Run a free scan

Tilting Point: an age screen that starts at 1953 and SDKs left on their defaults

Check two things in any app children might use: that the age screen does not nudge users towards an adult age, and that every SDK is actually configured for the child path. The California case against Tilting Point’s SpongeBob game alleged both failures, and paired the CCPA with the federal Children’s Online Privacy Protection Act (COPPA).

C.D. Cal. · COPPA, CCPA and UCL · Stipulated judgment entered 2 July 2024

The problem

SpongeBob: Krusty Cook-Off is rated "4+" and "E", and the complaint calls it directed to children. Its first screen asked for a birth year with the picker starting at 1953, so a child had to scroll "more than 50 years" to answer truthfully. Even players who said they were under 16 and got the child version had their data collected and shared, because third-party SDKs were "incorrectly configured" (Complaint, ¶¶ 8, 12–13, 19).

Case record

Court
US District Court, Central District of California
Case number
2:24-cv-05140-FLA-AS
Judge
Fernando L. Aenlle-Rocha ([Judgment, p. 16](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
Counsel
Attorney General's Office and Los Angeles City Attorney's Office; Frankfurt Kurnit Klein & Selz PC for Tilting Point ([Judgment, p. 2](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
Laws
COPPA; CCPA; UCL, including Bus. & Prof. Code § 22580
Stage
Stipulated final judgment, Dkt. 15, filed 2 July 2024
Amount
USD 500,000 civil penalties plus USD 10,079.66 costs ([Judgment, ¶¶ 40–41](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
Source review
17 October 2026

The People sued in federal court because COPPA lets a state attorney general bring a civil action there, with the state claims added under supplemental jurisdiction (Complaint, ¶¶ 3–4). Tilting Point stipulated without admitting liability (Judgment, p. 2).

What the regulator alleged

What the regulator alleged
ClaimWhat the law requiresFacts allegedResult
COPPAVerifiable parental consent and notice before collecting under-13s' data (16 C.F.R. §§ 312.4, 312.5)The app was directed to children; numerous users self-identified as under 13; data was collected and disclosed for ads without parental consent ([Complaint, ¶¶ 23–27, 30–35](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20People%20v%20Tilting%20Point%20Media%20LLC%20%28filed%29.pdf))Settled; not decided
CCPA under-16 rulesParental opt-in under 13; the teen's own opt-in for 13 to 15 (Civ. Code § 1798.120(c))Whatever age was entered, data was sold or shared without the required opt-in ([Complaint, ¶¶ 12(c), 36–41](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20People%20v%20Tilting%20Point%20Media%20LLC%20%28filed%29.pdf))Settled; not decided
UCL and ads to minorsNo unfair or deceptive practices; no ads for products minors cannot buy (Bus. & Prof. Code § 22580)Ads not labelled as ads, with no clear exit, and some for a gambling app and a marijuana-growing game ([Complaint, ¶¶ 28, 44](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20People%20v%20Tilting%20Point%20Media%20LLC%20%28filed%29.pdf))Settled; not decided

The complaint records that BBB National Programs' Children’s Advertising Review Unit (CARU) had found similar problems in September 2022, and that Tilting Point did not find the SDK misconfiguration until the state investigation. Tilting Point said "third-party documentation and default settings complicated installation", but the complaint answers that configuration "is ultimately Tilting Point’s legal obligation" (Complaint, ¶¶ 10–11, 20).

What the judgment requires

Paragraphs are from the judgment.

  • No sale or sharing of known under-16s' data, "including through SDKs", without the required opt-in; a user who self-identifies counts as known (¶ 20). A just-in-time notice where it does sell or share (¶ 21).
  • SpongeBob is child-directed. Every SpongeBob game is "deemed DIRECTED TO CHILDREN" (¶ 25), and each app must get a written child-directed analysis (¶ 24).
  • Neutral age screens: no data before age is collected; no default of 16 or above; no hint that features are lost; a notice that the age should be the player’s, not the phone owner’s (¶¶ 29–30).
  • SDK governance framework: per child-directed app, every SDK and its provider, its purpose, an evaluation of its configuration "including default settings", its contract terms, and the steps taken for under-16 data (¶ 33), reviewed and tested annually (¶ 34).
  • Ads: labelled as ads, closable in one click, not manipulative, and nothing children cannot legally buy (¶ 35).

Technical issue

  • Tools or vendors: third-party SDKs and ad networks, not named.
  • Where: the SpongeBob: Krusty Cook-Off app on iOS and Android.
  • What data: personal information including persistent identifiers, used for targeted ads (Judgment, ¶ 12).
  • When: since the 2020 launch, including in the child version.
  • How it came to light: CARU’s 2022 review, then a joint state and city investigation (Complaint, ¶¶ 10–11).

Inth’s technical interpretation: SDK defaults are built for adult, consented traffic. A child path that branches the UI but initialises the same SDKs with the same defaults still collects identifiers and requests personalised ads. The child flags have to be set before the SDK starts, from the age the user entered.

Illustrative pattern, not the defendant’s code. The SDK calls are generic.

// Bad: the picker opens at 1953 and the ad SDK starts with its defaults
birthYearPicker.selectRow(1953 - minimumYear, inComponent: 0, animated: false)
AdsSDK.shared.start() // personalised ads and device ID by default

Illustrative pattern, not the defendant’s code. The SDK calls are generic.

// Fixed: neutral entry, and SDK flags set from the age before start
ageField.placeholder = "How old is the player?" // no preset value
func onAgeEntered(_ age: Int) {
    let restricted = age < 13 || (age < 16 && !consent.teenOptIn)
    AdsSDK.shared.configure(childDirected: restricted, personalisedAds: !restricted)
    AdsSDK.shared.start()
}

Timeline

Timeline
DateEvent
2020App launched ([Complaint, ¶ 8](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20People%20v%20Tilting%20Point%20Media%20LLC%20%28filed%29.pdf))
September 2022CARU findings ([Complaint, ¶ 10](https://oag.ca.gov/system/files/attachments/press-docs/Complaint%20People%20v%20Tilting%20Point%20Media%20LLC%20%28filed%29.pdf))
18 June 2024Complaint filed; settlement announced ([Announcement](https://oag.ca.gov/news/press-releases/attorney-general-bonta-la-city-attorney-feldstein-soto-announce-500000))
2 July 2024Judge Aenlle-Rocha enters the stipulated judgment ([Judgment, p. 16](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))

Outcome

Tilting Point pays USD 500,000 under the UCL, USD 250,000 to the Attorney General and USD 250,000 to the Los Angeles City Attorney, in thirds due within six months, two years and three years of being served with notice of entry (¶¶ 9, 40). It also pays the City Attorney USD 10,079.66 in costs within 30 days (¶ 41). A compliance programme runs for three years with annual reports; a third-party assessor or COPPA safe harbour programme may do the review if the CEO certifies the report (¶¶ 37–38). The judgment is not a finding of liability.

What it cost

What it cost
ItemAmount or term
Civil penaltiesUSD 500,000 in three instalments ([¶ 40](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
City Attorney costsUSD 10,079.66 ([¶ 41](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
Compliance programmeThree years, annual reports ([¶ 37](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))
SDK governance and age-screen reviewsAt least annually; no end date stated ([¶¶ 30, 34](https://oag.ca.gov/system/files/attachments/press-docs/Tilting%20Point%20Final%20Judgment%20%287-2-24%29.pdf))

Why it matters

The Attorney General called it his third CCPA action, and it is the first in this library to pair the CCPA with COPPA (Announcement). Paragraph 33's SDK governance framework is a practical template for any app team, and the age-screen terms reappear in Jam City. A self-regulatory finding (CARU) that was only partly fixed became the starting point for a state case. See children’s privacy defaults and CCPA.

How Inth catches this

  • Code audit: tracker and SDK detection lists advertising and analytics SDKs as they enter an app codebase, and the vendor call graph shows where each is started and whether a child or consent state is read first. That is the raw inventory ¶ 33 asks for.
  • Website audit: not relevant; this was a native app.
  • Consent banner: not relevant; it is a website banner, not a verifiable parental consent tool.
  • Evidence: each Code audit finding keeps its file, commit, owner and decision.

Limit: Inth cannot see what an SDK sends from a device or how a vendor treats a child-directed flag; that needs device traffic capture and the vendor’s terms.

Checks for your own systems

In the repository

  • Find every SDK start or initialize call and check it follows the age decision.
  • Check each SDK’s child-directed or restricted-processing setting, and whether its default is on or off.
  • Check the age field has no preset value.

In the browser and network

  • On a test device, enter age 8 and capture traffic through a proxy. Look for advertising IDs and ad requests.
  • Repeat for age 14 without opt-in.

With the people responsible

  • Write down, per app, whether it is child-directed and why, as ¶ 24 requires of Tilting Point.
  • Review ad network settings for categories children cannot legally buy.

Sources and limits

Source review: 17 October 2026. This page describes the cited records and procedural stage. It does not audit Tilting Point’s current apps. Inth wrote the technical checks; they cannot decide which laws apply or prove compliance.