Weight Management Companies Kurbo Inc. and WW International Inc. Agree to $1.5 Million Civil Penalty and Injunction for Alleged Violations of Children’s Privacy Laws

The Department of Justice, together with the Federal Trade Commission (FTC), announced today that the government entered into an agreement with Kurbo Inc. and its parent company, WW International Inc. (formerly Weight Watchers International Inc.) (collectively, “Defendants”) and will collect $1.5 million in civil penalties from defendants as part of a settlement to resolve allegations that they violated the Children’s Online Privacy Protection Act (COPPA) and Children’s Online Privacy Protection Rule (COPPA Rule) in connection with their weight management service for children, Kurbo by WW.

In a complaint filed in the U.S. District Court for the Northern District of California, the government alleged that defendants designed and marketed the Kurbo by WW mobile application and website for use by children as young as eight years old. The defendants also possessed actual knowledge that the application and website collected personal information from children, including their names, telephone numbers, email addresses and identifiers used to track their devices, as well as other sensitive information like height, weight, food intake and physical activity. The defendants nonetheless failed to notify parents that they were collecting children’s personal information and to obtain verifiable parental consent for that collection, as required by the COPPA Rule.

“Parents have a right to know and consent before companies collect their children’s personal information,” said Principal Deputy Assistant Attorney General Brian M. Boynton, head of the Justice Department’s Civil Division. “The department is committed to enforcing the protections against unauthorized collection of information from consumers, particularly children.”

“Weight Watchers and Kurbo marketed weight management services for use by children as young as eight and then illegally harvested their personal and sensitive health information,” said Chair Lina M. Khan of the FTC. “Our order against these companies requires them to delete their ill-gotten data, destroy any algorithms derived from it, and pay a penalty for their lawbreaking.”

The stipulated order entered requires the defendants to pay $1.5 million in civil penalties and bars them from collecting personal information from children in a manner that violates the COPPA Rule. It also prohibits them from using children’s personal information that was previously collected unless they obtain verifiable parental consent and subjects them to compliance reporting obligations.

This matter was handled by Trial Attorneys Rachael Doud and Zachary Cowan and Assistant Director Lisa Hsiao of the Civil Division’s Consumer Protection Branch. Danielle Estrada and David Walko represented the FTC.