--- title: Mishandling Children's Data Leads to $500K CCPA Penalty - TrueVault description: California continues to vigorously enforce the state's data privacy law. This time, the target was the developer of a popular kids' mobile game. image: https://safe.truevault.com/hubfs/Pubmats/tilting-point-ccpa-fine.png --- - [CCPA](https://safe.truevault.com/learn/ccpa/what-is-the-ccpa) - [GDPR Compliance](https://safe.truevault.com/gdpr-guide) - [HIPAA](https://safe.truevault.com/learn/hipaa) - [HIPAA Compliance](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [Personally Identifiable Information](https://safe.truevault.com/blog/what-is-pii) - [PHI](https://safe.truevault.com/protected-health-information) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [Resources](https://safe.truevault.com/learn/?hsLang=en) - Login - Login - [TrueVault Safe Log in to TrueVault Safe](https://console.truevault.com) - [TrueVault Polaris Log in to TrueVault Polaris](https://polaris.truevault.com) - [CCPA Resources Center](https://safe.truevault.com/learn/ccpa/) # Mishandling Children's Data Leads to $500K CCPA Penalty ![children-online](https://safe.truevault.com/hs-fs/hubfs/images/children-online.jpg?width=800&height=533&name=children-online.jpg "children-online")   California Attorney General Rob Bonta has continued vigorous enforcement of the state’s landmark privacy law, the [California Consumer Privacy Act](https://safe.truevault.com/ccpa-guide?hsLang=en) (CCPA). Bonta’s office [recently announced a settlement](https://oag.ca.gov/news/press-releases/attorney-general-bonta-la-city-attorney-feldstein-soto-announce-500000) with Tilting Point Media, requiring the company to pay $500,000 in civil penalties, ensure future compliance, and submit annual reports to the California Department of Justice and the Los Angeles City Attorney’s Office. ## What Did Tilting Point Do Wrong? Tilting Point is an app developer that operates a mobile game (”SpongeBob: Krusty Cook-Off”) directed toward children. The state alleges that Tilting Point collected, sold, and shared the personal information of minors under the age of 16 without appropriate consent. There are two separate laws at play in the settlement: The CCPA and the federal Children’s Online Privacy Protection Act (COPPA). The CCPA prohibits the [sale and sharing of the personal information](https://safe.truevault.com/learn/ccpa/is-sharing-the-same-as-selling-under-the-ccpa?hsLang=en) of anyone under the age of 13 unless a parent or guardian has given prior consent; if the consumer is between the ages of 13 and 16, the consumer may be the one who gives consent. COPPA prohibits the collection of personal information from children under 13 unless a parent or guardian consents. These rules apply when a business has actual knowledge of (or willfully disregards) the consumer’s age or, under COPPA, operates a website or online service directed to children. There seems to be little question that the mobile game at issue falls within the scope of these rules. Tilting Point is alleged to have violated CCPA and COPPA in two ways: - **Not collecting users’ age in a “neutral manner"** While the app did have a mechanism to determine users’ age, the Attorney General says that “children were not encouraged to enter their age correctly to be directed to a child-version of the game.” Specifically, the default birth year was set to 1953; this made it easy for children to incorrectly indicate that they were adults while also requiring children to scroll through more than 50 years in order to correctly indicate their age. - **Misconfiguring third-party software to disclose children’s data** The state further alleges that Tilting Point inadvertently misconfigured third-party software development kits (SDKs) so that children’s personal information was collected, sold, and shared without appropriate consent. There is no further detail about who these third parties were or what type of SDKs were involved. In addition to paying a civil penalty of $500,000, Tilting Point must remediate its CCPA and COPPA violations and also submit annual reports to the state for the next three years detailing its efforts to stay in compliance. ## Privacy Compliance Made Simple The biggest obstacle businesses face in privacy compliance is not taking it seriously enough. Posting a generic privacy policy and assuming that authorities will automatically give businesses a chance to cure has become a high-risk strategy. The CCPA has been on the books for years, and state officials have run short on patience. The time for getting compliant is now, before an enforcement action disrupts your business and costs you hundreds of thousands of dollars in fines and legal fees. TrueVault US simplifies privacy compliance across multiple state laws, so that businesses can handle it on their own. With an interface that is familiar to anyone who has done their own taxes online, TrueVault guides you through every step of the process, from onboarding vendors to handling privacy requests. As [more states pass comprehensive privacy laws](https://www.truevault.com/privacy-laws-covered-by-truevault-products?hsLang=en), they are added to your Privacy Center at no extra cost. [Contact our team](https://www.truevault.com/contact-us?hsLang=en) to learn more and view a demo of how TrueVault works.   [![Schedule Call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4693513/949d85da-b649-4822-b380-0922b22c3b60.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4693513/949d85da-b649-4822-b380-0922b22c3b60) **Disclaimer:** This content is provided for general informational purposes only and does not constitute legal or other professional advice. Without limiting the foregoing, the content may not reflect recent developments in the law, may not be complete, and may not be accurate or relevant in an applicable jurisdiction. This content is not a substitute for obtaining legal advice from a qualified licensed attorney in the applicable jurisdiction. The content is general in nature and may not pertain to specific circumstances, so it should not be used to act or refrain from acting based on it without first obtaining advice from professional counsel qualified in the applicable subject matter and jurisdictions. - ON THIS PAGE - [What Did Tilting Point Do Wrong?](https://safe.truevault.com/resources/ccpa/mishandling-childrens-data-leads-to-500k-ccpa-penalty#what-did-tilting-point-do-wrong) - [Privacy Compliance Made Simple](https://safe.truevault.com/resources/ccpa/mishandling-childrens-data-leads-to-500k-ccpa-penalty#compliance) ##### Get compliant today Our attorney-designed software will step-by-step guide you through the compliance process from start to finish. [Request a Demo](https://www.truevault.com/contact-us?hsLang=en) ### Company - [Blog](https://safe.truevault.com/blog) - [Contact Us](https://safe.truevault.com/contact-us-2019) - [Careers](https://truevault.workable.com) - [HIPAA Compliance Checklist](https://safe.truevault.com/blog/hipaa-compliance-checklist-download.html) - [PDF: Developers Guide to HIPAA compliance](https://my.leadpages.net/leadbox/14472b173f72a2%3A131fd12f8b46dc/5760820306771968/) ### Developers - [Patterns](https://safe.truevault.com/patterns) - [Documentation](https://docs.truevault.com/) - [Quick Start Guide](https://safe.truevault.com/quick-start-guide) - [Secure Infrastructure](https://safe.truevault.com/secure-infrastructure) - [API Overview](https://safe.truevault.com/api-overview) ### Latest Posts ### Contact Us 201 Mission Street, 12th Floor San Francisco, CA 94105 Email: [hello@truevault.com](mailto:hello@truevault.com) 2024 © All Rights Reserved.  [Privacy Policy](https://privacy.truevault.com/privacy-policy)  |  [Terms of Use](https://www.truevault.com/legal/truevault-terms-of-use?hsLang=en)  |  [Supplemental Terms](https://www.truevault.com/legal/truevault-supplemental-terms-of-use?hsLang=en) | [California Privacy Notice](https://privacy.truevault.com/privacy-policy#california-privacy-notice)