The FTC and the New York Attorney General recently announced a record-setting $170 million ($136 million to the FTC and $34 million to the NY AG) joint settlement with Google. The settlement resolves allegations that YouTube violated the Children’s Online Privacy Protection Act (“COPPA”) and is the largest penalty the FTC has ever received in a COPPA case, easily dwarfing the agency’s next-highest $5.7 million settlement with TikTok.

In the complaint, the agencies alleged that YouTube violated the COPPA Rule because the site did not provide direct notice to parents of, or attempt to obtain verifiable parental consent prior to, collecting children’s personal information. Although the site markets itself as general audience and prevents users under age 13 from creating an account, the complaint alleged that YouTube had actual knowledge that it collected children’s personal information, including persistent identifiers, through the child-directed channels commercial entities operate on the site. This “actual knowledge” made YouTube an “operator” subject to the COPPA Rule.

The complaint also noted that, while identifying itself as a general audience platform not subject to COPPA, YouTube promoted its site as the “favorite website for kids 2-12” in pitches to toy companies and manually rated its content based on age group. Still, the company treated any content self-identified as child-directed similarly to any other content in terms of monetization and behavioral advertising practices.

The settlement’s injunctive provisions include:

1. Developing and implementing a system for channel owners to designate whether their content is child-directed;
2. Providing annual COPPA training for employees who manage child-directed channel owners;
3. Making reasonable efforts to ensure that parents receive direct notice of the collection, use, or disclosure of children’s personal information;
4. Posting prominently a link to that COPPA notice on any area of the site that collects children’s personal information;
5. Obtaining verifiable parental consent prior to collecting, using, or disclosing children’s personal information; and
6. Ceasing disclosing, benefiting from, or using any children’s personal information collected prior to the settlement within 90 days of the compliance date in January of 2020.

Although not specifically required by the settlement, YouTube also recently announced that it will be creating a site specifically for children’s content. Parents will be able to filter videos based on a child’s age, and track their children’s viewing history, and the site will not use behavioral advertising. Previously, the kids’ site was only available via mobile app.

Children’s privacy has been a hot topic recently, with the FTC announcing a request for comment on the COPPA Rule and legislators proposing updated COPPA legislation. Initial reports indicate that Congress sees this settlement as a slap on the wrist for the tech giant, as the total monetary penalty is allegedly less than two-days’ worth of profits for Google. Similar complaints were made after the FTC’s Facebook settlement, but it is left to be seen if disappointment with either settlement will be enough to push Congress to identify a new privacy enforcer via federal legislation.

[View source.]