parent has previously consented;
D. Failing to delete a child's personal information at the request of a parent; and
E. Retaining personal information for longer than is reasonably necessary to fulfill the purpose for which the information was collected.
A copy of the Children's Online Privacy Protection Rule, 16 C.F.R. Part 312, is attached hereto as Appendix A.
II. DELETION OF CHILDREN'S PERSONAL INFORMATION AND TREATMENT OF ACCOUNTS EXISTING AT TIME OF ENTRY OF THIS ORDER
IT IS FURTHER ORDERED that Defendants and Defendants' officers, agents, employees, and attorneys, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, shall:
A. Destroy all personal information, in all forms in their possession, custody, or control, that is associated with user accounts existing at the time of entry of this Order; or
B. If, at the time of entry of this Order, Defendants operate any Web site or online service that is directed to children but that does not target children as the primary audience,
1. For users of accounts existing at the time of entry of this Order who identify as under age 13, Defendants shall destroy such users' personal information, except that Defendants may, with the affirmative consent of the user, transfer the user's videos to the user's device and allow such user to retain their username, so long as that username does not function in the same manner as online contact information.
2. For users of accounts existing at the time of entry of this Order who identify as age 13 or over who were under age 13 at the time Defendants collected personal information, Defendants shall destroy such personal information, except that Defendants may, with the affirmative consent of the user, transfer the user's videos to the user's device and retain the user's registration information.
3. If the age of a particular user of an existing account is not identified within forty-five 45 days after entry of the Order, Defendants shall, within forty-five (45) days of entry of the Order: (a) remove such user's personal information from Defendants' Web sites and online services; (b) refrain from disclosing or using personal information that has been removed from their Web sites and online services; and (c) destroy such personal information within 12 months after entry of the Order. If the age of a particular user whose information has been removed is identified within 12 months after entry of the Order, Defendants shall comply with Section B(1) and B(2).
4. Personal information need not be destroyed, and may be collected, used, and disclosed, to the extent Defendants obtain verifiable parental consent for its collection, use, and disclosure.
5. Personal information need not be destroyed, and may be disclosed, to the extent requested by a government agency or as required by a law, regulation, or court order.
C. To the extent not covered in its compliance report, Defendants must submit a supplemental report, sworn under penalty of perjury, discussing whether and how Defendants are in compliance with this provision, within 15 months of entry of this Order.
Provided further, that personal information need not be destroyed, and may be collected, used, and disclosed, to the extent Defendants obtain verifiable parental consent for its collection, use, and disclosure, and may be disclosed as requested by a government agency or as required by a law, regulation or court order.
III. MONETARY JUDGEMENT FOR CIVIL PENALTY
IT IS FURTHER ORDERED that:
A. Judgement in the amount of $5,700,000.00 is entered in favor of Plaintiff against Defendants, jointly and severally, as a civil penalty.
B. Defendants are ordered to pay to Plaintiff, by making payment to the Treasurer of the United States, $5,700,000.00, which, as Defendants stipulate, their undersigned counsel holds in escrow for no purpose other than payment to Plaintiff. Such payment must be made within 7 days of entry of this Order by electronic fund transfer in accordance with instructions previously provided by a representative of Plaintiff.
IV. ADDITIONAL MONETARY PROVISIONS
IT IS FURTHER ORDERED that:
A. Defendants relinquish dominion and all legal and equitable right, title, and interest in all assets transferred pursuant to this Order and may not seek the return of any assets.
B. The facts alleged in the Complaint will be taken as true, without further proof, in any subsequent civil litigation by or on behalf of the Commission, including in a proceeding to enforce its rights to any payment or monetary judgement pursuant to this Order.
C. The facts alleged in the Complaint establish all elements necessary to sustain an action by the Commission pursuant to Section 523(a)(2)(A) of the Bankruptcy Code, 11 U.S.C. § 523(a)(2)(A), and this Order will have collateral estoppel effect for such purposes.
D. Defendants acknowledge that their Taxpayer Identification Numbers, which Defendants must submit to the Commission, may be used for collecting and reporting on any delinquent amount arising out of this Order, in accordance with 31 U.S.C. §7701.
V. INFORMATIONAL RELIEF
A. Defendants must report on their deletion obligations under penalty of perjury:
1. Defendants must submit a report within ninety (90) days of the entry of this Order summarizing their compliance with Section II of this Order; and
2. If Defendants elect to operate any Web site or online service that is directed to children but that does not target children as the primary audience, Defendants must submit a report within fifteen (15) months of the entry of this Order summarizing their compliance with Section II.B. of this Order.
VI. ORDER ACKNOWLEDGMENTS
IT IS FURTHER ORDERED that Defendants obtain acknowledgments of receipt of this Order:
A. Each Defendant, within 7 days of entry of this Order, must submit to the Commission an acknowledgment of receipt of this Order sworn under penalty of perjury.
B. For five (5) years after entry of this Order, Defendants must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees, agents, and representatives having managerial responsibilities for the collection, use, maintenance, or disclosure of personal information or the operation of any of Defendants' Web sites or online services; and (3) any business entity resulting from any change in structure as set forth in the Part titled Compliance Reporting. Delivery must occur within seven (7) days of entry of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.
C. From each individual or entity to which a Defendant delivered a copy of this Order, that Defendant must obtain, within 30 days, a signed and dated acknowledgment of receipt of this Order.
VII. COMPLIANCE REPORTING
IT IS FURTHER ORDERED that Defendants make timely submissions to the Commission:
A. One year after entry of this Order, each Defendant must submit a compliance report, sworn under penalty of perjury. Each Defendant must:
1. Identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission and Plaintiff may use to communicate with Defendant;
2. Identify all of that Defendant's businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses;
3. Describe the activities of each business, including the goods and services offered, the means of advertising, marketing, and sales, and involvement of any other Defendant;
4. Describe in detail whether and how that Defendant is in compliance with each section of this Order;
5. Provide a copy of each different version of any privacy notice posted on each Web site or online service operated by that Defendant or otherwise communicated to parents of children from whom that Defendant collects personal information;
6. Provide a statement setting forth in detail any methods used to obtain verifiable parental consent prior to any collection, use, and/or disclosure of personal information from children or the methods used to avoid collecting, using, and/or disclosing personal information from children;
7. Provide a statement setting forth in detail the means provided for parents to review any personal information collected from their children and to refuse to permit its further use or maintenance;
8. Provide a statement setting forth in detail why each type of information collected from a child is reasonably necessary for the provision of the particular related activity;
9. Provide a statement setting forth in detail the procedures used to protect the confidentiality, security, and integrity of personal information collected from children; and
10. Provide a copy of each Order Acknowledgment obtained pursuant to this Order, unless previously submitted to the Commission.
B. For ten (10) years after entry of this Order, each Defendant must submit a compliance notice, sworn under penalty of perjury, within 14 days of any change in: (a) any designated point of contact; or (b) the structure of any Defendant or any entity that Defendant has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.
C. Each Defendant must submit to the Commission notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against such Defendant within 14 days of its filing.
D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: "I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _______" and supplying the date, signatory's full name, title (if applicable), and signature.
E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to Debrief@ftc.gov or sent by overnight courier (not the U.S. Postal Service) to: Associate Director for Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue NW, Washington, DC 20580. The subject line must begin: United States v. Musical.ly, et al.
VIII. RECORDKEEPING
IT IS FURTHER ORDERED that Defendants must create certain records for 10 years after entry of this Order, and retain each such record for 5 years. Specifically, Defendants must create and retain the following records:
A. All records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission;
B. Copies of all consumer complaints relating to Defendants' information practices, including its collection, use, maintenance, or disclosure of personal information, and any response; and
C. A copy of each materially different form, page, or screen created, maintained, or otherwise provided by Defendants through which personal information is collected from a child, and a copy of each materially different document containing any representation regarding collection, use, maintenance or disclosure practices pertaining to personal information from children. Each webpage copy shall be accompanied by the URL of the webpage where the material was posted online. Electronic copies shall include all text and graphics files, audio scripts, and other computer files used in presenting information on the Internet.
IX. COMPLIANCE MONITORING
IT IS FURTHER ORDERED that, for the purpose of monitoring Defendants' compliance with this Order:
A. Within 14 days of receipt of a written request from a representative of the Commission or Plaintiff, each Defendant must: submit additional compliance reports or other requested information, which must be sworn under penalty of perjury; appear for depositions; and produce documents for inspection and copying. The Commission and Plaintiff are also authorized to obtain discovery, without further leave of court, using any procedure prescribed by Federal Rules of Civil Procedure 29, 30 (including telephonic depositions), 31, 33, 34, 36, 45, and 69.
B. For matters concerning this Order, the Commission and Plaintiff are authorized to communicate directly with each Defendant. Defendants must permit representatives of the Commission and Plaintiff to interview any employee or other person affiliated with Defendants who has agreed to such an interview. The person interviewed may have counsel present.
C. The Commission and Plaintiff may use all other lawful means, including posing, through its representatives as consumers, suppliers, or other individuals or entities, to Defendants or any individual or entity affiliated with Defendants, without the necessity of identification or prior notice. Nothing in this Order limits the Commission's lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.
X. RETENTION OF JURISDICTION
IT IS FURTHER ORDERED that this Court retains jurisdiction of this matter for purposes of construction, modification, and enforcement of this Order. The Clerk of the Court shall close the case.
IT IS SO ORDERED.
SO STIPULATED AND AGREED.
Appendix A
