Miniclip S.A.

Text (OCR of the scan at left; may contain errors)

IN THE MATTER OF MINICLIP S.A.

CONSENT ORDER, ETC. IN REGARD TO ALLEGED VIOLATIONS OF SECTION 5 OF THE FEDERAL TRADE COMMISSION ACT AND THE CHILDREN’S ONLINE PRIVACY PROTECTION ACT Docket No. C-4722; File No. 192 3129 Complaint, June 29, 2020 – Decision, June 29, 2020 This consent order addresses Miniclip S.A.’s violation of Section 5 of the Federal Trade Commission Act by disseminating that it participated in the Children’s Advertising Review Unit (“CARU”) and complied with the Children’s Online Privacy Protection Act of 1998 (“COPPA”) when it did not. The complaint alleges that Respondent joined CARU’s COPPA safe harbor program in July 2009 until July 6, 2015, when CARU terminated Respondent’s participation in the COPPA safe harbor program. After CARU terminated Respondent from the safe harbor program, Respondent continued to make claims that it participated in the safe harbor program. The consent order requires Respondent must not misrepresent the extent to which Respondent participates in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization. Participants For the Commission: Jonah Fabricant and Ryan Mehm.

For the Respondents: Jennifer Archie and Alexander Stout, Latham & Watkins. COMPLAINT The Federal Trade Commission (“FTC” or “Commission”), having reason to believe that Miniclip S.A., a corporation (“Respondent”), has violated the Federal Trade Commission Act (“FTC Act”), and it appearing to the Commission that this proceeding is in the public interest, alleges:

1. Respondent Miniclip S.A. is a Swiss corporation with its principal office or place of business at 18 Faubourg de l’Hôpital, 2000 Neuchâtel, Switzerland. 2. Respondent develops, publishes, and distributes mobile and online digital games. As of August 2019, Respondent had approximately 100 applications (“apps”) available for download through Apple’s App Store and Google Play. Consumers can also play online games via Respondent’s website, www.miniclip.com, and through Facebook. 3. The acts and practices of Respondent as alleged in this complaint have been in or affecting commerce, as “commerce” is defined in Section 4 of the FTC Act. COPPA Safe Harbor Programs 4. Congress enacted the Children’s Online Privacy Protection Act of 1998 (“COPPA”) to protect the safety and privacy of children online by prohibiting the unauthorized or unnecessary collection of children’s personal information online by operators of Internet Web sites VOLUME 169 Complaint and online services (“operators”). COPPA directed the Commission to promulgate a rule implementing COPPA. The Commission promulgated the COPPA Rule on November 3, 1999, under Section 1303(b) of COPPA, 15 U.S.C. § 6502(b), and Section 553 of the Administrative Procedure Act, 5 U.S.C. § 553. The Rule went into effect on April 21, 2000. The Commission promulgated revisions to the Rule that went into effect on July 1, 2013. 5. COPPA includes a provision enabling industry groups or others to submit for Commission approval self-regulatory safe harbor programs that implement the protections of the Commission’s final Rule.

6. The COPPA safe harbor programs approved by the Commission review member operators’ compliance with the safe harbor programs’ guidelines. An operator who complies with the Commission-approved safe harbor program guidelines will be deemed in compliance with COPPA.

Relevant Business Practices 7. In 2001, the Commission approved the Children’s Advertising Review Unit (“CARU”) as a COPPA safe harbor program.

8. In July 2009, Respondent joined CARU’s COPPA safe harbor program. Thereafter, Respondent began disseminating statements regarding its participation in CARU’s COPPA safe harbor program.

9. From at least 2012 through June 2019, Respondent disseminated or caused to be disseminated the following statement on its Small Print website page (https://corporate.miniclip.com/advertising/small-print): In recognition of our focus on the quality and safety of our content, we have been accepted to join the CARU Kids Privacy Safe Harbor Program and have been certified as COPPA compliant.

10. From April 2019 through June 2019, Respondent disseminated or caused to be disseminated the same statement in Paragraph 9 on its Terms and Conditions website page (https://www.miniclip.com/terms). In addition to being available on Respondent’s website, the Terms and Conditions also were available to users through the settings menu in Respondent’s apps. 11. From at least November 2012 through July 2019, Respondent disseminated or caused to be disseminated the following statement on its Facebook Games Privacy Policy website page (https://www.miniclip.com/games/page/en/facebook-privacy-policy): Miniclip is a Certified Participant of the Better Business Bureau’s, CARU Kids Privacy Safe Harbor Program: http://www.caru.org/caru.aspx?id=275582381. The information practices of Miniclip.com have been reviewed and meet the MINICLIP S.A. 641 Decision and Order standards of the Children's Advertising Review Unit's Kid's Privacy Safe Harbor Program.

12. Respondent remained a member of CARU’s COPPA safe harbor program until July 6, 2015, when CARU terminated Respondent’s participation in the COPPA safe harbor program. 13. After CARU terminated Respondent from CARU’s COPPA safe harbor program, Respondent continued to make claims, as indicated in Paragraphs 9-11, that it participated in the CARU COPPA safe harbor program.

Count 1: COPPA Safe Harbor Misrepresentations 14. As described in Paragraphs 9-11, Respondent represented, directly or indirectly, expressly or by implication, that it was a current participant in the CARU COPPA safe harbor program.

15. In fact, as described in Paragraph 12, after CARU terminated Respondent from CARU’s COPPA safe harbor program, Respondent was not a current participant in the CARU COPPA safe harbor program. Therefore, the representation set forth in Paragraph 14 is false or misleading.

Violations of Section 5 of the FTC Act 16. The acts and practices of Respondent as alleged in this complaint constitute deceptive acts or practices, in or affecting commerce, in violation of Section 5(a) of the Federal Trade Commission Act.

THEREFORE, the Federal Trade Commission this twenty-ninth day of June 2020, has issued this complaint against Respondent.

By the Commission.

DECISION The Federal Trade Commission (“Commission”) initiated an investigation of certain acts and practices of the Respondent named above in the caption. The Commission’s Bureau of Consumer Protection (“BCP”) prepared and furnished to Respondent a draft Complaint. BCP proposed to present the draft Complaint to the Commission for its consideration. If issued by the Commission, the draft Complaint would charge Respondent with violation of the Federal Trade Commission Act.

VOLUME 169 Decision and Order Respondent and BCP thereafter executed an Agreement Containing Consent Order (“Consent Agreement”). The Consent Agreement includes: 1) statements by Respondent that it neither admits nor denies any of the allegations in the Complaint, except as specifically stated in this Decision and Order, and that only for purposes of this action, it admits the facts necessary to establish jurisdiction; and 2) waivers and other provisions as required by the Commission’s Rules. The Commission considered the matter and determined that it had reason to believe that Respondent has violated the Federal Trade Commission Act, and that a Complaint should issue stating its charges in that respect. The Commission accepted the executed Consent Agreement and placed it on the public record for a period of thirty (30) days for the receipt and consideration of public comments. Now, in further conformity with the procedure prescribed in Rule 2.34, the Commission issues its Complaint, makes the following Findings, and issues the following Order: Findings 1. Respondent Miniclip S.A. is a Swiss corporation with its principal office or place of business at 18 Faubourg de l’Hôpital, 2000 Neuchâtel, Switzerland. 2. The Commission has jurisdiction over the subject matter of this proceeding and over Respondent, and the proceeding is in the public interest. ORDER Definitions For purposes of this Order, the following definition applies: A. “Respondent” means Miniclip S.A., a corporation and its successors and assigns. Provisions I. Prohibition against Misrepresentations about Participation in or Compliance with Privacy Programs IT IS ORDERED that Respondent and its officers, agents, employees, and all other persons in active concert or participation with any of them, who receive actual notice of this Order, whether acting directly or indirectly, in connection with the advertising, marketing, promotion, offering for sale, or sale of any product or service must not misrepresent in any manner, expressly or by implication, the extent to which Respondent is a member of, adheres to, complies with, is certified by, is endorsed by, or otherwise participates in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, including but not limited to the Children’s Advertising Review Unit (CARU) Children’s Online Privacy Protection Act of 1998 (COPPA) safe harbor.

MINICLIP S.A. 643 Decision and Order II. Acknowledgments of the Order IT IS FURTHER ORDERED that Respondent obtain acknowledgments of receipt of this Order:

A. Respondent, within ten (10) days after the effective date of this Order, must submit to the Commission an acknowledgment of receipt of this Order. B. For five (5) years after the issuance date of this Order, Respondent must deliver a copy of this Order to: (1) all principals, officers, directors, and LLC managers and members; (2) all employees, agents, and representatives having managerial responsibilities for conduct related to the subject matter of the Order; and (3) any business entity resulting from any change in structure as set forth in the Provision titled Compliance Report and Notices. Delivery must occur within ten (10) days after the effective date of this Order for current personnel. For all others, delivery must occur before they assume their responsibilities.

C. From each individual or entity to which Respondent delivered a copy of this Order, Respondent must obtain, within thirty (30) days, a signed and dated acknowledgment of receipt of this Order.

III. Compliance Report and Notices IT IS FURTHER ORDERED that Respondent make timely submissions to the Commission:

A. Sixty (60) days after the issuance date of this Order, Respondent must submit a compliance report, sworn under penalty of perjury, in which Respondent must: (a) identify the primary physical, postal, and email address and telephone number, as designated points of contact, which representatives of the Commission, may use to communicate with Respondent; (b) identify all of Respondent’s businesses by all of their names, telephone numbers, and physical, postal, email, and Internet addresses; (c) describe the activities of each business; (d) describe in detail whether and how Respondent is in compliance with each Provision of this Order; and (e) provide a copy of each Acknowledgment of the Order obtained pursuant to this Order, unless previously submitted to the Commission.

B. Respondent must submit a compliance notice, sworn under penalty of perjury, within fourteen (14) days of any change in the following: (1) any designated point of contact; or (2) the structure of Respondent or any entity that Respondent has any ownership interest in or controls directly or indirectly that may affect compliance obligations arising under this Order, including: creation, merger, sale, or dissolution of the entity or any subsidiary, parent, or affiliate that engages in any acts or practices subject to this Order.

VOLUME 169 Decision and Order C. Respondent must submit notice of the filing of any bankruptcy petition, insolvency proceeding, or similar proceeding by or against Respondent within fourteen (14) days of its filing.

D. Any submission to the Commission required by this Order to be sworn under penalty of perjury must be true and accurate and comply with 28 U.S.C. § 1746, such as by concluding: “I declare under penalty of perjury under the laws of the United States of America that the foregoing is true and correct. Executed on: _____” and supplying the date, signatory’s full name, title (if applicable), and signature.

E. Unless otherwise directed by a Commission representative in writing, all submissions to the Commission pursuant to this Order must be emailed to [email protected] or sent by overnight courier (not the U.S. Postal Service) to: Associate Director of Enforcement, Bureau of Consumer Protection, Federal Trade Commission, 600 Pennsylvania Avenue, N.W., Washington, D.C. 20580. The subject line must begin: In re Miniclip S.A., FTC File No. 1923129. IV. Recordkeeping IT IS FURTHER ORDERED that Respondent must create certain records for ten (10) years after the issuance date of the Order, and retain each such record for five (5) years. Specifically, Respondent must create and retain the following records: A. accounting records showing the revenues from all goods or services sold; B. personnel records showing, for each person providing services, whether as an employee or otherwise, that person’s: name; addresses; telephone numbers; job title or position; dates of service; and (if applicable) the reason for termination; C. all records necessary to demonstrate full compliance with each provision of this Order, including all submissions to the Commission; and D. a copy of each widely disseminated representation by Respondent regarding Respondent’s participation in any privacy or security program sponsored by a government or any self-regulatory or standard-setting organization, and all materials that were relied upon in making the representation. V. Compliance Monitoring IT IS FURTHER ORDERED that, for the purpose of monitoring Respondent’s compliance with this Order:

A. Within ten (10) days of receipt of a written request from a representative of the Commission, Respondent must: submit additional compliance reports or other MINICLIP S.A. 645 Decision and Order requested information, which must be sworn under penalty of perjury, and produce records for inspection and copying.

B. For matters concerning this Order, representatives of the Commission are authorized to communicate directly with Respondent. Respondent must permit representatives of the Commission to interview anyone affiliated with Respondent who has agreed to such an interview. The interviewee may have counsel present. C. The Commission may use all other lawful means, including posing through its representatives as consumers, suppliers, or other individuals or entities, to Respondent or any individual or entity affiliated with Respondent, without the necessity of identification or prior notice. Nothing in this Order limits the Commission’s lawful use of compulsory process, pursuant to Sections 9 and 20 of the FTC Act, 15 U.S.C. §§ 49, 57b-1.

VI. Order Effective Dates IT IS FURTHER ORDERED that this Order is final and effective upon the date of its publication on the Commission’s website (ftc.gov) as a final order. This Order will terminate on June 29, 2040, or twenty (20) years from the most recent date that the United States or the Commission files a complaint (with or without an accompanying settlement) in federal court alleging any violation of the Order, whichever comes later; provided, however, that the filing of such a complaint will not affect the duration of:

A. any Provision in this Order that terminates in less than twenty (20) years; B. this Order’s application to any respondent that is not named as a defendant in such complaint; and C. this Order if such complaint is filed after the order has terminated pursuant to this Provision.

Provided, further, that if such complaint is dismissed or a federal court rules that Respondent did not violate any provision of the Order, and the dismissal or ruling is either not appealed or upheld on appeal, then the Order will terminate according to this Provision as though the complaint had never been filed, except that the Order will not terminate between the date such complaint is filed and the later of the deadline for appealing such dismissal or ruling and the date such dismissal or ruling is upheld on appeal.

By the Commission.

VOLUME 169 Concurring Statement STATEMENT OF COMMISSIONER ROHIT CHOPRA REGARDING MINICLIP AND THE COPPA SAFE HARBORS Miniclip is a major player in the mobile gaming space, offering over 1,000 games to users,1 including children, around the world. Miniclip is owned by Tencent, the Chinese tech conglomerate.2 Today, the FTC is taking action against Miniclip, but not for violations of the Children’s Online Privacy Protection Act (COPPA). Instead, the Commission is ordering Miniclip to stop misrepresenting that it participates in a children’s privacy self-regulatory program. Miniclip was enrolled in a COPPA “Safe Harbor” program run by the Children’s Advertising Review Unit (CARU). The Federal Trade Commission approves these Safe Harbor programs, and companies that participate in an approved program get special regulatory treatment. According to CARU, “Program participants who adhere to CARU’s Guidelines are deemed in compliance with COPPA and essentially insulated from enforcement actions by the Federal Trade Commission (FTC).”3 In 2015, Miniclip was terminated from CARU’s Safe Harbor program. According to my office’s analysis of COPPA Safe Harbor reports submitted to the FTC, terminations are exceedingly rare.4 I commend CARU for demonstrating its willingness to discipline its participants that violate its guidelines, but the specific details regarding Miniclip’s violations that led to its termination remain a secret to the public. If the FTC does not promptly learn about or investigate terminations by COPPA Safe Harbors, the agency may be unable to obtain civil penalties, due to the five-year statute of limitations.

1 Miniclip The Ultimate Games Brand: About, MINICLIP, https://corporate.miniclip.com/about/ (last visited May 15, 2020).

2 Surveillance and data collection on American children raise concerns that go beyond privacy. According to a State Department official, there are critical national security issues with respect to technology companies affiliated with the Chinese government, such as Huawei, ZTE, Alibaba, Baidu, and Tencent. Dr. Christopher Ashley Ford, Assistant Secretary, U.S. Department of State Bureau of International Security and Nonproliferation, Remarks at the Multilateral Action on Sensitive Technologies (MAST) Conference at the Loy Henderson Auditorium in Washington, D.C., Huawei and Its Siblings, the Chinese Tech Giants: National Security and Foreign Policy Implications (Sept. 11, 2019), https://www.state.gov/huawei-and-its-siblings-the-chinese-tech-giants-national- security-and-foreign-policyimplications/.

3 The Children’s Advertising Review Unit (CARU), BETTER BUSINESS BUREAU NATIONAL PROGRAMS., https://bbbprograms.org/programs/all-programs/caru/CARU-COPPA-safe-harbor (last visited May 15, 2020). 4Rohit Chopra, Commissioner, Fed. Trade Commu, Remarks at the Common Sense Media Truth About Tech Conference at Georgetown University (Apr. 4, 2019), https://www.ftc.gov/public-statements/2019/04/preparedremarks-commissioner-rohit-chopra-common-sense-media-truth-about. MINICLIP S.A. 647 Analysis to Aid Public Comment While I support this action, the Miniclip matter reinforces my concerns about the COPPA Safe Harbor programs. The Commission must take many steps to revamp its approach to these third- party privacy policing programs, such as:

• Subjecting the COPPA Safe Harbors to routine reviews and Commission votes to maintain accreditation, rather than the current “lifetime approval” approach • Disclosing COPPA Safe Harbor performance data to the public, including complaints handled and disciplinary actions taken • Limiting conflicts of interest by COPPA Safe Harbors by restricting additional fee-based consulting offered by affiliates of the Safe Harbor to participating websites and apps • Seeking the prompt submission to the FTC of all documentation regarding disciplinary actions • Terminating Safe Harbor programs that do not adequately fulfill their oversight requirements Beefing up oversight of the COPPA Safe Harbor program is just one of many actions the Commission must take to strengthen our approach to protecting children’s privacy. The Commission should also issue orders under Section 6(b) of the FTC Act to further study how companies are collecting, sharing, and monetizing data on children, as we look to modernize our rules and enforcement strategy to root out children’s privacy violations. ANALYSIS OF CONSENT ORDER TO AID PUBLIC COMMENT The Federal Trade Commission (“Commission”) has accepted, subject to final approval, an agreement containing a consent order from Miniclip S.A. (“Respondent”). The proposed consent order (“proposed order”) has been placed on the public record for thirty (30) days for receipt of comments from interested persons. Comments received during this period will become part of the public record. After thirty (30) days, the Commission will again review the agreement and the comments received, and will decide whether it should withdraw from the agreement and take appropriate action or make final the agreement’s proposed order. Respondent develops, publishes, and distributes mobile and online digital games. As of August 2019, Respondent had approximately 100 applications (“apps”) available for download through Apple’s App Store and Google Play. Consumers can also play online games via Respondent’s website, www.miniclip.com, and through Facebook. VOLUME 169 Analysis to Aid Public Comment This matter concerns alleged false or misleading representations that Respondent made concerning its status in a Children’s Online Privacy Protection Act of 1998 (“COPPA”) safe harbor program. Congress enacted COPPA to protect the safety and privacy of children online by prohibiting the unauthorized or unnecessary collection of children’s personal information online by operators of Internet Web sites and online services. COPPA directed the Commission to promulgate a rule implementing COPPA. The Commission promulgated the COPPA Rule on November 3, 1999, and the COPPA Rule went into effect on April 21, 2000. The Commission promulgated revisions to the Rule that went into effect on July 1, 2013. COPPA includes a provision enabling industry groups or others to submit for Commission approval self-regulatory safe harbor programs that implement the protections of the Commission’s final Rule. In 2001, the Commission approved the Children’s Advertising Review Unit (“CARU”) as a COPPA safe harbor program. In July 2009, Respondent joined CARU’s COPPA safe harbor program. Thereafter, Respondent began disseminating statements regarding its participation in CARU’s COPPA safe harbor program. Respondent remained a member of CARU’s COPPA Safe Harbor Program until July 6, 2015, when CARU terminated Respondent’s participation in the program. After CARU terminated Respondent from its safe harbor program, Respondent continued to make claims that it participated in the program.

The Commission’s proposed one-count complaint alleges that Respondent violated Section 5(a) of the Federal Trade Commission Act. Specifically, the proposed complaint alleges that Respondent engaged in a deceptive act or practice by falsely representing that it was a current participant in the CARU COPPA safe harbor program when it was not. Part I of the proposed order prohibits Respondent from making misrepresentations about its membership in any privacy or security program sponsored by the government or any other selfregulatory or standard-setting organization, including, but not limited to, the CARU COPPA safe harbor.

Parts II through V of the proposed order are reporting and compliance provisions. Part II requires acknowledgement of the order and dissemination of the order now and in the future to persons with responsibilities relating to the subject matter of the order. Part III ensures notification to the FTC of changes in corporate status and mandates that the company submit an initial compliance report to the FTC. Part IV requires the company to create certain documents relating to its compliance with the order for ten (10) years and to retain those documents for a five-year period. Part V mandates that the company make available to the FTC information or subsequent compliance reports, as requested. Part VI is a provision “sun-setting” the order after twenty (20) years, with certain exceptions.

The purpose of this analysis is to aid public comment on the proposed order. It is not intended to constitute an official interpretation of the complaint or proposed order, or to modify in any way the proposed order’s terms.

INTERLOCUTORY, MODIFYING, VACATING, AND MISCELLANEOUS ORDERS ____________________