Earlier this month, YouTube and its parent company, Google, entered into a record $170 million proposed settlement to resolve allegations brought by the Federal Trade Commission (FTC) and the New York Attorney General (NYAG) under the federal Children’s Online Privacy Protection Act (COPPA). According to the complaint in the case, YouTube collected personal information on video channels directed to children without parental consent using persistent identifiers that can track individuals across the Internet. This is the largest penalty to date in a COPPA enforcement action.
COPPA prohibits an operator of a website or other online service “directed to children,” or any operator that has “actual knowledge that it is collecting personal information from a child,” from collecting, using, or disclosing personal information of children under the age of 13, without express parental consent. Prohibited personal information includes not only the name, address, and phone number of a child under 13, but also persistent identifiers such as web browser cookies and geo-location information.
This is not the first time NYAG has brought enforcement actions under COPPA, and actions to enforce the statute are on the rise, both by NYAG and the FTC. As we reported late last year, Oath, Inc. (formerly AOL Inc.) settled a COPPA investigation with NYAG for $5 million – at the time, a record sum under COPPA. Just three months later, the company TikTok settled a COPPA enforcement action by the FTC based on TikTok’s Musical.ly lip-syncing app for a then-record $5.7 million. Both of those settlements, however, are miniscule in comparison to YouTube’s resolution.
In addition to the relatively large size of the civil penalty against YouTube, the settlement also mandates a variety of changes to YouTube’s platform. As part of the settlement, YouTube and Google agreed to implement a system where YouTube channel owners must designate whether a particular video is directed to children, and YouTube announced that it will “treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user.” YouTube also agreed to stop serving personalized advertisements on child-directed content and disable certain features on such content, including comments and notifications.
Despite its size, some – even within the FTC itself – feel that this settlement does not go far enough. The FTC commissioners approved the settlement by a vote of 3 to 2. In a dissenting statement, Commissioner Rebecca Kelly Slaughter noted that the designation of content as child-directed is critical to YouTube’s remediation efforts, and the settlement does not go far enough in requiring that child-directed content be identified and “fenced-in.” And Commissioner Rohit Chopra dissented on the basis that the civil fine was too modest, suggesting that the company should have paid multiples of its unjust gains, which could have resulted in a civil penalty of over $1 billion.
Regulators at the state and federal level are increasingly focused on COPPA compliance. For example, NYAG launched “Operation Child Tracker,” a targeted investigation into illegal online tracking of young children in violation of COPPA. YouTube’s settlement highlights – yet again – the importance of careful review of a company’s data collection procedures, especially as it relates to children. It should also serve as a reminder for companies operating online platforms that host user-created content to be mindful that a business platform may be found to be “directed to children,” and subject to COPPA, based at least in part on conduct of that platform’s public users.
Companies can expect that the FTC and NYAG, among other law enforcement entities, will continue to aggressively enforce COPPA, though it remains to be seen whether the civil penalty against YouTube is the new normal. We will continue to cover COPPA enforcement as developments arise.
