In the largest settlement ever obtained in connection with the Children’s Online Privacy Protection Act (COPPA), Google and its subsidiary YouTube have agreed to pay $170 million to the Federal Trade Commission (FTC) and the New York Attorney General (NYAG). The settlement comes in response to allegations that, in violation of COPPA rules, Google and YouTube collected personal information from children under 13 to serve them targeted advertising, without first notifying parents and obtaining their consent.

COPPA imposes compliance obligations on the operators of child-directed commercial websites and online services that “collect, use, or disclose” the personal information of children under 13. The FTC has also interpreted COPPA to apply to websites or online services having “actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.” Where COPPA requires that covered operators provide notice to parents, and thereafter obtain their verifiable consent prior to collecting personal information from children, the complaint alleges that Google and YouTube collected personal information in the form of persistent identifiers, such as cookies or unique device identifiers, that can be used to track users over time and across websites from the viewers of child-directed channels on the YouTube platform for behavioral advertising purposes. According to the complaint, Google and YouTube impermissibly effected this collection in the absence of parental notice and consent.

The complaint further alleges that Google and YouTube had actual knowledge that they were collecting personal information from viewers of child-directed channels. Per the complaint, Google and YouTube actively marketed YouTube as “a top destination for kids” to brands producing children’s products, such as Mattel and Hasbro, as evidenced by various Google presentations to the companies. Furthermore, Google and YouTube maintain a rating system that assigns (based on both automated and manual review) age-based ratings to every channel and video, including a “Y” rating, indicating such video is intended for viewers ages 0-7. Using Y and G (indicating such content is suitable for all ages) content derived from YouTube, Google and YouTube created a separate mobile application called “YouTube Kids,” which is targeted to children ages 2-12. The YouTube content that appears on the YouTube Kids home screen is specifically selected, following manual review by Google and YouTube. Thus, through their own review and curation, and indeed through their communications with specific channel owners, who are stated to have informed Google and YouTube that their content is targeted to children under 13, Google and YouTube, the complaint concludes, evidenced actual knowledge of the “child-directed nature” of these YouTube channels. Nevertheless, the complaint continues, they collected personal information, including persistent identifiers, from viewers of these channels without ever attempting to provide COPPA-compliant notice of their information collection to parents, or to obtain verifiable parental consent preceding any such collection.

According to the terms of the settlement, Google and YouTube must pay a total of $170 million in civil penalties, $136 million to the FTC, and $34 million to the NYAG. Other notable “fencing-in” provisions of the settlement require Google and YouTube to develop a system enabling channel owners to indicate whether their content is child-directed. As part of this system, Google and YouTube must provide notice to channel owners who are tasked with making the aforementioned designation that their child-directed content may implicate COPPA. Google and YouTube must also provide annual training on the subject of COPPA compliance to employees working with YouTube channel owners.

On the same day the settlement was announced, YouTube released a statement regarding upcoming changes, among others, to its data practices. Notably, starting in four months, YouTube will treat the data associated with any user viewing children’s content, notwithstanding that user’s actual age, as belonging to a child. YouTube also promised to stop serving personalized ads on children’s content. Finally, where the terms of the settlement merely require channel owners to designate their own content as child-directed, YouTube has also affirmed that it will use machine learning to identify child-directed videos.