## Facts

- RockYou, Inc. operated online services (websites and social-networking applications) that allowed users to create and share widgets, games, and similar content.
- To register and save uploaded content, users provided personal information including email address, password, date/year of birth, gender, zip code, and country.
- The government alleged RockYou operated a service directed to children, or had actual knowledge it collected personal information from children, and collected personal information from approximately 179,000 children under age 13.
- RockYou’s privacy policy represented that it used “commercially reasonable” safeguards to protect users’ personal information and that it did not knowingly collect or maintain personal information from children under 13.
- The government alleged RockYou failed to implement reasonable security measures, including storing usernames and passwords in clear, unencrypted text and failing to use adequate protections against unauthorized database access.
- A security incident allegedly exposed personal information of approximately 32 million users, including email addresses and passwords.
- For children under 13, the government alleged RockYou collected personal information without providing direct notice to parents, without obtaining verifiable parental consent, and without adequate disclosure of its practices regarding children’s information.

## Issues

1. Whether RockYou violated COPPA and the COPPA Rule by collecting, using, or maintaining personal information from children under 13 without required notice, verifiable parental consent, and reasonable safeguards.
2. Whether RockYou’s statements about its data security and its collection of children’s information constituted deceptive acts or practices under § 5(a) of the FTC Act.
3. What monetary penalties and injunctive terms were appropriate to address alleged COPPA noncompliance and alleged deceptive privacy and security representations.

## Decision

- The United States filed an action seeking civil penalties and injunctive relief, and the parties submitted a stipulated consent decree.
- The court entered a Consent Decree and Order resolving the case without adjudicating disputed facts or law; RockYou did not admit liability beyond jurisdiction and venue.
- RockYou agreed to pay $250,000 in civil penalties for alleged COPPA violations.
- The order permanently enjoined RockYou from violating COPPA and from making misrepresentations about the privacy, security, confidentiality, or integrity of personal information.
- The order required RockYou to implement a written, comprehensive information-security program and to obtain independent, third-party security assessments every two years for 20 years.
- The order required deletion of personal information collected from children in violation of the COPPA Rule and imposed recordkeeping and reporting obligations.

## Legal Principles

- COPPA and the COPPA Rule require operators of covered online services to provide notice of children’s information practices, obtain verifiable parental consent before collecting personal information from children under 13, and maintain reasonable procedures to protect the confidentiality, security, and integrity of such information.
- Under § 5 of the FTC Act, materially misleading representations about privacy or data-security practices may be treated as deceptive acts or practices.
- Injunctive relief in privacy and data-security enforcement may include mandated security governance measures, ongoing compliance monitoring, and long-term independent assessments to verify implementation and effectiveness.
- Consent decrees can impose binding prospective obligations and monetary penalties without a litigated merits decision, based on the court’s jurisdiction and authority to enter agreed relief.

## Conclusion

The court entered a consent decree requiring RockYou to pay civil penalties and to comply prospectively with COPPA and § 5-based prohibitions on deceptive privacy and security statements, including deletion of unlawfully collected children’s data and implementation of a long-term, independently assessed information-security program.


United States v. RockYou, Inc., No. 3:12-cv-01487-SI (N.D. Cal. 2012)