On Dec. 4, 2018, the New York Attorney General (AG) announced that media giant and AOL successor Oath Inc. (Oath), a subsidiary of Verizon Communications, Inc., agreed to pay nearly $5 million to settle charges that its online behavioral advertising (OBA) auctions violated the Children’s Online Privacy Protection Act (COPPA). The AG found that AOL collected, used, and disclosed personal information about children under 13 without obtaining prior parental consent. The AG specifically charged that AOL conducted more than one billion auctions for advertising space on websites the company knew targeted children under 13. COPPA was enacted to protect this age group from being tracked online and targeted by advertisers.

Under COPPA personal information includes, among other data, persistent identifiers that can be used to recognize a user over time and across different websites, such as cookie or device identifiers, IP addresses, and geolocation information. COPPA applies to websites and online services directed at children under 13 as well as those that are directed at a general audience if the operator of the site or service has actual knowledge it is collecting information from these children. COPPA also applies to advertising networks that collect personal information on third-party sites directed towards children under 13. The AG alleged that AOL knew the ad space auctions were for websites AOL knew were directed to children under 13. So when AOL collected persistent identifiers and geolocation information related to these children without getting prior parental consent and shared it with advertisers during OBA auctions, AOL violated COPPA and the AG stepped in.

In addition to the fine, under the terms of the settlement, Oath is required to take a number of steps. Specifically, it must:  (i) destroy all personal information regarding children younger than 13; (ii) implement a functionality that enablers website operators that sell ad inventory through Oath systems to indicate each site or portion of a site that is subject to COPPA and maintain this information in a database and disclose to each third-party bidder that relevant ad space is subject to COPPA; (iii) create and implement a comprehensive COPPA compliance program that includes designating an executive or officer to oversee the program; (iv) conduct annual employee training; (v) design and implement controls to address identified risks and regularly monitor the effectiveness of the controls; and (vi) select and retain service providers that are COPPA compliant.

Takeaways:

• The amount of the settlement, the largest ever under COPPA, demonstrates the continued interest among consumer protection authorities, including, significantly, those at the state level, in enforcing COPPA and protecting children from the exploitation of their personal information in the increasingly crowded advertising ecosystem.
• In addition to the fine, the terms of the settlement demonstrate that the costs of non-compliance can be more costly than conducting a COPPA assessment and implementing measures to avoid triggering COPPA.

Operators of websites and online services should be aware that COPPA that empowers state Attorneys General to initiate COPPA actions.  With the FTC’s increased focus on competition, state attorneys general may prioritize COPPA enforcement. Since 2007 AGs in California, New York, and Texas have brought COPPA actions on behalf of their citizens.