Ever since the first 3-year-old became obsessed with whatever Tetris knockoff was on their cool aunt’s Blackberry, mobile software developers have seen the potential for real gold in kid-targeted games and apps. But two of the biggest names in children’s entertainment, Disney and Viacom, are each being accused of breaking child-specific privacy laws by allowing young users’ data to be collected and mined.

What’s the claim?

A plaintiff in California has filed two different lawsuits: one against Disney [PDF], and one against Viacom [PDF], parent company to kid-friendly entertainment giant Nickelodeon.

The suits claim that children under 13 who use the apps named in the complaints “have had their personally identifying information exfiltrated… for future commercial exploitation.”

The apps, the complaint claims, track children’s app usage and device behavior by obtaining “peristent identifiers.” That is to say, any time you use App X, the app will identify you and relay back your information under a unique number, like 7A51F9D56200.

That identifier is persistent across devices, so any software you are using can identify that you are you whether you’re on your work laptop using the Facebook version of a game, or whether you’re using your phone to play the mobile version on the bus home.

The use of unique, cross-platform, tracking identifiers in software is par for the course these days. But although there are no laws protecting most data adults generate, there is a strong privacy law directly pertaining to children under 13.

READ MORE: How much control do you actually have over your private data?

The Children’s Online Privacy Protection Rule, better known as COPPA, requires that any app, website, or service directed to children must disclose what data it is collecting, get parental approval to collect it, and must give parents the ability to opt-out of having their kids data shared.

The lawsuits claim that most users, including the parents of children using apps, “do not know that apps created for children are engineered to surreptitiously and unlawfully collect the child-users’ personal information,” which is then shared for “advertising and other commercial purposes.”

In short, the suits argue that creating a full, unique online tracking profile of child users, the way that also exists for adult users, is in violation of federal law.

The suits also name software companies that Disney and Viacom partner with to make and launch their apps, uncluding Kochava, Unity, and Upsight.

From Frozen to Paw Patrol

If you have any doubt that both companies are giants in children’s entertainment, just ask any four-year-old how many children in their preschool “played Elsa” or wore Paw Patrol T-shirts on any given day — you’ll never hear the end of it.

Disney itself has published more than 60 Android apps and over 100 for iOS. Some are park or channel companion apps, but most are games of some kind, targeted to Disney’s child audience.

The plaintiffs specifically point to 42 of Disney’s mobile apps, listed visually in a collection of exhibits [PDF] attached to the complaint. All of them are rated “E for everyone,” which according to the ESRB means they are “generally suitable for all ages.” The list of apps includes spin-offs from the popular Moana and Frozen films, as well as original apps like Where’s my Water?.

Viacom, meanwhile, is Nickelodeon’s parent company. So they own media properties like Paw Patrol, Dora the Explorer, SpongeBob SquarePants, and Dora the Explorer.

The list of exhibits attached to the Viacom suit [PDF] includes 11 apps. Several not only boast “E for everyone” ratings, but their Apple AppStore versions, the suit notes, specifically target them to young children. SpongeBob Bubble Party, for example, is rated for ages 4+, while Paw Patrol: Air + Sea Adventures is specifically described as “Made for ages 5 and under.”

All of those apps also, the suits claim, include developer kit code that collect, disclose, or use personal information and/or persistent identifiers, without ever telling parents or gaining their explicit consent. The full list of apps includes:

Disney:

• AvengersNet
• Beauty and the Beast: Perfect Match
• Cars: Lightning League
• Club Penguin Island
• Color by Disney
• Disney Build It: Frozen
• Disney Color and Play
• Disney Crossy Road
• Disney Dream Treats
• Disney Emoji Blitz
• Disney Gif
• Disney Jigsaw Puzzle
• Disney LOL
• Disney Princess: Story Theater
• Disney Store Become
• Disney Story Central
• Disney’s Magic Timer by Oral-B
• Dodo Pop
• DuckTales: Remastered
• Frozen Free Fall
• Frozen Free Fall: Icy Shot
• The Good Dinosaur: Storybook Deluxe
• Inside Out Thought Bubbles
• The Lion Guard
• Maleficent Free Fall
• Miles from Tomorrowland: Missions
• Moana: Island Life
• Olaf’s Adventures
• Palace Pets in Whisker Haven
• Princess: Charmed Adventures
• Sofia the First: Color and Play
• Sofia the First: The Secret Library
• Star Wars: Commander
• Star Wars: Puzzle Droids
• Temple Run: Brave
• Temple Run: Oz
• Toy Story: Story Theater
• Where’s My Mickey? (Free)
• Where’s My Water?
• Where’s My Water? (Free) / Where’s My Water? (Lite)
• Where’s My Water? 2
• Zootopia Crime Files

Viacom:

• Ballarina
• Bubble Guppies: A Grumpfish Tale
• Dora Appisode: Catch That Shape Train
• Dora Appisode: Check-Up Day!
• Dora Appisode: Perrito’s Big Surprise
• Paw Patrol: Air + Sea Adventures
• Paw Patrol: Pups to the Rescue
• Paw Patrol: Rescue Run
• SpongeBob Bubble Party
• Teenage Mutant Ninja Turtles: Portal Power
• Teenage Mutant Ninja Turtles: Brothers Unite

What Next?

From here, the rest, of course, will take time, as lawsuits and court cases ever do.

Although the lawsuits were filed by a single plaintiff in California, both seek class-action status, on behalf of the plaintiff’s child and any other children who use the apps in question.

The “game tracking apps” are intentionally designed “to surreptitiously obtain, improperly gain knowledge of, review, and or/retain” data from their users which, the complaints claim, is “highly offensive to a reasonable person.”

As a result, the suit asks the following.

• That the court find the defendants — Disney, Viacom, and the software companies building the apps — in violation of COPPA
• That the defendants immediately stop and be permanently barred from collecting childrens’ data this way
• That the companies destroy any data they already collected unlawfully
• That the court determine both statutory damages (i.e. delineated fines for breaking the law) and punitive damages

Disney, of course, has said it sees no merit in the claims.

“Disney has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families,” the company said in a statement. “The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in Court.”

A representative from Viacom tells Consumerist, “Viacom takes its COPPA compliance very seriously, and we are deeply committed to protecting children’s privacy. We believe the claims are without merit, and we intend to vigorously defend against this action.”

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.