Case 1:21-cv-00824 Document 1 Filed 08/25/21 Page 32 of 71
bid (i.e., paying the highest price to place an ad in the Angry Birds app), or else another ad SDK might win the bid. Regardless, in its mediation capacity, an SDK is still responsible for acquiring the child’s Personal Information and passing it on to the winning ad network. 75.
Once exfiltrated to the SDK’s servers, the Personal Information harvested from
children playing the Angry Birds Gaming Apps can be combined with other data associated with those same children via the same persistent identifiers or other data (e.g., online activity or demographics) which can track and individually identify the children. This is often accomplished through vast quantities of data obtained by “ad networks.” 76.
An ad network is also where advertising space is bought and sold. In this virtual
marketplace, app developers and advertisers buy and sell advertising space and the ads to fill it. These networks connect advertisers looking to sell data-driven, targeted ads to mobile apps that want to host advertisements. A key function of an ad network is aggregating available ad space from developers and matching it with advertisers’ demands. 77.
Once the ad call is facilitated by the SDK, and the ad is placed on the child’s device,
advertising companies then store and analyze the Personal Information to enable continued tracking of the child. This further analysis and profiling includes storing information such as what ads they have already seen, what actions they took in response to those ads, other online behavior, and additional demographic data. This way, the advertising companies that design and maintain the SDK (and other affiliated entities) can generally monitor, profile, and track them over time, across devices, and across the Internet. Targeted advertising is driven by individuals’ Personal Information and employs sophisticated algorithms that interpret the Personal Information to determine the most effective advertising for those individuals.35 78.
This entire ecosystem collects and uses children’s Personal Information without
first providing direct parental notice or obtaining verifiable parental consent. This includes the 35
For a detailed discussion of targeted advertising, see Section IV.F.1, infra.
31
