$20 Million for Collecting Children's Data, Even After Being Told the Players Were Kids

Cognosphere, the developer behind popular mobile and online games with substantial youth audiences, collected personal data from child players without providing the notice to parents or obtaining the verifiable consent the Children's Online Privacy Protection Rule requires. According to the Federal Trade Commission, the company's violations were compounded by a specific failure: even after Cognosphere became aware that certain individual users were children, it did not take corrective action to stop collecting their data.DOCUMENTED

Cognosphere agreed in January 2025 to pay $20 million to settle the FTC's COPPA allegations.DOCUMENTED

What the complaint alleges

According to the FTC, Cognosphere's games collected personal data from users, including children under 13, without providing parents the notice COPPA requires about what information was being collected and how it would be used, and without obtaining the verifiable parental consent the rule mandates before that collection occurs.DOCUMENTED The complaint's allegation that the company failed to take corrective action after becoming aware specific users were children represents a distinct and more serious failure than an initial compliance gap alone: it suggests the company had actual, specific knowledge of underage users in at least some instances and did not adjust its data practices for those identified accounts even after that knowledge existed.REVIEWED

Why gaming platforms with in-game purchases draw particular scrutiny

Mobile and online games marketed to a mixed audience that includes children, particularly those built around collectible items, in-game currency, or randomized rewards, have drawn sustained regulatory attention beyond COPPA data-collection concerns alone, since these game mechanics can also raise separate questions about spending behavior among young players who may not fully grasp the real-money value of in-game purchases.REVIEWED While the FTC's complaint against Cognosphere centers specifically on data collection and parental consent rather than in-game spending practices, the broader category of games serving large youth audiences remains one where regulators have applied comparatively close and continuing scrutiny.

How the case fits the amended COPPA Rule's timeline

The FTC voted to approve significant updates to the COPPA Rule in January 2025, the same month it settled with Cognosphere, with those amendments imposing new obligations regarding the collection, use, and disclosure of children's personal information that took effect in stages through 2026.REVIEWED The Cognosphere settlement, arriving at the start of that broader regulatory transition, signaled the agency's continued enforcement of COPPA's existing requirements even as the updated rule's more expansive provisions were still being phased in for full compliance.

Terms of the settlement

Under the settlement, Cognosphere agreed to pay a $20 million civil penalty and to implement COPPA-compliant data collection practices going forward, including proper parental notice and verifiable consent mechanisms before collecting personal information from child users.DOCUMENTED The order also requires the company to correct its handling of any previously collected children's data consistent with COPPA's requirements.REVIEWED

Even after learning that specific users were children, the company did not adjust its data collection practices for those accounts, according to the FTC's complaint.

Why the case matters

For parents of children who play mobile or online games with substantial youth followings, the Cognosphere case is a reminder that COPPA's parental consent requirements apply regardless of a game's overall audience mix, and that a developer's actual, specific knowledge that individual users are children creates a heightened compliance obligation — one the FTC has shown it will treat as a distinct and more serious violation when a company fails to act on that knowledge once it exists.

Why the amended COPPA Rule raises the stakes further

The updated COPPA Rule that took effect in stages through 2025 and 2026 expanded companies' obligations regarding how children's data can be used, shared, and retained, and increased the maximum civil penalty per violation to more than $53,000 as of 2025. Game developers with any meaningful youth audience now face a considerably higher compliance bar, and a correspondingly higher potential penalty, than existed under the rule's prior 2013 version.

What parents can do to check a game's data practices

Parents of children who play mobile or online games can review the app's published privacy policy for any specific reference to COPPA compliance and parental consent mechanisms, and can use built-in parental control features on app store platforms to restrict data sharing for accounts they know belong to a child. Those steps do not replace a developer's legal obligation to seek consent directly, but they provide an additional layer of protection while enforcement of the amended rule continues to develop. Parents remain the first line of defense until enforcement of the amended rule fully catches up with the pace of new game releases.

Why civil penalties of this size are meant to change industry behavior

A $20 million penalty is calibrated not merely to compensate for the specific violation identified, but to make continued noncompliance more costly than the investment required to build proper parental consent systems in the first place. That deterrent calculation matters especially for gaming companies whose products may attract large youth audiences incidentally, without the company having initially designed the product specifically for children, since those companies may otherwise treat COPPA compliance as a lower priority than deliberately child-directed platforms. Games that draw large youth audiences, whether by design or by accident, now face the same expectations either way. The rule does not distinguish based on a developer's original marketing intent once children make up a meaningful share of actual users. That is the standard this settlement reinforces for every developer building a game with any meaningful reach among younger players.

Have documents relevant to this story? Reach us through our tips channel.