Federal and State Authorities Increase Scrutiny and Enforcement of Children’s Privacy; Google, YouTube Agree to Pay a Record $170 Million Fine
This fall, scrutiny has increased on children’s privacy with the FTC and New York Attorney General’s announcement of the largest fine ever for violations of the Children’s Online Privacy Protection Act (“COPPA”), followed by FTC public workshops on updating the COPPA Rule. Combined with increased requirements for the sale of teen personal information under the California Consumer Privacy Act (“CCPA”), and calls for triple fines for children’s privacy violations under a potential CCPA 2.0 referendum for 2020, children’s privacy has come to the forefront of privacy risks.
On September 4, 2019, the Federal Trade Commission (“FTC”) and New York Attorney General’s Office announced a record-setting $170 million civil penalty and other sanctions on Google LLC and its subsidiary YouTube, LLC to settle allegations of violations of children’s privacy rules. This is the largest civil penalty for violations of COPPA to date, and exponentially larger than the previous record $5.7 million fine of TikTok’s parent company last February for violations of the same law. The settlement requires Google and YouTube to pay $136 million to the FTC and $34 million to New York. The New York Attorney General’s coordination was a notable feature of the announcement—indicating increased attention from the states that may supplement the FTC’s own bandwidth to investigate and enforce the law.
COPPA applies to operators of commercial websites and online services (including mobile apps) directed to children under 13 that collect, use, or disclose personal information from children (15 U.S. Code § 6502(a)). While COPPA clearly applies to children’s sites, COPPA may also apply to an otherwise general audience website (i.e. Youtube), particularly where the operator has “actual knowledge” that it is collecting, using or disclosing personal information from children’s online. Moreover, personal information is a broad concept under COPPA, covering persistent identifiers along with traditional personal identifiers.
The FTC and New York Attorney General alleged that, while YouTube claimed to be a general-audience site, some of YouTube’s individual channels are child-directed and must comply with COPPA. Specifically, the FTC and New York Attorney General alleged that Youtube hosts numerous channels that met COPPA’s definition of a site “directed to children” and that Youtube was aware that a significant percentage of users were children under the age of 13. The FTC alleged that Youtube gained “actual knowledge” of such underage use, due to the fact that many of the channels self-identify as being for children in the “About” section of their YouTube channel webpage. In addition, many of the channels allegedly included indicia of child-directed content, such as the use of animated characters and/or depictions of children playing with toys and engaging in other child-oriented activities. Moreover, the FTC highlighted that Youtube’s automated system selected content from the child-directed channels to appear in YouTube Kids, and further alleged that in many cases, Youtube manually curated content from these channels to feature on its YouTube Kids homepage. According to the complaint, YouTube also used persistent identifiers on channels directed to children – identifiers that allowed YouTube to track children online and deliver to them targeted, personalized ads.
Settlement Terms. As a result of the FTC and NY AG action, in addition to paying the $170 million civil penalty, Google and Youtube have agreed to:
- Develop, implement and maintain a system for YouTube channel owners to designate whether their content is directed to children, so that YouTube can ensure that it complies with COPPA with respect to those channels;
- Notify channel owners that their child-directed content may be subject to COPPA’s obligations;
- Provide annual COPPA compliance training for employees who manage YouTube’s relationship with channel owners;
- Provide notice to parents about their data collection practices and obtain verifiable parental consent before collecting, using or disclosing personal information from children; and
- Satisfy certain recordkeeping and reporting requirements to verify their ongoing compliance with COPPA.
In a blog post responding to the settlement, Youtube explained several remedial and risk mitigation steps it would take to protect children’s privacy on the site. Specifically, Youtube stated that it will treat all data collected from anyone watching children’s content as coming from a child, regardless of the age of the user. Additionally, Youtube stated that it will no longer permit personalized ads (e.g. behavioral advertising) on content identified as “child-directed” content, and will no longer permit users to comment on such videos.
FTC COPPA Workshop. Against the backdrop of the FTC’s historic fine for violations of COPPA, on October 7, 2019, the FTC hosted a public workshop to explore whether to update the COPPA Rule. Workshop panel participants spoke at length about how the audience composition of a particular service should factor into a determination of whether a service is directed to children, and discussed whether Youtube’s decision to end targeting children with personalized ads has led to confusion in the market. Panelists seemed eager for the FTC to clarify how to determine whether personalized advertising is child-directed.
