The Walt Disney Company’s gaming apps allegedly violate the privacy of children.
That’s according to a federal lawsuit filed last week in U.S. District Court in San Francisco. Amanda Rushing, the lawsuit’s plaintiff, claims that Disney’s various mobile gaming apps routinely collect smartphone data that can eventually be used to create profiles of children that advertisers can then exploit.
Although Rushing’s lawsuit points to Disney Princess Palace Pets as the gaming app that allegedly tracked her child, it also lists 42 other Disney apps that the plaintiffs say violate the Children’s Online Privacy Protection Act, or COPPA. These apps include the games Toy Story: Story Theater, Disney Story Central, Star Wars: Commander, and DuckTales: Remastered.
The COPPA law debuted nearly 20 years ago to prevent website operators from collecting personally identifying information about children without their parents’ consent.
Get Data Sheet, Fortune’s technology newsletter.
In a statement to The Washington Post, Disney said it “has a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families.”
“The complaint is based on a fundamental misunderstanding of COPPA principles, and we look forward to defending this action in court,” a Disney spokesperson said.
Rushing’s lawsuit alleges that while Disney’s apps don’t collect personal data like email addresses or users’ names, they collect more obscure data like a smartphone’s so-called persistent identifier that’s unique to individual mobile devices and digital files.
This type of data can then be used to “to detect a child’s activity across multiple apps and platforms on the Internet, and across different devices, effectively providing a full chronology of the child’s actions across devices and apps,” according to the complaint. “This information is then sold to various third-parties who sell targeted online advertising.”
At the heart of the matter are several software tools Disney used to create the apps that Rushing believes help transmit data like persistent identifiers back to software tool makers that enable them to “facilitate subsequent behavioral advertising” to children. The lawsuit names the technology companies as Upsight, Unity Technologies, and Kochava as the makers of the software tools, and refers to them as defendants along with Disney.
Rushing alleged that Disney never notified her that it was collecting data that she claims could be used to track children. She also alleged that the software tool makers failed to ensure that Disney properly seeks parental consent before they begin obtaining data to be used for targeted advertising. Rushing wants Disney and the other companies to stop the tracking practices, destroy any personal data that they obtained thus far, and seeks “nominal and punitive damages in an amount to be determined at trial.”
Fortune contacted Disney, Upsight, Unity Technologies, and Kochava, for additional comment and will update this story if they respond.
