9th Circuit Lets Kids’ State Privacy Claims Stand, Despite COPPA Overlap

A class of children and their parents sued Google, toy companies and content creators, claiming the platform used persistent identifiers to collect data and track online behavior “surreptitiously” and without consent in violation of children’s privacy laws. They sought damages and injunctive relief through state law claims in California, Colorado, Indiana, Massachusetts, New Jersey and Tennessee. The plaintiffs agreed all the claims would also violate COPPA’s requirement that child-directed online services give notice and obtain “verifiable parental consent” before collecting persistent identifiers. The YouTube channel owners include Mattel, Dreamworks, Hasbro, the Cartoon Network, PocketWatch, RTR Production and RFR Entertainment. Attorneys for the companies didn’t comment.

The plaintiffs submitted three amended complaints to the U.S. District Court for the Northern District of California. The district court rejected all three, saying COPPA preempts the plaintiffs’ core allegations. The court granted leave for the children to file an amended complaint and substitute plaintiffs in the 13-16 age range since COPPA applies only to children 12 and younger. Rather than amend, the children appealed.

The 9th Circuit concluded that preemption doesn’t bar the children’s claims, reversing the district court’s decision. The panel remanded the case so the district court can “consider in the first instance the alternative arguments for dismissal, to the extent those arguments were properly preserved.” Circuit Judge Margaret McKeown delivered the opinion on behalf of Judges Michael Daly Hawkins and Gabriel Sanchez.

The 9th Circuit asked the FTC for its view in the case. The agency filed an amicus brief agreeing neither express nor conflict preemption principles bar the children from pursuing state claims. Stand-alone causes of action under state law that involve conduct that also violates COPPA aren’t preempted, the FTC said: Congress didn’t “intend to wholly foreclose state protection of children’s online privacy, and the panel properly rejected an interpretation of COPPA that would achieve that outcome.” The FTC said the panel properly rejected “Google’s interpretation, which would have the extreme effect of providing immunity from a wide swath of traditional state law claims that were never discussed in COPPA’s legislative history, much less swept aside altogether.”