A $4 Million Fine for Cartoon Cat Apps Split Regulators' Own Commissioners

HyperBeard, Inc. built a lineup of brightly colored, animated mobile games with names like BunnyBuns, KleptoCats, and NomNoms, promoted using child-friendly language like “super cute” and “silly.” According to the Federal Trade Commission, the company knew children were using its apps — it even licensed the characters for children's books and plush toys — and allowed third-party ad networks to collect persistent identifiers from those same children to serve targeted advertising, all without notifying parents or obtaining verifiable consent.DOCUMENTED

The Commission approved a settlement in June 2020 requiring HyperBeard to pay a civil penalty and destroy the data it had collected, but the vote was not unanimous: Commissioner Noah Phillips dissented, arguing the $4 million penalty was disproportionate to the actual harm involved.DOCUMENTED

What the complaint alleges

According to the FTC's complaint, filed in the U.S. District Court for the Northern District of California, HyperBeard was aware that children were using its apps and had actively promoted them to child audiences, including through a kids' entertainment website and licensed merchandise like plush stuffed animals based on the apps' cartoon characters.DOCUMENTED Despite that knowledge, the complaint alleges HyperBeard failed to notify its third-party ad networks that the apps were child-directed and therefore subject to the Children's Online Privacy Protection Act, allowing those networks to collect persistent identifiers — device-level tracking codes used to serve interest-based advertising — from children under 13 without parental notice or consent.DOCUMENTED

The dissent over proportionate penalties

The settlement's approval was not unanimous. Commissioner Noah Phillips dissented, arguing the $4 million penalty was excessive relative to the actual consumer harm, writing that “HyperBeard app users (children, we presume) viewed advertisements based on the collection of persistent identifiers. Under the COPPA Rule, that is something but it is not everything.”DOCUMENTED Phillips argued the company had not shared sensitive personal information about children, publicized it, or exposed children to unauthorized contact from strangers or other forms of danger — factors he considered relevant to calibrating an appropriately sized penalty.DOCUMENTED

The competing view from the Chair

Then-Chairman Joe Simons responded to Phillips's dissent by emphasizing that while harm is an important factor to consider, the Commission's first priority in setting penalties is deterrence of the underlying practice, not solely calibrating punishment to demonstrated financial injury.DOCUMENTED That disagreement reflects a genuine, recurring tension in privacy enforcement broadly: targeted advertising built on tracking a child's behavior does not produce an easily quantifiable dollar loss the way a financial fraud scheme does, making it difficult to size a penalty purely by reference to measurable consumer harm, as opposed to the broader deterrent signal a larger penalty sends to the rest of the industry.

Terms of the settlement

Under the settlement, HyperBeard and its officers are barred from collecting, benefiting from, or using personal information from children under 13 without verifiable parental consent, and must destroy any such data already collected.DOCUMENTED The full civil penalty is set at $4 million, with a large portion suspended upon the defendants' payment of $150,000, reinstated in full if the defendants are later found to have misrepresented their financial condition.DOCUMENTED

One FTC commissioner argued the $4 million penalty was excessive for a company whose users “viewed advertisements based on the collection of persistent identifiers” and nothing more severe.

Why the case matters

The HyperBeard dissent remains a frequently cited touchstone in debates over how the FTC should size civil penalties in privacy cases where the underlying harm is difficult to quantify in dollar terms. For developers of child-directed apps, the case is a reminder that promoting an app to children through licensed merchandise or kids' entertainment platforms establishes exactly the kind of actual knowledge of a young audience that triggers COPPA's parental consent requirements — regardless of how the resulting penalty is ultimately calibrated once a violation is found.

Why persistent identifiers matter even without a name attached

Persistent identifiers — device-specific tracking codes that allow an advertiser to build a profile of a user's behavior over time without necessarily knowing that user's actual name — were added to COPPA's definition of “personal information” in a 2013 rule update specifically because regulators recognized that this kind of tracking, even without a directly identifying name attached, still enables the same targeted advertising harms the underlying statute was designed to prevent.REVIEWED The HyperBeard complaint's reliance on this specific category of data reflects how COPPA's protections have expanded well beyond the law's original 1998 conception of “personal information” as name, address, and similarly directly identifying details.

How the dissent shaped later penalty debates

Commissioner Phillips's dissent in the HyperBeard case became a frequently cited reference point in subsequent debates over COPPA penalty sizing, cited by industry commentators arguing that penalties should scale more closely with demonstrated financial harm to consumers, and by consumer advocates arguing the opposite — that deterrence, not harm calibration, should remain the primary consideration given how difficult privacy harms are to quantify in dollar terms.REVIEWED That underlying disagreement has continued to surface in nearly every major COPPA settlement the Commission has approved since, with each new case reopening the same fundamental question: how should regulators price a privacy violation whose harm is real but resistant to straightforward dollar-figure measurement.

Parents evaluating any app marketed with cartoon characters and child-friendly branding can reasonably ask whether that same branding extends to licensed merchandise or kids-focused platforms — the same signal of a young audience the FTC relied on in this case.

Have documents relevant to this story? Reach us through our tips channel.