A Scary Example of Why You Should Care About PII and COPPA

I try to post content in this blog that will help game developers understand their privacy responsibilities, not just with COPPA in the US, but anywhere in the world. Much of it has been technical but this time, I’m sharing a scary experience that recently happened to a member of our team. 

I think this story makes it very obvious why it’s important for us to do whatever we can to protect children while they take advantage of all the good things today’s technology offers. Here’s her story:

“We spend a lot of time talking about personably identifiable information (PII) and when you can and can’t collect it, but talking about it as an acronym doesn’t get to the heart of how very serious the misuse of a person’s PII can really be.

I personally just experienced the misuse of PII, and I have to say, I was not prepared for how violated I felt having one of my kids’ information collected, shared, and used without my knowledge. It was downright creepy, and having experienced this first hand, I now have a whole new level of (healthy) respect for the issue of protecting children’s PII.

My youngest daughter is a competitive cheerleader. Competitive cheerleading is a multi-million dollar industry, with global associations that govern the sport, weekly competitions that take place across the US and hundreds of thousands of young cheerleaders (boys and girls) spending lots and lots of money to participate in this sport. It’s also very competitive and being “known” or “popular” as a cheerleader, team, or gym is very important.

One way cheerleaders, teams, and gyms get “known” is to have social media accounts across Facebook, Instagram, Twitter, etc. where they can promote what they are doing, where they’ll be competing, and how they are leading the sport. Individual cheerleaders are encouraged to show off the new tricks and stunts they have learned by posting pictures and video to their social channels. Cheerleaders being cheerleaders, they are also encouraged to root each other on via these social channels, call one another out, and issue competitive challenges.

My daughter’s cheerleading team has a profile page on each of the main social media platforms, as does her gym. On these profile pages are many pictures of my daughter in her cheer uniform and gymnastics practice attire, posing.  Taken out of context of her fun little youth cheer team, these photos could be provocative.

As the gym takes and posts these photos they aren’t thinking, “wow, that 5 year old is gorgeous with her leg stretched straight up in the air.” They are thinking, “look how talented the athletes are that we develop at this gym.” Unfortunately, there are crazies out there, and those crazies have full access to the public social media pages and all the PII they house, just like the rest of us do.

I didn’t give a second thought to the massive amounts of PII being captured and shared about my daughter on her cheer social profiles, from the info about her on her cheer bio and her achievement pictures and videos (like when she got her middle splits or her back handspring) to the list of the competitions her team would be performing at with the schedule and a map to the competition or the practice schedule of when and where she trains.

I didn’t think about those things until I received an email last week from the local police department. The email was followed by a phone call letting me know that a registered pedophile and sex offender with a history of stalking little girls who is known to have a cheerleader fetish has been verified to be following my daughter’s social media profiles. 

Based on his cell phone data, he has been pinpointed to the location of my daughter’s practice gym and recent cheer competitions. Furthermore, this predator is the real owner of two individual social media accounts that have been interacting with our girls where he was posing as a fellow elite cheerleader and had asked to schedule meet-ups at competitions so they could “exchange good luck gifts”.

Have the chills yet? Yep, all that PII just got real. It’s like a puzzle, and all those PII pieces are being put together to form a scarily realistic picture of who my daughter is, where she can be found and when, what she likes, who her friends are, and so much more.

The police who contacted me were very professional and carefully reviewed all of the known connection points that this potential predator had with my daughter and her teammates. They also provided tips and advice on how to limit our exposure to these types of situations. While I haven’t taken down the photos or the information about her that resides on these websites for her team I did have a number of sit down conversations with my daughter and her teammates about the kind of information that strangers could know about them just from following them on social media, and how “meeting” people online through social media is unsafe and should be monitored by a parent.

Thankfully, this example of PII abuse didn’t end in tragedy thanks to the diligence of our local police department, but let it serve as a reminder to us all that PII in the wrong hands can be very dangerous. The more we know about what PII is being captured, shared, and stored, by all the apps and social services we use, the better.“

Friends, this is why we need to protect children’s privacy in every way we can.  Love your children, and have a great holiday season!