1

Statement of Commissioner Noah Joshua Phillips

FTC v. HyperBeard, Inc., et al

Matter No. 1923109

June 4, 2020

I commend Federal Trade Commission staff for their work investigating and resolving this 

matter. Given the violations at issue, the harm to consumers, and how we have approached other 

COPPA cases, my view is that the fine imposed today is too much; and so I dissent.

The recent push to heighten financial penalties—even where the law permits only equitable 

relief1

— has been relentless, without clear direction other than to maximize the amount in every 

case. That may create the appearance of being “tough”, but it runs the risk also of being 

inconsistent and, in some cases, unfair or even counterproductive. That is particularly so in the 

context of consumer data privacy, and this is not the first time we have confronted the difficulty 

of getting such penalties right.2

HyperBeard, Inc. (HyperBeard) is alleged to have violated the Children’s Online Privacy 

Protection Act (COPPA), which requires, inter alia, that online services directed to children and 

wishing to collect covered information about them must publicly disclose their collection 

practices; provide direct notice to parents; and obtain verifiable parental consent for the 

collection, use, or disclosure of the information.3According to the Complaint, HyperBeard 

allowed third-party ad networks to collect information (in the form of persistent identifiers)from 

the users of its child-directed apps, and those networks in turn served those users with 

behavioral advertisements using the information collected. HyperBeard permitted that collection 

without disclosing it or obtaining verifiable parental consent. Pursuant to the COPPA Rule, 

amended in 2012 to add, among other things, persistent identifiers to the information covered 

under COPPA,4HyperBeard’s failures to disclose and obtain consent are violations of law 

subject to civil penalties under 15 U.S.C. § 45(m).

1 The routine description of the need for equitable monetary (and other) relief in terms of penalizing wrongdoers and 

achieving specific and general deterrence, see, e.g., Dissenting Statement of Commissioner Rebecca Kelly 

Slaughter, In the Matter of Progressive Leasing, LLC, Matter No. 1823127 (Apr. 20, 2020), neglects the legal 

difference between equitable relief and penalty. Failing to recognize and give credence to that difference runs the 

risk, among other things, of weakening the suite of relief available to the Commission under Section 5. Cf. Kokesh

v. SEC, 137 S. Ct. 1635 (2017) (applying penalty statute of limitations period to use by Securities and Exchange 

Commission of disgorgement remedy, where equitable remedy operated as penalty).

2 Separate Statement of Commissioner Noah Joshua Phillips, United States of America and People of the State of 

New York v. Google LLC and YouTube, LLC, Matter No. 1723083 (Sept. 4, 2019), 

https://www.ftc.gov/system/files/documents/public_statements/1542943/phillips_google_youtube_statement.pdf.

3 See 15 U.S.C. § 6502(b); see also 16 C.F.R. § 312.4(b), (d); § 312.5(a)(1).

4 Congress enacted COPPA to prohibit unfair or deceptive acts or practices in connection with the collection, use, or 

disclosure of personally identifiable information from children on the Internet. It gave the Commission 

responsibility for promulgating a regulation under COPPA, and for enforcing it. The COPPA Rule went into effect 

in 2000. Among other things, it required Web site operators to obtain verifiable consent from parents before 

collecting personal information from their children. In December 2012, the FTC revised the COPPA Rule’s 

definition of personal information to include “persistent identifiers”, such as IP addresses and mobile device
2

That statute lays out the factors courts (and, by extension, the Commission) must consider in 

seeking a penalty under COPPA:

1) The defendant’s degree of culpability;

2) The history of prior similar conduct by the defendant;

3) The defendant’s ability to pay;

4) The effect on the defendant’s ability to continue to do business; and

5) Such other matters as justice may require.5

Evaluating a district court’s award under this test, the U.S. Court of Appeals for the Seventh 

Circuit recently advised that “the best way [to ensure that a penalty is within a constitutionally 

allowable range] is to start with harm rather than wealth”, noting that, “[n]ormally the legal 

system bases civil damages and penalties on harm done”.6So, while we must consider more than 

just harm in fashioning a penalty under COPPA, we cannot ignore it.

The role of harm in fashioning penalties is well-trod ground. The economics literature counsels 

that basing penalties on harm (adjusting upward based on the likelihood of detection) forces 

defendants to internalize the costs their behavior imposes on others, orienting conduct in a 

socially beneficial fashion.7That aligns with our basic intuitions of justice. As I wrote in my 

concurring statement in U.S. v. Google, LLC and YouTube LLC, another COPPA case, common 

sense dictates that we punish more that which threatens more harm.8

What is the harm in this case? As in the YouTube case, rather than seeing contextual 

advertisements, HyperBeard app users (children, we presume) viewed advertisements based on 

the collection of persistent identifiers. Under the COPPA Rule, that is something;9 but it is not

identifiers that can recognize users over time and across different websites or online services. 16 C.F.R. § 312.2. 

Liability in this case rests entirely on that rule amendment.

5 15 U.S.C. § 45(m)(1)(C).

6 U.S. v. Dish Network, L.L.C., No. 17-3111, slip op. at 16 (7th Cir. Mar. 26, 2020).

7 See, e.g., Gary S. Becker, Crime & Punishment: An Economic Approach, 76 J. POL. ECON. 169 (1968); STEVEN 

SHAVELL, FOUNDATIONS OF ECONOMIC ANALYSIS OF LAW 474-79 (2004); Mitchell A. Polinsky & Steven Shavell,

Should Liability Be Based on the Harm to the Victim or the Gain to the Injurer?, 10 J.L. ECON. & ORG. 427 (1994); 

Louis Kaplow, Optimal Deterrence, Uninformed Individuals, and Acquiring Information about Whether Acts are 

Subject to Sanctions, 6 J.L. ECON. & ORG. 93 (1990). See also Richard Craswell, “Deterrence and Damages: The 

Multiplier Principle and Its Alternatives,” 97 MICH. L. REV. 2185 (1999).

8 Separate Statement of Commissioner Noah Joshua Phillips, supra note 2.

9 We are in the midst of a robust national debate about the collection, use, and transmission of data about people. 

There are many concerned about the practice of behavioral advertising, including some of my colleagues. See, e.g., 

Dissenting Statement of Commissioner Rohit Chopra, In the Matter of Google LLC and YouTube, LLC, File No.

1723083 (Sept. 4, 2019), https://www.ftc.gov/system/files/documents/public_statements/

1542957/chopra_google_youtube_dissent.pdf. Readers should note, however, that there are many potential 

benefits to behavioral advertising, including reduced consumer search costs and consumers seeing fewer ads. See 

Yan Lau, A Brief Primer on the Economics of Targeted Advertising, ECON. ISSUES PAPERS, BUREAU OF ECON., 

FED. TRADE COMM’N at 5-6 (Jan. 2020), https://www.ftc.gov/system/files/documents/reports/brief-primereconomics-targeted- advertising/economic_issues_paper_-_economics_of_targeted_advertising.pdf.
3

everything. The Complaint does not allege, for instance, that HyperBeard shared sensitive 

personal information about children, or publicized it. Nor does it allege that children were 

exposed to unauthorized contact from strangers, or otherwise put in danger. Harms like those are 

understandably frightening, and they played a critical role in animating Congress to pass COPPA 

in the first place.10

Consider another recent COPPA case, against Musical.ly, operators of the popular social 

network TikTok.11The defendant paid a $5.7 million fine, at that point the largest COPPA 

penalty ever assessed. In that case, the app allowed children, who made up a significant 

percentage of TikTok’s 65 million registered U.S. users, to establish public accounts that shared 

sensitive personal information and allowed them to receive direct messages; indeed, there were 

many public reports of adults trying to contact children via TikTok. The defendant, Musical.ly, 

exhibited considerably more culpability, too. The company was well aware of complaints from 

parents that children were creating accounts without permission; and, in some cases, even when 

closing an account in response to a complaint, the company failed to delete a child’s personal 

information from its servers. Musical.ly also sent messages to popular users who appeared to be 

under 13 instructing them to edit their profiles to indicate that the accounts were being run by an 

adult, but took no steps to verify that the person responding was, in fact, an adult.

HyperBeard is not Musical.ly, KleptoCats and the other HyperBeard productions are not TikTok, 

and this case is not that one. As charged in the Complaint, HyperBeard violated the COPPARule 

by collecting the persistent identifiers of users presumed to be children without adequate 

disclosure and authorization. Those data were then used to serve users with behavioral ads. That 

is the extent of the harm. The Complaint does not allege that HyperBeard is a recidivist; as the 

Chairman’s statement notes, the company is unable to pay; and, in my opinion, other factors 

suggesting a comparable degree of culpability are absent. All of that ought to matter, a lot. In my 

view, given the difference in harms alleged and the other statutory factors, HyperBeard 

warranted a substantially lesser penalty than that assessed in Musical.ly.

In YouTube, I wrote that, as Congress considers consumer data privacy legislation, it should 

consider consumer harm and, in particular, how any penalty relates to the concept of harm.12

There is an important reason for that, as this case demonstrates. Many violations of data privacy 

statutes on the books today—including COPPA—regulate conduct that does not involve a great 

deal of harm, at least as harm is traditionally considered.13 (As noted above, COPPA violations

10 See 144 CONG. REC. S11,657 (daily ed. Oct. 7, 1998) (statement of Sen. Bryan).

11 FTC Press Release, Video Social Networking App Musical.ly Agrees to Settle FTC Allegations That it Violated 

Children’s Privacy Law (Feb. 27, 2019), https://www.ftc.gov/news-events/press-releases/2019/02/video-socialnetworking-app-musically-agrees-settle-ftc.

12 Separate Statement of Commissioner Noah Joshua Phillips, supra note 2.

13 The Chairman’s statement relies in substantial part on the fact that the civil penalties penalize conduct proscribed 

by Congress. That is true to some extent, but it omits an important detail. Congress delegated to the FTC to define 

information covered under COPPA. 15 U.S.C. § 6501(8). Well over a decade after Congress legislated, this agency 

used that power to adopt a rule that included persistent identifiers among the information covered under the statute. 

Only at that point did the conduct at issue here become illegal. The COPPA Rule is the operative law, but Congress 

did not itself deem the conduct at issue here to be harmful.
4

also do reach conduct that is more obviously harmful.) But the underlying kind of conduct at 

issue in our YouTube case, and here—the collection, use, and disclosure of non-sensitive 

personal information—is endemic to the economy. It goes on everywhere. And it is numerous. 

That is, any time there is a violation of the kind here, there are likely to be a lot of violations. To 

the extent the number of violations bears on the penalties assessed, that creates the prospect—in 

data privacy cases categorically and more so than in many other contexts—of routine and 

overwhelming penalties, and inconsistent ones at that. (Given the endemic quality of the 

utilization of data, it also raises the specter of selective prosecution.) So making harm a more 

central consideration in the calculation of privacy penalties is useful to direct law enforcement, 

to avoid drastic over-penalization, and to ensure penalties fit the violations.

The point is not to immunize that which is illegal from penalties. We must, however, think about 

penalties in terms of what is being penalized. It is illegal to speed and illegal to steal. But we 

don’t penalize those two the same way, nor do we ignore the difference between driving 76 miles 

per hour and driving 103; or between stealing $100 and $100 million. To do so would be 

perverse, both from the perspective of justice and social consequences. As we recognize even in 

the context of criminal law, the costs necessary to achieve complete deterrence of every kind of 

legal violation would impose such a burden that society should not bear it.14 Consistent with the 

statutory instruction, just as harm should not be the whole of the discussion, neither should 

deterrence.15

As I said in the YouTube case, Congress should pay attention to how the FTC is approaching 

monetary relief, including civil penalties, especially in privacy cases. In this case, at least, I fear 

we got it wrong; and so I respectfully dissent.

14 See Becker, supra note 7 at 180-81 (noting that increasing punishment severity decreases the number of offenses, 

but that the cost of imposing these severe punishments may be extremely high).

15 I agree wholeheartedly with the Chairman’s comment about the number of non-monetary forces that can combine 

to deter illegal conduct.