## Facts

- Parents sued on behalf of minor children who played a child-directed mobile game, *Subway Surfers*, bringing putative class claims.
- The game’s developers integrated third-party advertising and analytics software development kits (SDKs) into the app.
- Plaintiffs alleged the embedded SDKs collected and transmitted data such as persistent device identifiers, IP address, location-related information, and in-app behavioral/usage data while children played.
- Plaintiffs alleged defendants used the collected data to track children over time, build user profiles, and serve targeted advertising, without adequate disclosure or verifiable parental consent.
- Plaintiffs asserted injuries including invasion of privacy and loss of control over children’s personal information, allegedly monetized by defendants.
- Defendants (developers and SDK providers) moved to dismiss under Rule 12(b)(6) at the pleading stage.

## Issues

1. Whether the allegations plausibly stated a California intrusion-upon-seclusion claim based on covert data collection and profiling of children through a mobile app.
2. Whether COPPA preempted or otherwise barred state-law privacy and consumer-protection claims relying on the same alleged conduct.
3. Whether plaintiffs plausibly alleged a reasonable expectation of privacy and “highly offensive” intrusion in the context of child-directed apps and persistent identifiers.
4. Whether the pleadings adequately connected both developers and SDK companies to the alleged tracking and monetization conduct.

## Decision

- The court granted the motions to dismiss in part and denied them in part.
- The court held plaintiffs plausibly stated an intrusion-upon-seclusion claim against both developer defendants and SDK defendants.
- The court rejected broad COPPA preemption arguments and allowed state-law claims to proceed where they were not framed as private enforcement of COPPA.
- The court permitted several other privacy and unfair-competition theories to proceed in whole or in part, while dismissing or narrowing certain statutory/wiretap-related claims for insufficiently specific pleading.

## Legal Principles

- California intrusion upon seclusion requires (1) an intentional intrusion into a matter as to which the plaintiff has a reasonable expectation of privacy and (2) intrusion that would be highly offensive to a reasonable person.
- Allegations of persistent identifier-based tracking, profiling, and monetization of children’s app activity, undertaken without adequate disclosure or parental consent, can plausibly satisfy both elements at the pleading stage.
- COPPA’s enforcement limitations and limited preemption clause do not categorically bar parallel state-law privacy claims based on the same conduct; COPPA-related materials may be used as contextual evidence of privacy norms without converting a claim into private COPPA enforcement.
- At the pleading stage, allegations that developers selected and deployed SDKs to monetize child users, and that SDK providers designed tools to collect and exploit app-derived data, can be sufficient to plead participation and intent for core privacy tort theories.

## Conclusion

The court allowed the central state-law privacy claims—especially intrusion upon seclusion—challenging alleged covert tracking and profiling of children through mobile-game SDKs to move forward, while trimming other theories and rejecting the argument that COPPA broadly preempted complementary state-law claims.


McDonald v. Kiloo ApS, 385 F. Supp. 3d 1022 (N.D. Cal. 2019)