FTC orders company to remove algorithms created with data alleged to have been improperly obtained | Akin Gump Strauss Hauer & Feld LLP

[co-author: Michelle Rodriguez]

The Federal Trade Commission (FTC) has reached a settlement with weight loss company WW International (formerly known as Weight Watchers) requiring the company to pay a $1.5 million fine, delete personal information from children under 13 that may have been obtained unlawfully and delete any work products, including algorithms, derived from such data.1 The case marks the second time in two years that the FTC has ordered the destruction of an algorithm following alleged irregularities in a company’s data collection practices.

According to a complaint filed by the Department of Justice (DOJ) on behalf of the FTC, WW International allegedly unlawfully collected personal information about children without parental consent through Kurbo for WW, a health and wellness platform marketed to children as young as eight years old. Children’s personal information is protected nationally by the Children’s Online Privacy Protection Act and its regulations (together, COPPA).2 Companies that direct content to children under 13 must obtain parental consent before collecting users’ personal information. Although Kurbo informed users that children under 13 must register through a parent, Kurbo’s registration process allegedly encouraged children to circumvent parental consent by registering as if they were themselves. same parent or were at least 13 years old. Once registered, hundreds of children subsequently changed their ages to under 13, but Kurbo continued to collect their personal information without obtaining parental consent. The complaint further alleged that WW International violated COPPA’s data retention policies by retaining children’s personal information indefinitely unless a parent affirmatively requests that the child’s data be deleted. WW International has not admitted any wrongdoing in its regulation with the FTC.

The destruction of algorithms as an enforcement mechanism

Although the FTC has previously ordered fines and data suppression in regulations for improper data collection practices (such as the recent action against CafePress),3 Requiring the destruction of algorithms is a new approach that raises the compliance stakes by involving a company’s valuable intellectual property. The FTC first rolled out algorithm destruction as a penalty in a January 2021 settlement with EverAlbum. There, the company allegedly used users’ photos to develop facial recognition technology without users’ consent or knowledge.4 Since then, the FTC has expressed interest in using this penalty as an enforcement mechanism. In a month of August 2021 article for the Yale Journal of Law and TechnologyFTC Commissioner Rebecca Slaughter and her co-authors wrote:[t]The premise is simple: when companies collect data illegally, they should not be able to profit from the data or any algorithm developed from it. . . . This innovative approach to law enforcement should send a clear message to companies that engage in illicit data collection to train AI models: it’s not worth it. The FTC also announced its intention to explore developing rules that would address algorithmic damages in December 2021.5 These indications all suggest that the FTC will seek to use algorithm destruction as an enforcement tool in the future, making it all the more imperative for companies to assess and ensure compliance with applicable privacy laws. data collection and data privacy.

1 Press release, FTC takes action against company formerly known as Weight Watchers for illegally collecting sensitive health data from childrenFederal Trade Comm’n (March 3, 2022), available at https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-company-formerly-known-weight-watchers-illegally-collecting-kids-sensible.

2 15 USC §§ 6501–6506.

3 Press release, FTC takes action against CafePress for covering up data breachFederal Trade Comm’n (March 15, 2022), available at https://www.ftc.gov/news-events/news/press-releases/2022/03/ftc-takes-action-against-cafepress-data-breach-cover.

4 Press release, FTC finalizes settlement with photo app developer over misuse of facial recognition technologyFederal Trade Comm’n (March 7, 2021), available at https://www.ftc.gov/news-events/news/press-releases/2021/05/ftc-finalizes-settlement-photo-app-developer-related-misuse-facial-recognition-technology.

5 Statement of Regulatory Priorities, Federal Trade Comm’n (December 15, 2021), available at https://www.reginfo.gov/public/jsp/eAgenda/StaticContent/202110/Statement_3084_FTC.pdf.

Sharon D. Cole