Targeted Game Ads Settlement: Disney, Viacom, and Kids’ Privacy

The targeted game ads settlement is a group of three related class actions, filed in 2017 and approved in April 2021, that accused Disney, ViacomCBS, the Danish makers of Subway Surfers, and a set of advertising technology companies of secretly tracking children through mobile games to serve them behavioral ads. The final deal required the companies to stop the practice and change how their apps handle kids’ data, but it paid nothing to class members.¹

What the Lawsuits Alleged

The three complaints were filed in August 2017 in the U.S. District Court for the Northern District of California: McDonald v. Kiloo A/S, Rushing v. The Walt Disney Company, and Rushing v. ViacomCBS Inc.¹ Parents brought them on behalf of their children.

The central allegation was that popular kids’ games shipped with embedded tracking software known as software development kits, or SDKs, supplied by ad-tech companies. According to the complaints, those SDKs quietly pulled data from children’s devices, including Android Advertising IDs and device fingerprinting details like language, time zone, and mobile network. That information was then allegedly used to build profiles of individual children, follow them across apps and devices, and target them with ads and in-app purchase prompts.²

The legal theories included violations of the federal Children’s Online Privacy Protection Act (COPPA), which requires verifiable parental consent before collecting personal information from children under 13, along with claims under California’s constitutional right to privacy and Unfair Competition Law, New York’s General Business Law, Massachusetts privacy law, and the common law tort of intrusion upon seclusion.³¹

Who Was Sued and Which Games Were Involved

Fifteen defendants were named across the three cases, split between the app publishers and the ad-tech firms whose SDKs sat inside their games.

The Kiloo action targeted Danish developers Kiloo A/S and Sybo ApS, the studios behind the endless-runner hit Subway Surfers. The SDK providers named alongside them were AdColony, Chartboost, Flurry, InMobi, ironSource, Tapjoy, and Vungle.¹

The Disney case named The Walt Disney Company, Disney Enterprises, and Disney Electronic Content, with apps including Disney Princess Palace Pets. The SDK defendants there were Upsight, Unity Technologies SF, Comscore (and its subsidiary Full Circle Studies), and Twitter through its MoPub ad platform.¹

The Viacom case pulled in ViacomCBS and Viacom International, again with Upsight and Unity as SDK providers. The games came from some of the biggest children’s franchises on television:

PAW Patrol: Pups to the Rescue, Rescue Run, and Air and Sea Adventures
SpongeBob SquarePants: Bubble Party
Teenage Mutant Ninja Turtles: Portal Power and Brothers Unite
Dora the Explorer “Appisode” games: Perrito’s Big Surprise, Check-Up Day, and Catch That Shape Train
Bubble Guppies: A Grumpfish Tale
Game Shakers: Ballarina
Llama Spit Spit

Court filings showed the Upsight SDK ran in nearly all of these apps, with Unity’s SDK appearing in several.⁴

What the Settlements Required

The parties reached agreements between February and April 2020, and Judge James Donato granted final approval on April 12, 2021.¹⁵ The relief was entirely injunctive. That means the defendants agreed to change how they operate rather than pay damages.

The companies had to remove or disable tracking software that had been used to serve targeted ads to children under 13. They also agreed to stop using personal data collected during a child’s app session to target that child in later sessions, whether in the same app, in other apps, or elsewhere online. The app developers committed to putting education and screening processes in place for child-directed content.²

Two defendants took on more specific obligations. Comscore agreed to maintain a database of child-directed apps to keep children’s data out of its systems and not to use its technology for behavioral advertising modeling involving anyone under 18.² Kiloo had to add an age-gate to Subway Surfers, limit data collection from users identified as under 13, and delete or stop using data previously collected from users under 13, from users of older app versions, and from anyone who had entered a birth year of 2000 in earlier age-gates. Kiloo was required to certify compliance within 120 days.⁶

The injunctive relief lasts three years from the date the court entered its order. None of the defendants admitted wrongdoing.⁶²

Did Parents Get Any Money

No. There was no settlement fund, no claim form, and no payments to class members. Because the relief consisted of changes to the companies’ data practices, class members received the benefit automatically and did not need to file anything.¹ If you’re arriving at this settlement looking for a payout, there isn’t one to claim.

How This Case Fits Into the Wider Push on Kids’ App Privacy

The Disney, Viacom, and Kiloo settlements sit inside a longer run of enforcement and litigation aimed at the same pattern: children’s games that embed third-party ad SDKs, and SDKs that collect data COPPA was written to protect.

In June 2024, the California Attorney General and the Los Angeles City Attorney announced a $500,000 settlement with Tilting Point Media over its SpongeBob: Krusty Cook-Off app. Investigators found the app used a non-neutral age screen that defaulted to a birth year of 1953, discouraging children from entering their real ages, and that misconfigured third-party SDKs allowed children’s data to be processed for advertising without parental consent.⁷

In September 2025, the FTC settled with Chinese toymaker Apitor Technology over allegations that its companion app used an SDK that collected geolocation data from children without parental consent — reinforcing the agency’s position that developers are on the hook for what the third-party SDKs inside their apps do.⁸ And in January 2026, an $8.25 million settlement was reported in A.B. v. Google LLC, a class action accusing Google of illegally collecting children’s information through apps in its “Designed for Families Program” on Android and using it for targeted advertising.⁹

Together with the 2021 settlements, these cases show a clear direction: whoever puts a game in a child’s hands is responsible for the ad code running inside it.

1
Angeion Group. Notice of Class Action Settlement
2
MediaPost. Kids Advertising Game Changer: App Data Collection Settlements
3
Classaction.org. Rushing et al. v. The Walt Disney Company et al.
4
FKKSLaw.com. Rushing v. Viacom Class Action Complaint
5
PlainSite. McDonald v. Kiloo ApS Docket
6
Courthouse News Service. McDonald v. Kiloo Final Approval Order
7
California Attorney General. Attorney General Bonta, LA City Attorney Feldstein Soto Announce $500,000 Settlement
8
Federal Trade Commission. Using a Third Party’s Software in Your App? Make Sure You’re All Complying With COPPA
9
Silver Golub & Teitell LLP. Law360 Reports on $8 Million Settlement Agreement in Google Kids App Case