Photo credit: wachiwit – stock.adobe.com.
Following an extensive investigation, the Federal Trade Commission (“FTC”) announced a settlement with Google and its subsidiary YouTube for the largest-ever civil penalty for violations under the Children’s Online Privacy Protection Act (“COPPA”) – $136 million to the FTC and $34 million to the State of New York.
In its 2013 COPPA rulemaking, the Commission indicated that online platforms are not responsible for COPPA compliance when they were offering someone else’s child-directed content on such platform. But the Commission also made clear that “[p]latforms may well wear multiple hats and are still responsible for complying with COPPA if they themselves collect personal information directly from children.” The settlement with Google and YouTube is the first case in which the FTC has enforced that principle.
According to the complaint, the companies knowingly collected personal information, such as persistent identifiers for use in behavioral advertising, from YouTube channels directed to children under the age of 13. In particular, the complaint alleged that Google and YouTube obtained actual knowledge they were serving behavioral advertising to child-directed channels by: (1) directly soliciting and engaging with child-oriented Channel Owners and content creators such as toy companies, child-directed television and film brands; (2) marketing YouTube to such companies as an effective place to reach children ages 2-12; (3) manually and automatically curating content from the general audience page for YouTube for Kids; and (4) creating and applying content ratings to videos indicating the materials were for children under 8.
The FTC found that “[t]hrough this actual knowledge, Defendants are deemed to be operators of a website or online service directed to children.” The complaint alleged that, as operators conducting behavioral advertising, Google and YouTube violated COPPA when they failed to provide sufficient notice on their website regarding what information is collected from children, how it is used and how the information is disclosed. Moreover, the companies did not provide direct notice to parents about what information is collected from children, nor obtain verifiable parental consent before collecting or using children’s personal information.
Under the terms of the settlement, in addition to general COPPA compliance, Google and YouTube must “develop, implement, and maintain a system for Channel Owners to designate whether their content on the YouTube service is directed to children,” notify Channel Owners that their child-directed content may be subject to COPPA Rule’s obligations, and provide annual COPPA training to all employees dealing with YouTube Channel Owners. The settlement also forbids the companies from using or benefiting from users’ personal data it has already collected. YouTube will have to limit data collection and take measures to prevent targeted ads from being placed on child-directed content.
Similar to the record-breaking Facebook settlement, the COPPA settlement was a 3-2 split vote with Commissioners Rohit Chopra and Rebecca Kelly Slaughter opposing. The dissenting Commissioners expressed concerns that YouTube is not required “to police the channels that mis-designate their content,” or to create technology to identify undesignated child-directed content. Additionally, the dissents noted the settlement does not hold company executives personally accountable for the illegal data mining of children.
The settlement will likely have implications beyond YouTube and Google as it may encourage content platforms to implement measures to identify children-directed content and take steps to limit targeted behavioral advertising. In addition, the Statement of Commissioner Simons and Wilson noted the agency would be conducting “a sweep of YouTube channels following implementation of the order’s provisions to determine if there are any further violations of COPPA.”
Note that the FTC is currently seeking public comment on the Commission’s review of the COPPA Rule and is also hosting a COPPA public workshop on October 7, 2019.
