United States v. Yelp, Inc.

Yelp, Inc. (defendant) operated a website that allowed users to provide reviews for local businesses and to connect with other people online and at local events. Yelp required all users to identify their birthdate to register for an account. Using this information, Yelp’s website would not allow users under the age of 13 to register for accounts. Yelp mistakenly believed that its mobile application did the same thing. However, for at least four years, Yelp’s mobile application accepted registrations from users of any age, including children under the age of 13. During this four-year period, Yelp hired a third party to conduct a privacy review of its mobile application. However, the third party missed the registration-age problem, and Yelp did not do any further checks. Once a user was registered, the user could use any Yelp platform without further age checks. Yelp collected the names, email addresses, birthdates, zip codes, and gender of all registered users. In addition, all Yelp users could disclose personal data including photos, current city, and their current location. Yelp gave accounts to several thousand users who had input birthdates indicating that the users were between 9 and 13 years old, but Yelp did not give these users’ parents notice, did not get consent from those users’ parents before activating the accounts, and did not post any privacy policy online about how Yelp handled children’s personal data. The attorney general of the United States (plaintiff) sued Yelp for violating the Children’s Online Privacy Protection Act of 1998 (COPPA), seeking monetary civil penalties, an injunction, and other equitable relief.