OpenX Technologies operates an ad exchange running a real-time bidding platform that sells advertising space on participating websites and mobile apps. According to the Federal Trade Commission, the company's own internal review process identified hundreds of apps as “for toddlers,” “for kids,” “kids games,” or “preschool learning,” complete with age ratings indicating they were directed at children under 13 — and sold targeted advertising against those same apps anyway, without the protections federal children's privacy law requires.DOCUMENTED
OpenX agreed to a settlement including a $2 million civil penalty, resolving allegations that it violated the Children's Online Privacy Protection Act by failing to flag child-directed apps in its own advertising system.DOCUMENTED
- OpenX operates a real-time bidding ad exchange that sells advertising inventory across participating websites and mobile apps.
- The FTC alleges OpenX actively reviewed and identified hundreds of apps as child-directed, using labels such as "for toddlers" and "kids games."
- Despite those internal classifications, OpenX did not flag the apps or their associated data as child-directed under COPPA.
- As a result, child users of these apps were targeted with behavioral advertising, according to the complaint.
- The settlement includes a $2 million civil penalty.
- OpenX is required to delete all ad request data collected to serve targeted ads to users of the identified child-directed apps.
What the complaint alleges
According to the FTC, OpenX did not merely fail to notice that certain apps in its exchange were directed at children — the complaint alleges the company actively reviewed and classified hundreds of specific apps using labels that explicitly identified them as directed at young children, complete with age ratings under 13.DOCUMENTED Despite generating that internal classification, OpenX did not exclude the flagged apps from participating in behavioral advertising or otherwise treat the associated data as subject to COPPA's parental consent requirements, according to the complaint.DOCUMENTED
Why an ad exchange's role differs from an app developer's
Most COPPA enforcement targets the developer of a child-directed app directly, since that developer typically has the most direct relationship with the app's young users and controls what data the app itself collects. The OpenX case took a different approach, targeting the ad exchange sitting between many different app developers and the advertisers ultimately buying targeted placements — a position from which OpenX had visibility across a large number of child-directed apps simultaneously, and, according to the complaint, its own internal classification system to prove it knew which ones qualified.REVIEWED That combination of scale and demonstrated internal knowledge made OpenX's alleged conduct distinct from a case built on an individual app developer's failure to recognize its own young audience.
How real-time bidding complicates COPPA compliance
Real-time bidding systems are designed to process enormous volumes of ad placement decisions in fractions of a second, matching advertisers with available inventory based on data signals about the viewer and the app or website involved.REVIEWED That automated speed and scale creates a specific compliance challenge: an exchange operator that has already invested in classifying content by audience, as OpenX allegedly had, bears a particular responsibility to actually apply those classifications to restrict behavioral advertising against children, rather than maintaining the classification system for other purposes while continuing ordinary ad-targeting operations against the very apps it had already identified as child-directed.
Terms of the settlement
Under the settlement, OpenX must pay a $2 million civil penalty and is required to delete all ad request data it collected in order to serve targeted ads to users of the apps it had identified as child-directed.DOCUMENTED The order also requires OpenX to implement a comprehensive privacy program going forward specifically designed to ensure compliance with COPPA across its advertising exchange operations.DOCUMENTED
The company's own internal classification system had already labeled hundreds of apps as directed at toddlers and preschoolers — the FTC alleges it simply did not act on that knowledge.
Why the case matters
For advertising technology companies operating anywhere in the chain between app developers and advertisers, the OpenX case establishes that COPPA compliance obligations extend to intermediaries with independent knowledge that specific content is child-directed, not solely to the app developer with the most direct consumer relationship. A company that builds its own internal system for classifying content by audience, as OpenX had, cannot treat that classification as separate from its underlying legal obligations under children's privacy law.
Why this case set a precedent beyond a single ad exchange
Prior COPPA enforcement had focused overwhelmingly on the developers of child-directed apps and websites themselves, leaving the broader advertising technology ecosystem — exchanges, supply-side platforms, and demand-side platforms that never directly interact with a child user — in a comparatively untested legal position regarding their own independent compliance obligations.REVIEWED The OpenX settlement signaled that an ad exchange with demonstrated internal knowledge of which apps in its network are child-directed cannot rely on the app developer's own compliance obligations as a substitute for its own, a precedent with implications for every other intermediary operating in the real-time bidding ecosystem.
What app developers should take from a case about an ad exchange
Although OpenX, not any individual app developer, was the named defendant in this case, the underlying facts still carry a lesson for developers: if an ad exchange's own internal classification system identified an app as child-directed, that same app's developer likely had, at minimum, comparable knowledge of its own audience, meaning any developer relying on a third-party ad network's silence as evidence that COPPA did not apply to their app was operating on a mistaken assumption the OpenX case helps clarify.REVIEWED Silence from an ad partner is not the same thing as compliance, on either side of that advertising relationship.
The broader lesson extends past this one exchange: any company sitting between a child-directed app and the advertisers targeting its users bears its own independent compliance obligation, regardless of how many other parties sit in that same chain.
That obligation does not disappear simply because an exchange sits several steps removed from the child using the app in the first place.
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.