We Heart It app didn’t have proper verification and consent measures in place
OLYMPIA — Attorney General Bob Ferguson announced today that California-based technology company Super Basic LLC and its parent company Maple Media LLC will pay $100,000 to resolve an investigation by the Attorney General’s Office. Ferguson’s investigation found the companies’ social media platform, “We Heart It,” allowed children to create accounts, collected their personal information and allowed third-party advertisers to collect data from them, all without legally required parental consent.
Under a legally enforceable consent decree filed today in Thurston County Superior Court, Super Basic and Maple Media will pay $100,000, with an additional $400,000 suspended contingent upon the companies’ compliance with the order.
We Heart It has approximately 500,000 monthly active users in the United States. We Heart It did not collect data on the geographic location or age of its users, so exact numbers of Washingtonians or minor users impacted is not available.
Under the federal Children's Online Privacy Protection Act (COPPA), platforms that are directed toward children may not collect personal information from them without first obtaining parental consent. Ferguson asserts that the companies’ conduct violated COPPA, and is also an unfair or deceptive business practice under the state Consumer Protection Act.
“Parents have the legal right to know who has their children’s personal information so they can protect them,” Ferguson said. “My office will continue to serve as a watchdog for Washingtonians’ online privacy rights.”
We Heart It is a social media platform on which users create profiles where they can upload and share images and other content. The platform has various pages or “channels” that users can follow, several of which appeal to children, including those dedicated to Disney, Harry Potter, DC Comics, Pokémon, and child celebrities or celebrities who appeal to children, such as Taylor Swift and Ariana Grande.
Users can interact by messaging each other or by liking each other’s content.
To create an account, users must provide an email address and user name, and are encouraged to upload a photo. Users can also provide other information, including a biography or their location.
In addition to the information it collects from its users’ profiles and their activity on the platform, We Heart It also allows third-party advertisers to collect data from its users.
When the Attorney General’s Office began its investigation, We Heart It permitted anyone, regardless of their age, to create an account without obtaining verifiable parental consent or providing proper notification of its data collection.
While many online platforms at a minimum use an age screen to verify that children under the age of 13 are not creating accounts on their platform, We Heart It did not.
User profiles on the platform were also public by default, and could be searched for and viewed by any other user. We Heart It also collected the metadata from user’s photos, which included geolocation data. COPPA requires verifiable parental consent and notification of data collection for users under the age of 13 for platforms that are directed at children.
As a result of the Attorney General’s Office investigation, We Heart It now requires users to confirm they are over 13 years old before creating an account and has changed the default profile and messaging settings to private. In addition, We Heart It no longer maintains user’s geolocation data.
In addition to the $100,000 payment and the $400,000 suspended payment, the consent decree requires Super Basic and Maple Media to:
- Utilize an age gate to prevent users under the age of 13 from creating We Heart It accounts
- Obtain verifiable parental consent before collecting personal information from children under the age of 13
- Provide direct notice to parents of We Heart It’s data collection and disclosure practices, as well as a clearly labeled link to online notice of its practices
In addition, Super Basic and Maple Media must expand their auditing of user accounts to better track and delete any accounts belonging to children, and submit a compliance report to the Attorney General’s Office within 15 months. Failure to comply with the terms subjects the companies to the $400,000 suspended payment.
The $100,000 will be used to cover the costs of the case and to fund future enforcement of high-tech consumer protection cases.
Assistant Attorney General Andrea Alegrett handled the case for Washington.
Consumers who have been affected by similar conduct, or any other deceptive business practices, are encouraged to file a complaint with the Attorney General’s Office at https://www.atg.wa.gov/file-complaint.
The Office of the Attorney General is the chief legal office for the state of Washington with attorneys and staff in 27 divisions across the state providing legal services to roughly 200 state agencies, boards and commissions. Visit www.atg.wa.gov to learn more.
Brionna Aho, Communications Director, (360) 753-2727; Brionna.firstname.lastname@example.org