WW International Inc. — the company formerly known as Weight Watchers — and its subsidiary Kurbo Inc. agreed to pay $1.5 million and to delete data collected in violation of the Children's Online Privacy Protection Act to settle findings that Kurbo's weight and health management app for children collected personal information from users under 13 without obtaining verifiable parental consent as the law requires, routed children through a consent flow that regulators found was inadequate to prevent underage users from entering false age information, and retained the health and behavioral data of those children for purposes that went beyond what any consent could have authorized.DOCUMENTED
COPPA imposes specific requirements on operators of websites and apps that are directed to children under 13 or that the operator knows are being used by children under 13. Among the most fundamental requirements is that the operator obtain verifiable parental consent before collecting any personal information from a child — a consent that must be meaningful, not merely a checkbox or age-gate that a child can bypass by entering a false date of birth. When an app collects health data — including food intake, physical activity, height, weight, and health goals — from children without this consent, it violates COPPA in a category that regulators treat as particularly serious given the sensitivity of children's health information.REVIEWED
- Kurbo collected health and behavioral data including food intake logs, weight, and activity information from users who disclosed they were under 13
- The age verification system could be bypassed by entering a false birthdate — no mechanism existed to verify the age users reported
- Parental consent was not collected before health data from users under 13 was stored and used
- Data from underage users was used to improve the app's algorithms and in some cases shared with third-party service providers
- $1.5 million civil penalty and required deletion of all personal information collected from users under 13 without COPPA-compliant consent
The Age Gate and Its Failure
Kurbo's enrollment flow asked users to enter their birthdate at the start of the signup process. If the entered birthdate indicated the user was under 13, the flow was supposed to route them to a parental consent process. However, the age gate did not prevent a child who entered a false birthdate — stating they were over 13 when they were not — from proceeding through the standard adult enrollment flow and completing signup without any parental consent being obtained. Regulators found that a substantial number of users who had self-identified as under 13 in other parts of the app experience, or who had ages below 13 derivable from data they had provided, had enrolled through the adult flow using a birthdate inconsistent with other user-provided information.DOCUMENTED
COPPA does not require that app operators catch every possible instance of underage use — it requires that operators use reasonable means to verify age and to obtain parental consent when they know or have reason to know a user is under 13. Regulators found that Kurbo had reason to know that a meaningful portion of its users were under 13 — given the app's marketing positioning as a weight management tool for children and families, the health data collected indicating developmental-stage physical characteristics, and the direct disclosures by some users of their actual ages in app interactions — and had not implemented verification mechanisms adequate to the risk.DOCUMENTED
Health Data and Children
Kurbo collected detailed health and behavioral data from its users: food intake logs that captured everything the child ate and drank each day, physical activity records, height and weight measurements, and goal-setting information about weight management targets. This data is among the most sensitive categories of information about a child — it captures not only the child's physical health status but their behavioral patterns, their relationship with food, and potentially their health struggles or family health circumstances. Collecting this data from children without parental consent bypassed the parental oversight function that COPPA is designed to protect.REVIEWED
The settlement's data deletion requirement — covering all personal information collected from users under 13 without COPPA-compliant consent — addresses the ongoing harm from the unlawful collection by eliminating the data that should not have been collected. Deletion remedies in children's privacy cases are designed to ensure that companies do not retain the benefit of the unlawful collection after the enforcement action is resolved — a consideration that is particularly important when the retained data includes sensitive health information about children.DOCUMENTED
Kurbo collected detailed food intake and weight management data from children who disclosed their ages as under 13, retaining that health data for app improvement purposes — without ever obtaining the parental consent that federal law requires before any data collection from a child can occur.
COPPA and Children's Health Apps
The Kurbo case is part of a pattern of enforcement against operators of children's apps and websites that collect sensitive personal information — including health data — without COPPA-compliant parental consent. Children's health and fitness apps represent a category of particular concern because the data they collect is both sensitive and persistent, can reveal developmental health conditions or family circumstances, and may be used in ways that affect the child's experience of their own body and health at a formative stage of development. Developers of apps that are directed to or likely to be used by children under 13 — including apps focused on health, fitness, diet, or physical activity — must implement verifiable parental consent mechanisms before any data collection occurs.REVIEWED
Parents who used the Kurbo app for their children should be aware that WW International is required to delete personal data collected from users under 13 during the violation period. Parents who have concerns about children's health apps more broadly can consult the resources published by the children's privacy advocacy community, which maintains guides on how to evaluate apps' privacy practices before allowing children to use them. Federal enforcement of COPPA is handled at the federal level, but many states also have children's privacy laws that may provide additional protections and enforcement mechanisms for violations that affect children in those states.DOCUMENTED
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.