Google and its subsidiary YouTube have reached a settlement with the Federal Trade Commission (FTC) and the New York State Attorney General under which Google and YouTube agreed to pay $170 million to settle allegations that YouTube collected personal information from children in violation of the Children’s Online Privacy Protection Act (COPPA).
Under the settlement, Google and YouTube will pay $136 million to the FTC — the largest amount ever obtained by the FTC in a COPPA action — and $34 million to the state of New York. To put this in perspective, the total civil penalty paid by Google and YouTube is nearly 30 times larger than the largest civil penalty previously obtained by the FTC for COPPA violations.
According to the complaint, although YouTube claimed to be a general audience site, several of YouTube’s individual channels are in fact child-directed, and feature video content such as child-friendly animated characters and depictions of children playing toys and engaging in child-oriented activities.
YouTube allegedly violated COPPA by using persistent identifiers, such as cookies, which COPPA deems to be “personal information,” to track viewers of child-directed YouTube channels (who were presumably children under 13 years of age) and serve them behaviorally-targeted advertisements without first notifying their parents and obtaining their parent’s consent to track and collect this information. YouTube allegedly earned millions of dollars by using these persistent identifiers to deliver targeted ads to viewers of its child-directed channels.
According to the regulators, YouTube had actual knowledge that it was collecting personal information from children. Not only had several channel owners told YouTube that their content was directed to children under 13 years of age, but YouTube had itself created content classifications specifically for children, such as “Made for Kids.”
YouTube also manually reviewed and curated content from its child-directed channels for its separate YouTube Kids mobile app. In addition, YouTube allegedly promoted itself as a top destination for kids, a “leader” in reaching children under 13 years of age and the “#1 website regularly visited by kids” in presentations it gave to children’s advertisers.
Despite hosting and promoting numerous child-directed channels, the complaint asserted that YouTube nevertheless told one advertising company that it did not have users younger than 13 on its platform and, therefore, that channels on its platform did not have to comply with COPPA.
In addition to paying the record-breaking $170 million civil penalty, the proposed settlement, which requires court approval, imposes numerous obligations on Google and YouTube.
In particular, it requires that they:
- Develop, implement and maintain a system for YouTube channel owners to designate whether their content is directed to children, so that YouTube can ensure that it complies with COPPA with respect to those channels;
- Notify channel owners that their child-directed content may be subject to COPPA’s obligations;
- Provide COPPA compliance training for employees who deal with YouTube channel owners;
- Provide notice to parents about their data collection practices and obtain verifiable parental consent before collecting, using or disclosing personal information from children; and
- Satisfy certain recordkeeping and reporting requirements to verify their ongoing compliance with COPPA.
Implications of the Settlement
It is perhaps no coincidence that the settlement was announced only weeks before the FTC’s upcoming public workshop on COPPA where, among other things, the FTC will consider whether COPPA should be updated or otherwise modified. For additional information, please see a previous alert on this subject titled, “FTC to Review the Children’s Online Privacy Protection Act.”
Significantly, as Commissioners Joseph J. Simons and Christine S. Wilson observed in their separate statement regarding the settlement, this settlement is groundbreaking not only in its monetary impact, but in its use of injunctive relief in an effort to shift the behavior of online content platforms and online service providers more broadly.
Notably, COPPA provides that third parties that host and serve ads on child-directed content but do not themselves create the content are not responsible for making inquiries about whether the content is child-directed, and are not obligated to comply with COPPA unless they have actual knowledge that the content they are hosting is child-directed.
The settlement now imposes an obligation on Google and YouTube to create a system through which content creators must self-designate and notify the platform if they are child-directed. As Commissioners Simons and Wilson pointed out, this obligation “exceeds what any third party in the marketplace currently is required to do” and represents “the first and only mandated requirement on a platform or third party to seek actual knowledge of whether content is child-directed.”
It also should be noted that FTC Commissioners Rebecca Kelly Slaughter and Rohit Chopra were dissatisfied with the proposed settlement, contending that it did not go far enough — that the monetary payment should have been larger and that further obligations should have been imposed on Google and YouTube to ensure their compliance with the mandated self-designating system, such as requiring that they develop a “technological backstop to identify undesignated child directed content and turn off behavioral advertising.”
Notably, it seems that Google and YouTube are already taking steps of their own volition to course-correct. Prior to the FTC announcing the settlement, YouTube announced plans to expand its YouTube Kids service, currently only available via mobile app, to the web. This additional platform would allow YouTube to implement age-gate mechanisms into its general audience website to direct users under 13 to the YouTube Kids portion of the site. In addition, YouTube’s announcement revealed that YouTube Kids will be introducing a new content filter for parents, based on their child’s age level. This announcement suggests that YouTube intends to make meaningful reforms to ensure compliance with COPPA, indicating that the platform does take children’s privacy concerns seriously.
One or more of these elements certainly may surface again as the FTC revisits COPPA in October.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.