Breaking News Emails
Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.
New Mexico has sued Google, several online advertising firms and a maker of popular gaming apps, alleging that the companies allowed the unlawful collection of sensitive data about children including their location.
The lawsuit, filed in federal court on Tuesday by the state Attorney General Hector Balderas, represents a new privacy battleground for tech companies that face mounting other questions from regulators, lawmakers and consumers about how data is collected and used.
A 1998 federal law makes it difficult for internet companies to collect data about children under age 13. Companies need to get verifiable parental consent before doing so.
The lawsuit focuses on Tiny Lab Productions, a maker of gaming apps such as Fun Kid Racing, Candy Land Racing, and GummyBear and Friends Speed Racing. It alleges that when children play the company’s apps, data including geolocation, demographic characteristics, online activity and other pieces of information are sent to third-party advertising networks without the verified consent of parents.
“These multi-million-dollar tech companies partnering with app developers are taking advantage of New Mexican children,” Balderas said in a statement.
The suit alleges that Google condones the collection by marketing Tiny Lab’s apps as safe and appropriate for children through the Google Play Store. “Google knows that Tiny Lab’s apps track children unlawfully,” the suit says.
Google spokesman Aaron Stein told the New York Times that developers are responsible for declaring whether their apps are primarily for children, and that apps in the store’s family section “must comply with more stringent policies.”
Stein did not immediately respond to a request for comment.
Tiny Lab’s racing games were removed from the Google Play Store this week, the app developer said in a statement on its company website.
Tiny Lab, which is based in Lithuania, said in its statement that it is not in violation of the 1998 law, known as the Children’s Online Privacy Protection Act, or COPPA. It said that if someone enters a birthdate showing they are under 13 years old, no data is collected.
Experts say the problem is more widespread than just one app developer. A study published in April by university researchers analyzed 5,855 free children’s apps and found that a majority were potentially in violation of the 1998 law.
Serge Egelman, one of the researchers behind the study, said he was surprised by how common it is for kids’ gaming apps to send data to online advertising companies, given the limits imposed by federal law and the companies’ own policies.
“I was expecting that the companies would be doing a little more to enforce their own terms of service,” Egelman, a professor at the University of California, Berkeley, told NBC News.
The New Mexico lawsuit also lists as defendants several companies that operate online advertising exchanges or are part of the online ad industry, including MoPub, which is owned by Twitter. It alleges that, by working with apps such as the Tiny Lab games, the ad tech companies surreptitiously extract data about children.
Twitter said in a statement on Friday that Tiny Lab was suspended from MoPub in 2017 and that it does not permit its services to be used to collect data about children for advertising purposes. A spokesman declined to say if MoPub had suspended other apps or was investigating other apps.
The lawsuit asks a judge to impose an injunction preventing future violations of federal law.
David Carl, a spokesman for the New Mexico Attorney General’s Office, told NBC News that the office also reviewed kids’ gaming apps on the Apple App Store, the equivalent of the Google Play Store for iPhone and iPad users. He said the office “decided that a lawsuit was not warranted at least at this time.”