← Back to incidents

FTC Orders Weight Watchers to Delete AI Models Trained on Children's Data from Kurbo App

High

The FTC ordered Weight Watchers to delete AI models trained on children's data collected through its Kurbo app without proper parental consent, marking the first 'algorithmic disgorgement' order requiring destruction of AI systems built with illegally obtained data.

Category
Privacy Leak
Industry
Healthcare
Status
Resolved
Date Occurred
Jan 1, 2018
Date Reported
Sep 15, 2022
Jurisdiction
US
AI Provider
Other/Unknown
Application Type
embedded
Harm Type
privacy
Estimated Cost
$1,500,000
Human Review in Place
No
Litigation Filed
No
Regulatory Body
Federal Trade Commission
Fine Amount
$1,500,000
COPPAchildren_privacyalgorithmic_disgorgementFTCweight_losshealth_dataAI_training_dataregulatory_precedent

Full Description

In September 2022, the Federal Trade Commission issued a landmark enforcement action against WW International (Weight Watchers) for violations of the Children's Online Privacy Protection Act (COPPA) through its Kurbo by WW app. The Kurbo app, which Weight Watchers acquired in 2018, was marketed as a weight management platform for children and teens, using AI-powered features to provide personalized diet and exercise recommendations. The FTC investigation revealed that from 2018 onwards, Weight Watchers collected personal information from children under 13 through the Kurbo app without obtaining the verifiable parental consent required under COPPA. This data included children's weights, photos of their meals, and other sensitive health information that was then used to train the company's AI algorithms and machine learning models for generating personalized weight loss recommendations. The commission found that Weight Watchers knew it was collecting data from children, as the app was specifically designed for users as young as 8 years old and actively marketed to children. Despite this knowledge, the company failed to implement proper age verification systems or obtain meaningful parental consent before collecting and processing children's personal information. In an unprecedented enforcement action, the FTC not only imposed a $1.5 million civil penalty but also ordered Weight Watchers to delete all AI models, algorithms, and data derived from the illegally collected children's information. This 'algorithmic disgorgement' remedy marked the first time a U.S. regulator required the destruction of AI systems built with unlawfully obtained data, establishing a significant precedent for AI accountability and children's privacy protection in the digital age.

Root Cause

Weight Watchers collected personal information from children under 13 through the Kurbo app without obtaining verifiable parental consent as required by COPPA, then used this illegally obtained data to train AI models and algorithms for personalized weight loss recommendations.

Mitigation Analysis

Proper COPPA compliance mechanisms including verifiable parental consent systems, data governance frameworks that flag use of children's data in AI training, and privacy-by-design approaches in algorithm development could have prevented this violation. Age verification systems and data lineage tracking would have identified the problematic data sources before model training.

Lessons Learned

This case established the precedent of 'algorithmic disgorgement' as an enforcement tool, demonstrating that regulators can require companies to destroy AI models built with illegally obtained data. It highlights the critical importance of COPPA compliance in AI development and the potential for retrospective destruction of AI systems when built on unlawful data foundations.