New Mexico ex rel. Balderas v. Tiny Lab Prods.

• Decision Date: 29 April 2020
• Docket Number: No. 18-854 MV/JFR,18-854 MV/JFR
• Citation: 457 F.Supp.3d 1103
• Parties: State of NEW MEXICO EX REL. Hector BALDERAS, Attorney General, Plaintiff, v. TINY LAB PRODUCTIONS; Twitter Inc.; MoPub, Inc. ; Google, Inc.; AdMob, Inc.; AerServ LLC; InMobi PTE Ltd.; Applovin Corporation; and ironSource USA, Inc., Defendants.
• Court: U.S. District Court — District of New Mexico

457 F.Supp.3d 1103

State of NEW MEXICO EX REL. Hector BALDERAS, Attorney General, Plaintiff,

v.TINY LAB PRODUCTIONS; Twitter Inc.; MoPub, Inc. ; Google, Inc.; AdMob, Inc.; AerServ LLC; InMobi PTE Ltd.; Applovin Corporation; and ironSource USA, Inc., Defendants.

No. 18-854 MV/JFR

United States District Court, D. New Mexico.

Signed April 29, 2020

Brian E. McMath, Cholla Khoury, New Mexico Office of the Attorney General, Santa Fe, NM, David F. Slade, James Allen Carney, Joseph H. Bates, Carney Bates & Pulliam, PLLC, Little Rock, AK, Michael Sobol, Pro Hac Vice, Lieff Cabraser Heimann & Bernstein, LLP, San Francisco, CA, Nicholas Diamand, Pro Hac Vice, Lieff Cabraser Heimann & Bernstein, LLP, New York, NY, for Plaintiff.

Anthony Weibell, Pro Hac Vice, Wilson Sonsini Goodrich & Rosati, PC, Palo Alto, CA, Richard L. Alvidrez, Miller Stratvert PA, Albuquerque, NM, for Defendants.

Tiny Lab Productions, pro se.

MEMORANDUM OPINION AND ORDER

MARTHA VÁZQUEZ, United States District Judge

THIS MATTER comes before the Court on the SDK Defendants’¹ Motion to Dismiss the Complaint for Failure to State a Claim ("SDK Defendants’ Motion") [Doc. 47] and Defendant Google's² Motion to Dismiss ("Google's Motion") [Doc. 50]. The Court, having considered the motions and relevant law, finds that the SDK Defendants’ Motion is well-taken and will be granted, and that Google's Motion is well-taken in part and will be granted in part and denied in part.

BACKGROUND

I. Introduction

Though catchy television commercial jingles may no longer be ubiquitous in contemporary society, advertising is still alive and well in this computer age. In exchange for free access to "apps" on our many mobile devices, we are often required to (im)patiently view ads that pop up before, after, or while we play, watch, or otherwise enjoy those apps. Those ads often seem tailor-made to match our interests. That is no accident. There are companies – matchmakers of the digital age – that design computer programs to match app users with the ads most suited to them.

This is how it works, in a nutshell. Ad exchanges, or "networks," sell coding known as software development kits, or "SDKs," to app developers to embed into their apps. When an app is in use, data signals from the SDKs collect information about the app users. Based on that information, the networks’ sophisticated algorithms allow the instantaneous, automated buying and selling of advertisements, and the instantaneous, automated service of those advertisements back to the app users. In this way, the ad networks provide "monetization platforms" that mediate between app developers and third-party advertisers, maximizing the effectiveness of mobile app advertising and the resulting revenue that an app developer can earn from selling advertising space on its free apps.

Sometimes, and perhaps more often than some parents would like, app users are children, just as susceptible (if not more so) to targeted advertising than adult app users. As a general rule, a federal statute known as the Children's Online Privacy Protection Act ("COPPA") prohibits app developers and ad networks from collecting certain personal information from app users who are children without first taking certain precautions. This opinion addresses what appears to be an issue of first impression, namely, under what circumstances ad networks may be held liable under COPPA for their collection of personal information from app users who are children, in addition to how issues of preemption and state law come into play.

II. The Facts

Tiny Lab Productions ("Tiny Lab"), a Lithuanian company, is a developer of child-directed, mobile game apps including Fun Kid Racing, Candy Land Racing, Baby Toilet Race: Cleanup Fun, and GummyBear and Friends Speed Racing. Doc. 1 ¶ 3. Tiny Labs apps are "fun, free, kid-focused games" that have a "cartoonish design and subject matter," and Tiny Lab represents that the "children love" their games, that the "levels are designed specifically for children," that the games are "for kids," and will keep them "entertained for months," and that the "games are expressly to be played by [ ] children." Id. ¶¶ 100, 30-31.

During the relevant time period, Tiny Lab's apps were available for download in the Google Play Store, operated by Google. Id. ¶ 12. "[T]he majority of Tiny Lab's Gaming Apps were submitted to Google as family friendly, child-directed and appropriate for inclusion in Google's Designed for Family section on Google Play." Id. ¶ 109.

Google/AdMob, Twitter/MoPub, InMobi/AerServ, Applovin, and ironSource (collectively, the "Ad Networks") sold their proprietary SDKs to Tiny Lab for installation and use in its gaming apps. Id. ¶ 13. When a Tiny Lab app is downloaded onto a child's device in New Mexico, the Ad Networks’ SDKs are also installed as app components. Id. ¶ 5. Once so embedded, while a child in New Mexico plays one of the apps, the Ad Networks’ SDK collects personal information about that child and tracks the child's online behavior to profile the child for targeted advertising. Id. ¶¶ 43-46. This activity is invisible to the child and her parents, who simply see the given app's game interface, and occurs "without (1) reasonable and meaningful notice to parents, or (2) verifiable parental consent." Id. ¶¶ 46, 55, 66, 74.

Specifically, as soon as a child in New Mexico opens up a Tiny Lab app on her device and it connects to the internet, the app connects to servers, including the Ad Networks’ servers. Id. ¶ 55. The embedded SDKs then begin sending data about the child to the Ad Networks’ respective servers. Id. As the child plays the app, the SDKs continue to communicate with the servers, sending requests, or "calls" for advertisements targeted to the child playing the app. Id. ¶ 56. With each request from the embedded software, the child's personal information, including her location in New Mexico, is transmitted to the Ad Networks’ servers. Id.

The Ad Networks take and analyze this data "for purposes of profiling the child and serving her age-based, behavioral advertising targeted to children." Id. ¶ 108. Advertisements served to users of the apps include those for "cartoonish games very similar in content and cartoonish presentation to the Tiny Lab Gaming Apps." Id. The Ad Networks further use the data they collect "to trigger events – both within the app and across the Internet – that will encourage [the child] to play the app more often and for longer periods." Id. ¶ 153.

The Ad Networks’ servers also store and analyze the child's information "to enable continued tracking of [that] child, such as what ads she has already seen, what actions she took in response to those ads, other online behavior, and additional demographic data." Id. ¶ 56. "This way, each [Advertising Network] (and other affiliated entities) can generally monitor, profile, and track her over time, across devices, and across the Internet." Id.

The data that the Ad Networks take from children's devices are called ‘persistent identifiers,’ " which are "a set of unique data points" that "can link one specific individual to all of the apps on her device and her activity on those apps." Id. ¶ 50. These persistent identifiers include "device fingerprint data," which in turn includes the name and developer of the app that the child is operating. Id. ¶¶ 51-53, 63, 71, 79, 86, 93. In addition, some of the Ad Networks, namely, Twitter/MoPub, Google/AdMob, and InMobi/AerServ, "can receive the GPS location of the child's device, with a street-level granular accuracy." Id. ¶¶ 61, 69, 77.

While "[v]iewed in isolation, a persistent identifier is merely a string of numbers uniquely identifying a child," when "linked to other data points about the same child such as app usage, geographic location (including likely domicile), and Internet navigation, it discloses a personal profile that can be exploited in a commercial context." Id. ¶ 123. The Ad Networks "aggregate this data, and also buy it from and sell it to other third-parties," and, linking it with the child's geolocation, create "an increasingly sophisticated profile of how, when, and why a child uses her mobile device." Id. ¶¶ 124-126.

The Ad Networks engage in these actions "despite widespread awareness that children are more vulnerable to deception by advertisers because they are easily influenced by its content, lack the cognitive skills to understand the intention of advertisers, and can struggle to distinguish between advertisements and other content." Id. ¶ 141. Further, "[p]arents are increasingly concerned about their children's mobile device usage," as increased usage is associated "with negative consequences for children," including "increasing rates of ADHD, depression, anxiety, and reduced focus in the classroom." Id. ¶ 158. Similarly, sources such as legislative enactments, scholarly literature, and comments by self-regulatory agencies manifest "society's deep revulsion" toward the sort of "collecting and accessing of personal information for tracking and profiling purposes" in which the Ad Networks engage. Id. ¶ 180.

III. The Instant Case

The State of New Mexico ("Plaintiff") commenced this action, asserting a federal statutory claim against Tiny Lab and the Ad Networks for violation of COPPA, along with a state statutory claim against Tiny Lab and the Ad Networks for violations of the New Mexico Unfair Practices Act ("UPA"), a state common law claim against Tiny Lab and the Ad Networks for intrusion on seclusion, and a state statutory claim against Google for an additional violation of the UPA in connection with its operation of Google Play. Id. ¶¶ 207-248.

Thereafter, all of the Ad Networks other than Google/AdMob (collectively, the "SDK Defendants") together filed one motion to dismiss, in which Google/AdMob joined. Additionally, Google filed its own motion to dismiss on behalf of Google as the operator of Google Play and Google/AdMob. The State objects to both motions.

STANDARD

Under Rule 12(b)(6), ...