Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 1 of 39
`
`
`UNITED STATES DISTRICT COURT
`DISTRICT OF NEW MEXICO
`
`
`
`STATE OF NEW MEXICO EX REL.
`HECTOR BALDERAS, ATTORNEY
`GENERAL,
`
`
`Plaintiff,
`
`
`v.
`
`TINY LAB PRODUCTIONS; TWITTER
`INC.; MOPUB, INC.; GOOGLE, INC.;
`ADMOB, INC.; AERSERV LLC;
`INMOBI PTE LTD.; APPLOVIN
`CORPORATION; and
`IRONSOURCE USA, INC.
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`No. 18-854 MV/JFR
`
`
`
`
`
`
`
`
`
`Defendants.
`
`MEMORANDUM OPINION AND ORDER
`
`THIS MATTER comes before the Court on the SDK Defendants’1 Motion to Dismiss
`
`the Complaint for Failure to State a Claim (“SDK Defendants’ Motion”) [Doc. 47] and
`
`Defendant Google’s2 Motion to Dismiss (“Google’s Motion”) [Doc. 50]. The Court, having
`
`considered the motions and relevant law, finds that the SDK Defendants’ Motion is well-taken
`
`and will be granted, and that Google’s Motion is well-taken in part and will be granted in part
`
`and denied in part.
`
`
`
`
`
`
`1 The “SDK Defendants” are Twitter Inc., MoPub, Inc., AerServ LLC, InMobi PTE Ltd.,
`Applovin Corp., and ironSource USA, Inc.
`2 “Defendant Google” is Google LLC and AdMob Google Inc.
`1
`
`
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 2 of 39
`
`I.
`
`Introduction
`
`BACKGROUND
`
`Though catchy television commercial jingles may no longer be ubiquitous in
`
`contemporary society, advertising is still alive and well in this computer age. In exchange for
`
`free access to “apps” on our many mobile devices, we are often required to (im)patiently view
`
`ads that pop up before, after, or while we play, watch, or otherwise enjoy those apps. Those ads
`
`often seem tailor-made to match our interests. That is no accident. There are companies –
`
`matchmakers of the digital age – that design computer programs to match app users with the ads
`
`most suited to them.
`
`This is how it works, in a nutshell. Ad exchanges, or “networks,” sell coding known as
`
`software development kits, or “SDKs,” to app developers to embed into their apps. When an
`
`app is in use, data signals from the SDKs collect information about the app users. Based on that
`
`information, the networks’ sophisticated algorithms allow the instantaneous, automated buying
`
`and selling of advertisements, and the instantaneous, automated service of those advertisements
`
`back to the app users. In this way, the ad networks provide “monetization platforms” that
`
`mediate between app developers and third-party advertisers, maximizing the effectiveness of
`
`mobile app advertising and the resulting revenue that an app developer can earn from selling
`
`advertising space on its free apps.
`
`Sometimes, and perhaps more often than some parents would like, app users are children,
`
`just as susceptible (if not more so) to targeted advertising than adult app users. As a general
`
`rule, a federal statute known as the Children’s Online Privacy Protection Act (“COPPA”)
`
`prohibits app developers and ad networks from collecting certain personal information from app
`
`users who are children without first taking certain precautions. This opinion addresses what
`
`
`
`2
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 3 of 39
`
`appears to be an issue of first impression, namely, under what circumstances ad networks may be
`
`held liable under COPPA for their collection of personal information from app users who are
`
`children, in addition to how issues of preemption and state law come into play.
`
`II.
`
`The Facts
`
`Tiny Lab Productions (“Tiny Lab”), a Lithuanian company, is a developer of child-
`
`directed, mobile game apps including Fun Kid Racing, Candy Land Racing, Baby Toilet Race:
`
`Cleanup Fun, and GummyBear and Friends Speed Racing. Doc. 1 ¶ 3. Tiny Labs apps are
`
`“fun, free, kid-focused games” that have a “cartoonish design and subject matter,” and Tiny Lab
`
`represents that the “children love” their games, that the “levels are designed specifically for
`
`children,” that the games are “for kids,” and will keep them “entertained for months,” and that
`
`the “games are expressly to be played by [] children.” Id. ¶¶ 100, 30-31.
`
`During the relevant time period, Tiny Lab’s apps were available for download in the
`
`Google Play Store, operated by Google. Id. ¶ 12. “[T]he majority of Tiny Lab’s Gaming
`
`Apps were submitted to Google as family friendly, child-directed and appropriate for inclusion in
`
`Google’s Designed for Family section on Google Play.” Id. ¶ 109.
`
`Google/AdMob, Twitter/MoPub, InMobi/AerServ, Applovin, and ironSource
`
`(collectively, the “Ad Networks”) sold their proprietary SDKs to Tiny Lab for installation and
`
`use in its gaming apps. Id. ¶ 13. When a Tiny Lab app is downloaded onto a child’s device in
`
`New Mexico, the Ad Networks’ SDKs are also installed as app components. Id. ¶ 5. Once so
`
`embedded, while a child in New Mexico plays one of the apps, the Ad Networks’ SDK collects
`
`personal information about that child and tracks the child’s online behavior to profile the child
`
`for targeted advertising. Id. ¶¶ 43-46. This activity is invisible to the child and her parents,
`
`who simply see the given app’s game interface, and occurs “without (1) reasonable and
`
`
`
`3
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 4 of 39
`
`meaningful notice to parents, or (2) verifiable parental consent.” Id. ¶¶ 46, 55, 66, 74.
`
`Specifically, as soon as a child in New Mexico opens up a Tiny Lab app on her device
`
`and it connects to the internet, the app connects to servers, including the Ad Networks’ servers.
`
`Id. ¶ 55. The embedded SDKs then begin sending data about the child to the Ad Networks’
`
`respective servers. Id. As the child plays the app, the SDKs continue to communicate with
`
`the servers, sending requests, or “calls” for advertisements targeted to the child playing the app.
`
`Id. ¶ 56. With each request from the embedded software, the child’s personal information,
`
`including her location in New Mexico, is transmitted to the Ad Networks’ servers. Id.
`
`The Ad Networks take and analyze this data “for purposes of profiling the child and
`
`serving her age-based, behavioral advertising targeted to children.” Id. ¶ 108. Advertisements
`
`served to users of the apps include those for “cartoonish games very similar in content and
`
`cartoonish presentation to the Tiny Lab Gaming Apps.” Id. The Ad Networks further use the
`
`data they collect “to trigger events – both within the app and across the Internet – that will
`
`encourage [the child] to play the app more often and for longer periods.” Id. ¶ 153.
`
`The Ad Networks’ servers also store and analyze the child’s information “to enable
`
`continued tracking of [that] child, such as what ads she has already seen, what actions she took in
`
`response to those ads, other online behavior, and additional demographic data.” Id. ¶ 56.
`
`“This way, each [Advertising Network] (and other affiliated entities) can generally monitor,
`
`profile, and track her over time, across devices, and across the Internet.” Id.
`
`The data that the Ad Networks take from children’s devices are called ‘persistent
`
`identifiers,’” which are “a set of unique data points” that “can link one specific individual to all
`
`of the apps on her device and her activity on those apps.” Id. ¶ 50. These persistent identifiers
`
`include “device fingerprint data,” which in turn includes the name and developer of the app that
`
`
`
`4
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 5 of 39
`
`the child is operating. Id. ¶¶ 51-53, 63, 71, 79, 86, 93. In addition, some of the Ad Networks,
`
`namely, Twitter/MoPub, Google/AdMob, and InMobi/AerServ, “can receive the GPS location of
`
`the child’s device, with a street-level granular accuracy.” Id. ¶¶ 61, 69, 77.
`
`While “[v]iewed in isolation, a persistent identifier is merely a string of numbers
`
`uniquely identifying a child,” when “linked to other data points about the same child such as app
`
`usage, geographic location (including likely domicile), and Internet navigation, it discloses a
`
`personal profile that can be exploited in a commercial context.” Id. ¶ 123. The Ad Networks
`
`“aggregate this data, and also buy it from and sell it to other third-parties,” and, linking it with
`
`the child’s geolocation, create “an increasingly sophisticated profile of how, when, and why a
`
`child uses her mobile device.” Id. ¶¶ 124-126.
`
`The Ad Networks engage in these actions “despite widespread awareness that children
`
`are more vulnerable to deception by advertisers because they are easily influenced by its content,
`
`lack the cognitive skills to understand the intention of advertisers, and can struggle to distinguish
`
`between advertisements and other content.” Id. ¶ 141. Further, “[p]arents are increasingly
`
`concerned about their children’s mobile device usage,” as increased usage is associated “with
`
`negative consequences for children,” including “increasing rates of ADHD, depression, anxiety,
`
`and reduced focus in the classroom.” Id. ¶ 158. Similarly, sources such as legislative
`
`enactments, scholarly literature, and comments by self-regulatory agencies manifest “society’s
`
`deep revulsion” toward the sort of “collecting and accessing of personal information for tracking
`
`and profiling purposes” in which the Ad Networks engage. Id. ¶ 180.
`
`III.
`
`The Instant Case
`
`The State of New Mexico (“Plaintiff”) commenced this action, asserting a federal
`
`statutory claim against Tiny Lab and the Ad Networks for violation of COPPA, along with a
`
`
`
`5
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 6 of 39
`
`state statutory claim against Tiny Lab and the Ad Networks for violations of the New Mexico
`
`Unfair Practices Act (“UPA”), a state common law claim against Tiny Lab and the Ad Networks
`
`for intrusion on seclusion, and a state statutory claim against Google for an additional violation
`
`of the UPA in connection with its operation of Google Play. Id. ¶¶ 207-248.
`
`Thereafter, all of the Ad Networks other than Google/AdMob (collectively, the “SDK
`
`Defendants”) together filed one motion to dismiss, in which Google/AdMob joined.
`
`Additionally, Google filed its own motion to dismiss on behalf of Google as the operator of
`
`Google Play and Google/AdMob. The State objects to both motions.
`
`STANDARD
`
`Under Rule 12(b)(6), a Court may dismiss a complaint for “failure to state a claim upon
`
`which relief can be granted.” Fed. R. Civ. P. 12(b)(6). “The nature of a Rule 12(b)(6) motion
`
`tests the sufficiency of the allegations within the four corners of the complaint.” Mobley v.
`
`McCormick, 40 F.3d 337, 340 (10th Cir. 1994). When considering a Rule 12(b)(6) motion, the
`
`Court must accept as true all well-pleaded factual allegations in the complaint, view those
`
`allegations in the light most favorable to the plaintiff, and draw all reasonable inferences in the
`
`plaintiff’s favor. Smith v. United States, 561 F.3d 1090, 1097 (10th Cir. 2009), cert. denied,
`
`130 S. Ct. 1142 (2010).
`
`“To survive a motion to dismiss, a complaint must contain sufficient factual matter,
`
`accepted as true, to state a claim to relief that is plausible on its face.” Ashcroft v. Iqbal, 556
`
`U.S. 662, 678 (2009) (citations omitted). “A claim has facial plausibility when the plaintiff
`
`pleads factual content that allows the court to draw the reasonable inference that the defendant is
`
`liable for the misconduct alleged.” Id. “Where a complaint pleads facts that are ‘merely
`
`consistent with’ a defendant’s liability, it ‘stops short of the line between possibility and
`
`
`
`6
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 7 of 39
`
`plausibility of entitlement to relief.’” Id. (quoting Bell Atl. Corp. v. Twombly, 550 U.S. 544,
`
`557 (2007)).
`
`The Court in Iqbal identified “two working principles” in the context of a motion to
`
`dismiss. Id. First, “the tenet that a court must accept as true all of the allegations contained in
`
`a complaint is inapplicable to legal conclusions. Threadbare recitals of the elements of a cause
`
`of action, supported by mere conclusory statements, do not suffice.” Id. Accordingly, Rule 8
`
`“does not unlock the doors of discovery for a plaintiff armed with nothing more than
`
`conclusions.” Id. at 678-79. “Second, only a complaint that states a plausible claim for relief
`
`survives a motion to dismiss.” Id. at 679; see Twombly, 550 U.S. at 570 (holding that a plaintiff
`
`must “nudge” her claims “across the line from conceivable to plausible”). Accordingly, “where
`
`the well-pleaded facts do not permit the court to infer more than the mere possibility of
`
`misconduct, the complaint has alleged – but it has not shown – that the pleader is entitled to
`
`relief.” Id. (citation omitted).
`
`In keeping with these two principles, the Court explained,
`
`a court considering a motion to dismiss can choose to begin by identifying
`pleadings that, because they are no more than conclusions, are not entitled to the
`assumption of truth. When there are well-pleaded factual allegations, a court
`should assume their veracity and then determine whether they plausibly give rise
`to an entitlement to relief.”
`
`Id. at 679.
`
`DISCUSSION
`
`
`
`In their Motions to Dismiss, the SDK Defendants and Google argue that: (1) Plaintiff has
`
`failed to adequately allege that the Ad Networks violated COPPA; (2) as a result, Plaintiff’s state
`
`law claims against the Ad Networks are preempted by COPPA; and (3) even if the state law
`
`claims were not preempted, Plaintiff has failed to adequately allege claims against the Ad
`
`
`
`7
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 8 of 39
`
`Networks under either the UPA or common law. In its Motion to Dismiss, Google further
`
`argues that Plaintiff has failed to adequately allege that it violated the UPA in connection with its
`
`operation of Google Play.
`
`I.
`
`
`
`The COPPA Claims
`
`COPPA, codified at 15 U.S.C. § 6501, et seq., “prohibits unfair or deceptive acts or
`
`practices in connection with the collection, use, and/or disclosure of personal information from
`
`and about children on the Internet.” 16 C.F.R. § 312.1. Specifically, COPPA makes it
`
`“unlawful for an operator of a website or online service directed to children, or any operator that
`
`has actual knowledge that it is collecting personal information from a child, to collect personal
`
`information from a child in a manner that violates the [relevant] regulations ” (collectively
`
`codified as the “COPPA Rule”) prescribed by the Federal Trade Commission (the
`
`“Commission”). 15 U.S.C. § 6502(a)(1). In turn, the COPPA Rule provides in relevant part
`
`that, subject to certain exceptions, an operator must provide notice and “[o]btain verifiable
`
`parental consent prior to any collection, use, and/or disclosure of personal information from
`
`children.” 16 C.F.R. §§ 312.3(b), 312.4(a).
`
` COPPA thus addresses the “collection of personal information” from child app users.
`
`This includes “passively tracking” both “persistent identifiers” and “geolocation information,”
`
`which is what Plaintiff alleges Tiny Lab and the Ad Networks did here. 16 C.F.R. § 312.2.
`
`COPPA distinguishes between the app developers, who create the content of the apps – such as
`
`Tiny Lab – and the “plug-ins” or “ad networks” – such as Defendant Ad Networks – who
`
`provide software to collect information from app users. Specifically, app developers whose
`
`content is directed to children are strictly liable under COPPA if personal information is
`
`collected, in a manner that violates the COPPA Rule, from children using their apps. In
`
`
`
`8
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 9 of 39
`
`contrast, ad networks may be held liable for the collection of personal information from child
`
`app users only if they have “actual knowledge” that the apps in which their SDKs are embedded
`
`are directed to children. See 16 C.F.R. § 312.2.
`
`Unsurprisingly then, the parties disagree as to whether the Complaint adequately alleges
`
`that the Ad Networks had “actual knowledge” that the Tiny Lab apps were directed to children.
`
`In their motion, the SDK Defendants’ first and most persuasive argument is that the allegations
`
`in the Complaint, if proven, would fail to establish that they had “actual knowledge” that the
`
`Tiny Lab apps were “directed to children.” The SDK Defendants also argue, less convincingly,
`
`that the Complaint fails to allege that they collected personal information from children in a
`
`manner that violates the COPPA Rule. Google joins in both of these arguments, makes further
`
`not so persuasive points regarding the actual knowledge requirement, and makes the additional
`
`unavailing argument that it was entitled “as a matter of law” to rely on Tiny Lab’s obligation to
`
`ensure COPPA compliance.
`
`A.
`
`Actual Knowledge That Tiny Lab’s Apps Were Child-Directed
`
`Neither COPPA (the statute) nor the COPPA Rule defines “actual knowledge.” The
`
`commonly accepted legal definition of “knowledge” is “[a]n awareness or understanding of a
`
`fact or circumstance; a state of mind in which a person has no substantial doubt about the
`
`existence of a fact.” Black’s Law Dictionary (11th ed. 2019). Further, the definition of
`
`“actual knowledge,” which is “[d]irect and clear knowledge,” specifically distinguishes it from
`
`“constructive knowledge,” which is “[k]nowledge that one using reasonable care or diligence
`
`should have, and therefore that is attributed by law to a given person.” Id. Thus, the COPPA
`
`Rule reserves liability only for those ad networks with a direct and clear awareness, as opposed
`
`to an awareness attributed to them based on what they reasonably should have known, that the
`
`
`
`9
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 10 of 39
`
`apps in which their SDKs are embedded are directed to children.
`
`According to Plaintiff, through communications between the Ad Networks’ SDKs and
`
`their servers, all of the Ad Networks learned that Tiny Lab’s apps were directed to children.
`
`Also according to Plaintiff, Google (and Google alone) further gained actual knowledge of the
`
`child-directed nature of Tiny Lab’s apps through its own review of those apps. As discussed
`
`herein, the Court concludes that the Complaint does not plausibly allege actual knowledge on the
`
`part of the Ad Networks by virtue of the communications between their SDKs and their servers,
`
`but does plead factual content that allows the Court to draw the reasonable inference that Google
`
`had actual knowledge of the child-directed nature of Tiny Lab’s apps.
`
`1.
`
`The Complaint Fails to Allege that the Ad Networks Acquired Actual
`Knowledge of the Child-Directed Nature of Tiny Lab’s Apps Via
`Communications Between Their SDKs and Their Servers.
`
`
`The Complaint alleges that, while a Tiny Lab app was in use, the Ad Networks’ SDKs
`
`communicated to their servers the app user’s persistent identifiers, which included device
`
`fingerprint data. In turn, the device fingerprint data included “the bundle ID,” which contains
`
`“the name of the developer” and “the child-directed app title.” Doc. 1 ¶ 107. In the example
`
`provided in the Complaint, the developer name is “Tiny Lab” and the app title is “Fun Kid
`
`Racing” – information that Plaintiff alleges “manifestly indicate[d] the child-directed nature of
`
`the Gaming App and its content.” Id. The Complaint further alleges that the Ad Networks’
`
`service of “age-based, behavioral advertising targeted to children” in response to the SDKs’ calls
`
`requesting ad placements demonstrates the Ad Networks’ knowledge that the app users were
`
`children. Id. ¶ 108. This must be so, Plaintiff argues, because if the Ad Networks did not
`
`know that the app users were children, they would be unable to fulfill their very function,
`
`namely, to match ads with app users. See Doc. 66 at 16; Doc. 65 at 9-10.
`
`
`
`10
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 11 of 39
`
`Compelling though this argument may seem at first glance, the Court is not convinced.
`
`First, the nature of the information exchange at issue involves the automated transmission of data
`
`signals from embedded coding to computer servers and back again, not the communication of
`
`comprehensible information from which a sentient being might ascertain the child-directed
`
`content of Tiny Lab apps. The automated transmission of data signals is not an equal substitute
`
`for the communication of information in a format that plausibly could impart a direct and clear
`
`understanding of that information to the recipient.
`
`The automated and instantaneous service of targeted advertising in response to the SDKs’
`
`calls is equally a function of computer coding and sophisticated algorithms. The Complaint
`
`does not allege, and it would hardly be plausible if it did, that any sentient being at the Ad
`
`Networks had contemporaneous knowledge of who was using the apps in which the SDKs were
`
`embedded, and based on that knowledge, was able to instantaneously send ads to those users.
`
`There thus is no factual basis to draw the inference that the Ad Networks’ ability to serve
`
`targeted advertising back to its SDKs demonstrates the Ad Networks’ awareness of the identity
`
`of Tiny Lab app users. To the contrary, it is clear from the Complaint that the Ad Networks are
`
`able to send targeted advertising not because they are aware of who is using the apps, but rather
`
`because their servers were designed to process the data collected from the app users and match it
`
`with advertising data. The only knowledge that this functionality reveals is the knowledge of
`
`the coding-savvy individuals who designed the Ad Networks’ computer programs in the first
`
`instance.
`
`Indeed, the automated transmission of data signals between the Ad Networks’ SDKs and
`
`their servers appears from the Complaint to be the modus operandi of all of the ad networks that
`
`mediate between app developers and third-party advertisers; this is simply how the process of
`
`
`
`11
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 12 of 39
`
`their matchmaking works. If, without something more, the transmission from an ad network’s
`
`SDKs to its servers is deemed sufficient to impart actual knowledge of the child-directed nature
`
`of an app to an ad network, then all ad networks whose SDKs are embedded in child-directed
`
`apps would be equally subject to COPPA. If the Commission had intended for all ad networks
`
`who collect personal information from users of child-directed apps to be subject to COPPA,
`
`there would have been no reason to include language that, on its face, restricts liability to only
`
`certain of those ad networks. In contrast to its treatment of developers of child-directed apps,
`
`who are strictly liable for the collection of personal information from children, the plain
`
`language of the COPPA Rule holds ad networks liable for the same conduct only where they
`
`have actual knowledge that the apps are child-directed. Holding that the facts alleged here are
`
`sufficient to establish actual knowledge would effectively read the actual knowledge limitation
`
`on ad network liability out of the COPPA Rule, thereby eliminating the distinction between the
`
`standard to which content developers and ad networks each are held.
`
`Further, even if the Court were to find the transmission of data signals sufficient to
`
`bestow actual knowledge in the sense envisioned by the COPPA Rule, the Complaint falls short
`
`of alleging that the Ad Networks had actual knowledge from those data signals that the Tiny Lab
`
`apps were child-directed. What Plaintiff alleges the Ad Networks actually knew is the name of
`
`the app developer (Tiny Lab) and the name of the app being used (for example, Fun Car Racing).
`
`Although Plaintiff argues that this information “manifestly indicate[d] the child-directed nature
`
`of the Gaming App and its content,” implicit in this argument is that a reasonable person should
`
`have drawn the conclusion that the apps were child-directed from the name of the developer and
`
`the app. In other words, the Complaint alleges that the information available to the Ad
`
`Networks gives them constructive knowledge of the child-directed nature of the apps. Because
`
`
`
`12
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 13 of 39
`
`the standard here is actual, rather constructive knowledge, these allegations are insufficient.
`
`Moreover, it is not clear that this information – the name of the developer and the app –
`
`would be sufficient to provide even constructive knowledge of the child-directed nature of the
`
`app. The factors identified in the COPPA Rule for evaluating whether an app is directed or
`
`targeted to children do not include the name of either the developer or the app, but rather focus
`
`on the substance of the app itself. In particular, the enumerated factors include the app’s
`
`subject matter, language, visual, music, or audio content, use of animated characters or child-
`
`oriented activities and incentives, and use of child-directed ads, in addition to the age of models
`
`appearing on the app and the presence of child celebrities or celebrities who appeal to children
`
`on the app. 16 C.F.R. § 312.2. The COPPA Rule further indicates that “competent and
`
`reliable empirical evidence regarding audience composition, and evidence regarding the intended
`
`audience” may also be considered. Id.
`
`The Complaint nowhere alleges that any of these characteristics of Tiny Lab’s apps was
`
`conveyed to the Ad Networks by their SDKs. Plaintiff alleges that the fact that the Ad
`
`Networks served child-directed ads to the users of the apps demonstrates that the Ad Networks
`
`knew both that the apps used child-directed ads and that the app audience was comprised of
`
`children, factors relevant to the consideration of whether apps are child-directed. As discussed
`
`above, however, the fact that the Ad Networks were able to send child-directed ads does not
`
`allow the reasonable inference that they “knew” that the app users were children. And for
`
`purposes of determining what knowledge was conveyed to the Ad Networks by their SDKs’
`
`communications, Plaintiff’s allegations are limited to the transmission of only the name of the
`
`developer and the app being used. To consider the Ad Networks’ service of child-directed ads
`
`after receipt of these transmissions would turn the inquiry on its head.
`
`
`
`13
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 14 of 39
`
`In support of their respective arguments as to whether the Complaint sufficiently alleges
`
`actual knowledge, both sides rely upon the official Statement of Basis and Purpose published by
`
`the Commission with the amended COPPA Rule. After observing that “[k]nowledge, by its
`
`very nature, is a highly fact-specific inquiry,” the Commission stated its belief that “the actual
`
`knowledge standard” it was adopting “will likely be met in most cases when: (1) A child-
`
`directed content provider (who will be strictly liable for any collection) directly communicates
`
`the child-directed nature of its content to the other online service; or (2) a representative of the
`
`online service recognizes the child-directed nature of the content.” Federal Trade Commission,
`
`Children’s Online Privacy Protection Rule, Final Rule Amendments and Statement of Basis and
`
`Purpose, 78 Fed. Reg. 3972, 3978 (Jan. 17, 2013). The Commission further explained that it
`
`did “not rule out that an accumulation of other facts would be sufficient to establish actual
`
`knowledge,” and noted that “those facts would need to be analyzed carefully on a case-by-case
`
`basis.” Id.
`
`“The Statement of Basis and Purpose is not a rule.” Lozada v. Dale Baker Oldsmobile,
`
`Inc., 91 F. Supp. 2d 1087, 1094 (W.D. Mich. 2000). Instead, it provides an “explanation of the
`
`history and reasoning for implementation of the [COPPA Rule].” Id. Accordingly, the
`
`“Statement is not on the same footing as the language of the regulation itself.” Id. To the
`
`extent that it is nonetheless permissible to look at the commentary in determining the meaning of
`
`the “actual knowledge” language in the COPPA Rule, that commentary reaffirms the Court’s
`
`conclusion that the Complaint’s allegations are insufficient.
`
`Plaintiff argues that the actual knowledge standard set forth in the Statement is met here
`
`because the Complaint both “describe[s] direct communications to the [Ad Networks] from Tiny
`
`Lab itself about the Apps’ child-directed status,” and because “responses to those
`
`
`
`14
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 15 of 39
`
`communications show[] the [Ad Networks’] recognition that the Tiny Lab Apps were child-
`
`directed.” Doc. 65 at 8. But the Complaint alleges no “direct communications” from Tiny Lab,
`
`the “child-directed content provider” here. Rather, the only “direct communications” alleged
`
`are between the Ad Networks’ own SDKs and servers. Thus, the first scenario envisioned by
`
`the Commission as meeting the actual knowledge standard is not adequately alleged here.
`
`Similarly, there are no allegations in the Complaint that “a representative” of any of the
`
`Ad Networks recognized the child-directed nature of Tiny Lab’s apps. Allegations that the Ad
`
`Networks’ servers sent targeted ads in response to their SDKs’ data signals, if proven, would
`
`establish no more than that their servers – as opposed to any of their representatives – recognized
`
`the data that they received. The Commission’s use of the word “representative” suggests that,
`
`in order to meet the second factual scenario, Plaintiff must allege that a person who works for
`
`the Ad Networks recognized the child-directed nature of Tiny Lab’s apps. Indeed, the
`
`commonly accepted legal definition of “representative” is “someone who stands for or acts on
`
`behalf of another.” Black's Law Dictionary (11th ed. 2019) (emphasis added). That the
`
`Commission intended “representative” to mean a person is reflected in its response to a question
`
`from an ad network about application of the actual knowledge standard, which was included in
`
`an online publication of “Frequently Asked Questions” about COPPA. Specifically, the
`
`Commission stated:
`
`Under the second scenario, whether a particular individual can obtain actual
`knowledge on behalf of your business depends on the facts. Prominently
`disclosing on your site or service methods by which individuals can contact your
`business with COPPA information – such as: 1) contact information for
`designated individuals, 2) a specific phone number, and/or 3) an online form or
`email address – will reduce the likelihood that you would be deemed to have
`gained actual knowledge through other employees.
`
`Complying with COPPA: Frequently Asked Questions – A Guide for Business and Parents and
`
`
`
`15
`
`

`

`Case 1:18-cv-00854-MV-JFR Document 87 Filed 04/29/20 Page 16 of 39
`
`Small Entity Compliance Guide (Mar. 20, 2015), FAQ D. 10, https://www.ftc.gov/tips-
`
`advice/business-center/guidance/complying-coppa-frequently-asked-questions. Accordingly,
`
`the second scenario envisioned by the Commission as meeting the actual knowledge standard is
`
`not adequately alleged here.
`
`In the Statement, the Commission did not foreclose that “an accumulation of other facts
`
`would be sufficient to establish actual knowledge,” and noted that “those facts would need to be
`
`analyzed carefully on a case-by-case basis.” Id. In its above discussion, the Court undertook
`
`just such an analysis of the facts alleged in this case. And as explained above, based on this
`
`analysis, the Court has determined that the Complaint’s allegations regarding communications
`
`between the Ad Network’s SDKs and their servers neither state nor give rise to the reasonable
`
`inference that the Ad Networks had actual knowledge of the child-directed nature of Tiny Lab’s
`
`apps.
`
`Because the allegations regarding communications between the Ad Networks’ SDKs and
`
`their servers are the only allegations with which Plaintiff attempts to plead actual knowledge on
`
`the part of the SDK Defendants, the Complaint fails to state a COPPA violation as to the SDK
`
`Defendants. Plaintiff’s COPPA claim, set forth in Count I of the Complaint, thus will be
`
`dismissed as to the SDK Defendants. As discussed in the next section, however, additional
`
`allegations in the Comp