## Facts

- Path, Inc. operated a social-networking website and mobile applications that let users create a personal journal and share it with their network.
- During registration, Path required users to provide an email address and name, and it gave users an option to enter a date of birth.
- When users entered a date of birth, Path could determine the user’s age from that information.
- Over about 18 months, Path accepted registrations from roughly 3,000 users whose provided birth dates indicated they were under age 13.
- Path collected personal information from these children and permitted them to publicly disclose that information.
- The United States, acting through the Federal Trade Commission, brought a civil enforcement action in the U.S. District Court for the Northern District of California alleging violations of the Children’s Online Privacy Protection Act of 1998 (COPPA).
- The enforcement materials also described allegedly deceptive privacy practices involving collection and uploading of users’ mobile address-book data.
- After the complaint was filed, Path and the government reached a proposed settlement and submitted it to the court for approval as a consent decree and order.

## Issues

1. Whether the district court should approve and enter the parties’ proposed consent decree resolving the government’s COPPA enforcement claims against Path.
2. Whether the consent decree could impose civil penalties and permanent injunctive relief governing Path’s collection, use, and disclosure of children’s personal information.
3. Whether the consent decree could impose forward-looking compliance, reporting, and record-keeping duties tied to COPPA and related consumer-privacy representations.

## Decision

- The court entered the parties’ consent decree and order.
- The order recited that the court had subject-matter jurisdiction and personal jurisdiction, and that venue was proper.
- The decree was entered without adjudication of disputed issues of fact or law, and without Path admitting liability other than jurisdiction and venue.
- The order imposed monetary relief described in public enforcement materials as an $800,000 civil penalty.
- The order imposed permanent injunctive relief addressing COPPA compliance, including restrictions on collecting, using, or disclosing children’s personal information without required notice and verifiable parental consent.
- The order also imposed compliance-related obligations (such as reporting and record-keeping) designed to support monitoring and enforcement of the injunction.

## Legal Principles

- COPPA and its implementing rule regulate the online collection, use, and disclosure of personal information from children under 13, including requirements for parental notice and verifiable parental consent.
- Section 5 of the FTC Act prohibits deceptive acts or practices, including misleading statements or omissions about consumer data collection and use.
- A federal court may enter a negotiated consent decree in an enforcement action to provide civil penalties and injunctive relief, even where liability is not litigated to judgment.
- Consent decrees commonly include prospective conduct restrictions plus compliance mechanisms (reporting, record retention, and related obligations) to allow enforcement of the order’s terms.
- Jurisdiction and venue must be established for entry of an enforceable federal consent decree and permanent injunction.

## Conclusion

United States v. Path concerns a federal enforcement action against Path, Inc. based on alleged COPPA violations stemming from collection and public disclosure of children’s personal information without required parental notice and consent, along with related privacy-practice allegations. The case ended when the Northern District of California entered a consent decree and order providing monetary relief and a permanent injunction requiring COPPA-focused compliance measures, without a contested merits determination or admission of liability beyond jurisdiction and venue.


United States v. Path, 2012 WL 7006381 (2012)