On March 7, 2025, New York Attorney General Letitia James announced an Assurance of Discontinuance with Saturn Technologies (“Saturn”) for “failing to protect young users’ privacy” on their Saturn app. The app was designed to help students manage their schedules and connect with classmates, but the AG’s office identified various privacy risks including a failure to verify student identity. 

Background on Attorney General Findings

The Attorney General found significant issues with Saturn’s verification processes. Saturn marketed its app to high school students as a secure platform where they could “choose their high school community and share personal information with that high school community, such as their name, picture, biography, social media links, and school schedule.” Saturn represented to students that their platform was limited to high school students that it had verified attended the same school as a given user. This was initially accurate as Saturn verified user identities using their high school email credentials. However, Saturn’s verification methods changed in 2021, and the company disabled verification processes for over 4,000 high schools. The Attorney General found that after Saturn made school email credential verification optional, “it began to use unproven and untested user verification methods.” These methods included verifying users by “checking whether they appeared in the phone contact book of as few as three users” and “confirming that the user was accepted as a ‘friends’ with as few as one other user.”   

Other findings of the Attorney General’s investigation included a lack of age screening to confirm users were high school aged, promotion of its app through students without disclosure of promotion, copying user contacts and continued use of the copies even if the user changed their phone settings to deny app access to their contact book, and a failure to keep sufficient records regarding data privacy, data permissions, user verification, and user privacy.

Settlement Terms and Compliance Requirements

Under the terms of the settlement agreement, Saturn will pay $650,000 in penalties and costs to the state, limit the visibility of information about non-Saturn using students, allow teachers to block their name, initials, or other personal identifier from appearing in the class schedule feature, delete retained copies of the phone contacts of certain users, and hide the personal information of current students under 18 until Saturn obtains informed consent to the new app terms. Saturn is also prohibited from “making any future claims about user safety or user verification unless the company has a reasonable basis for making the claim based on competent and reliable scientific evidence.” 

Takeaways

This case is a reminder that regulators are closely scrutinizing apps and websites directed to minors for violations beyond COPPA or other state privacy laws. In this case the Attorney General’s office focused on deceptive marketing claims as a tool to crack down on marketing claims about safety and privacy, a new avenue to regulate companies’ privacy practices. It is important that companies look beyond COPPA or comprehensive state privacy laws when analyzing privacy policies, particularly when dealing with sensitive groups such as minors. And, it's important to note that sensitive data does not exclusively encompass minors under 13. The privacy of teen data is also increasingly regulated.