The Disney Princess Palace Pets app allows children to play with, bathe and accessorize about 10 different virtual pets. Sounds innocent enough.

But according to a new lawsuit, The Walt Disney Co. and its software partners are illegally using the app—and dozens of others aimed at kids—to track the online activity of youngsters to serve them targeted ads. Disney and three software companies were hit with a class action complaint Thursday claiming Princess Palace Pets violates a federal law designed to protect children's privacy while online.

Lawyers at Carney Bates & Pulliam and Lieff Cabraser Heimann & Bernstein filed the suit on behalf of a San Francisco woman whose daughter uses the app. The suit claims Disney's software partners—Upsight Inc., Unity Technologies SF and Kochava Inc.—harvested personally identifiable information from players under the age of 13 in violation of the Children's Online Privacy Protection Act, or COPPA. The suit seeks unspecified damages and an injunction barring further violation of COPPA, the 1999 federal law that requires online services to get parental permission before collecting identifying information of anyone younger than 13.