Earlier this month, the FTC approved a settlement with a developer of popular apps for purported violations of the Children’s Online Privacy Protection Act (COPPA). The Commissioners voted 4-1 to authorize the Department of Justice to file the complaint and the stipulated final order resolving the matter. Under the stipulated final order, the company was ordered to pay a $4 million civil penalty (although all but $150,000 of it was suspended for inability to pay). The lone dissent came from Commissioner Noah Phillips who issued a dissenting statement criticizing the “recent push to heighten financial penalties . . . without clear direction other than to maximize the amount in every case.”
Commissioner Phillips made the case, as he has before, that harm should be the starting point when fashioning a penalty. Steeped in economic theory, he argued that “basing penalties on harm forces defendants to internalize the costs their behavior imposes on others, orienting conduct in a socially beneficial fashion.” Chairman Simons also issued a statement, contending that starting with harm is “inapposite” when Congress explicitly prohibits practices and directs the agency to impose penalties.
The allegations against HyperBeard are straightforward. According to the FTC, because many of HyperBeard’s apps are directed to children, it should not have collected persistent identifiers of the apps’ users (used for targeted advertising) without first providing notice of the company’s information practices and obtaining parental consent. Finding the $4 million penalty disproportionate to the harm, Commissioner Phillips compared the collection, use, and disclosure of non-sensitive personal information, such as persistent identifiers, to the disclosure of children’s personal information which would allow them to be contacted, and provided a helpful analogy:
It is illegal to speed and illegal to steal. But we don’t penalize those two the same way, nor do we ignore the difference between driving 76 miles per hour and driving 103; or between stealing $100 and $100 million. To do so would be perverse, both from the perspective of justice and social consequences.
Chairman Simons drew a line between statutes seeking to balance competing costs and benefits and statutes where civil penalties are specifically proscribed in order to deter future misconduct. In other words, deterrence should be the starting point. Chairman Simons laid out the following standard:
I believe that the goal of the civil penalty should be to make compliance more attractive than violation. Said another way, violation should not be more profitable than compliance.
In the case at hand, the FTC attempted to estimate the revenue from the “illegal” behavioral advertising. It then considered the following statutory factors in deciding whether to adjust the penalty amount upwards or downwards: HyperBeard’s degree of culpability, history of prior related conduct, prior law enforcement actions, timeliness of corrective action, ability to pay, willfulness, and threat posed to consumers; the effect on Hyperbeard’s ability to continue to do business; and “such other matters as justice may require,” such as, cooperation with the FTC’s investigation, past approaches to similar violations, and expectations of businesses and consumers.
As Chairman Simons concluded, “[c]ivil penalties will be an ongoing discussion here at the FTC.” With millions—if not hundreds of millions—of dollars riding on it, we certainly hope so.