FTC, DOJ settle with WW weight loss app, citing violation of children's privacy

The app will have to wipe any algorithms it developed off the data.

The Federal Trade Commission and Justice Department slapped a children’s weight loss app with a $1.5 million penalty and an order to delete data it collected on thousands of children under 13 allegedly without proper parental consent.

The complaint from the FTC and DOJ alleges that Kurbo by WW (formerly known as Weight Watchers) failed to properly verify parental consent for users under 13 and made it easy for hundreds of users who identified as 13 or older during the signup process to then later change their age in the app.

It also alleges the app didn’t properly notify parents who signed up on their children’s behalf about the extent of the data collected by the app. Both practices, the FTC said, violate a decades-old federal children’s privacy law for users under 13 known as the Children’s Online Privacy Protection Act (COPPA).

“Weight Watchers and Kurbo marketed weight management services for use by children as young as eight, and then illegally harvested their personal and sensitive health information,” Federal Trade Commission Chair Lina Khan said in a statement Friday. “Our order against these companies requires them to delete their ill-gotten data, destroy any algorithms derived from it, and pay a penalty for their lawbreaking.”

The case is the first time the FTC has ordered a company to delete any technology created using data collected in violation of COPPA. The agency has in recent years started requiring firms to delete tech resulting from ill-gotten data as an enforcement tool.

WW acquired Kurbo in 2018, but the complaint alleges the violating behavior goes back to 2014. At least 18,600 of the more than 279,000 people that have used Kurbo since 2014 identified as children under the age of 13, according to the complaint. The app markets itself to children as young as eight, a practice that has attracted scrutiny from some dieticians and parents.

Under the settlement, according to the FTC, “the companies are also prohibited from retaining data collected in the future from children under 13 for more than a year after the last time a child uses Kurbo by WW.”

Kurbo did not admit any wrongdoing as part of the settlement.

“While Kurbo disputes that its historical practices violated COPPA, in every instance where the FTC staff indicated a possible compliance gap, Kurbo promptly took action to correct it,” Kurbo General Counsel Michael Colosi wrote in a statement.

Colosi denied that any “parents or children ever complained that Kurbo used their personal data in an inappropriate manner.”

House Republicans roll out national privacy bill

Experts say the federal legislation takes inspiration from states laws in Virginia and Kentucky, but a lack of bipartisan support could spell trouble. 

Apple and Google challenged by parents’ rights coalition on youth privacy protections

FTC announces settlement with toy robot makers that tracked location of children

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure