The Law and Business of Social Media
September 11, 2019 - FTC, Data Security, Privacy, COPPA, Compliance

The Company Who Cried “General Audience”: Google and YouTube to Pay $170 Million for Alleged COPPA Violations

It’s 10 p.m. Do You Know What Your Third-Party Integrations Are Doing?

Last week, the Federal Trade Commission made clear that child-directed parts of an otherwise general audience service will subject the operator of the service to the Children’s Online Privacy Protection Act (COPPA).

Just six months after the FTC’s record-setting settlement against TikTok, the FTC announced a $170 million fine against Google and its subsidiary YouTube to settle allegations that YouTube had collected personal information from children without first obtaining parental consent, in violation of the FTC’s rule implementing COPPA. This $170 million fine—$136 million to the FTC and $34 million to the New York Attorney General, with whom the FTC brought the enforcement action—dwarfs the $5.7 million levied against TikTok earlier this year. It is by far the largest amount that the FTC has obtained in a COPPA case since Congress enacted the law in 1998. The settlement puts operators of general-audience websites on notice that they are not automatically excluded from COPPA’s coverage: they are required to comply with COPPA if particular parts of their websites or content (including content uploaded by others) are directed to children under age 13.

Background

The COPPA Rule requires operators of child-directed websites and online services to provide notice and obtain parental consent before collecting personal information from children under 13. The COPPA Rule was amended in 2013 to, among other things, expand the definition of “personal information” to include persistent identifiers that collect information about a user’s online activity and use that information to serve targeted ads to the user.

Allegations in the Complaint

According to the complaint, Google and YouTube allegedly used persistent identifiers, in the form of cookies and mobile-advertising identifiers, to collect personal information from, and track, viewers of child-directed YouTube channels across the internet without first notifying parents and obtaining their consent as required by COPPA. YouTube allegedly earned millions of dollars from using the information collected through these identifiers to deliver targeted ads to the viewers of child-directed channels and content.

  • Marketing Statements

While YouTube claimed to be a general-audience website, the FTC alleged that YouTube knew that its platform had numerous child-directed channels. The complaint cites several presentations to popular children’s brands in which YouTube marketed itself as a top destination for kids. For example, a YouTube presentation to the toymaker Mattel stated that “YouTube is today’s leader in reaching children age 6-11 against top TV channels,” and a presentation to Hasbro touted that “YouTube was unanimously voted as the favorite website for kids 2-12” and was the “#1 website regularly visited by kids.” At the same time, and notwithstanding these representations to toy companies, YouTube allegedly took the position that it did not need to comply with COPPA. For example, the complaint alleged that a YouTube employee wrote to an advertising company that YouTube did not have users under the age of 13 on the platform and that, as a general-audience platform, YouTube did not need to comply with COPPA.

  • Actual Knowledge

The complaint further alleged that YouTube had actual knowledge that it collected personal information from children, based on YouTube’s content-rating system and the “YouTube Kids” app. First, YouTube had a practice of rating all channels and videos uploaded to its platform with ratings of, among others, Y (generally intended for ages 0-7), G (intended for any age), and PG (generally intended for ages 10+); however, from an information collection and behavioral advertising perspective, YouTube allegedly did not treat Y-rated channels or videos any differently than it did other content on YouTube. Specifically, YouTube allowed channel owners to monetize Y-rated content and earn revenue from targeted advertising on Y-rated videos.

Second, the “YouTube Kids” app, aimed at children 2-12, generally drew from YouTube content rated Y or G on an automated basis. YouTube employees also manually reviewed content to appear on the home screen of YouTube Kids. Despite YouTube’s identification of content for YouTube Kids, the same content remained on the normal YouTube platform and used persistent identifiers for targeted advertising. In contrast, when the videos were viewed on YouTube Kids, persistent identifiers were not used. The complaint alleged that this disparity in treatment of the same child-directed content evinced YouTube’s knowledge that personal information was collected from children on its general-audience platform.

  • Operator of a Child-Directed Online Service

The complaint listed myriad examples of YouTube channels that were allegedly “directed to children” under the COPPA Rule, to show that YouTube was an operator of a child-directed online service and therefore subject to COPPA.

Assessing several channels against the COPPA Rule’s factors for determining whether a site is “child-directed” (i.e., subject matter, visual content, language, use of animated characters, or child-oriented activities and incentives), the FTC alleged that “numerous channels on YouTube have content directed to children under the age of 13.” Over five pages, the complaint went on to describe several child-directed channels, including, for example, Mattel’s channels (e.g., Barbie, Hot Wheels), CookieSwirlC (a popular children’s unboxing channel), and Little Baby Bum (a popular channel showing videos of well-known nursery rhymes).

Relief Imposed by the Order

In addition to the monetary penalty, the settlement requires Google and YouTube to develop, implement, and maintain a system that permits channel owners to identify child-directed content so that YouTube can ensure that it is complying with COPPA. YouTube must also notify channel owners that their child-directed content may be subject to the COPPA Rule’s obligations and provide annual training about COPPA compliance to employees who interface with YouTube channel owners. The settlement also requires YouTube to comply with the COPPA Rule by, for example, providing notice of its information practices and obtaining verifiable parental consent. In addition, the settlement imposes reporting and recordkeeping obligations.

The FTC voted 3-2 to authorize the stipulated consent decree. Notably, the two dissenting Commissioners dissented on the grounds that the settlement did not sufficiently punish Google and YouTube, arguing that the FTC should have sought even greater injunctive and monetary relief. Commissioner Rebecca Kelly Slaughter advocated the imposition of a technological backstop on Google’s and YouTube’s policing of YouTube’s channels and content, and Commissioner Rohit Chopra criticized the settlement amount and injunctive remedies as “not even significant enough to make Google issue a warning to its investors.”

Takeaway

With this record-breaking settlement following so close on the heels of the previous record-breaking settlement, federal and state regulators are showing a willingness to more aggressively pursue COPPA violations. In fact, the split vote for this consent decree suggests that certain regulators prefer an even more aggressive approach than has been seen to date. In conjunction with the FTC’s early review of the COPPA Rule, in which the FTC has solicited comments on how to encourage general-audience sites to proactively protect children’s privacy, it seems that regulators are increasingly focused on protecting children’s privacy in a world where the distinction between “child-directed” and “general-audience” is blurred.

As children’s use of technology keeps pace with technological advancements, companies operating online should be mindful of what content is posted on their sites and regularly evaluate their obligations, if any, under COPPA: They are required to comply with COPPA if particular parts of their websites or content (including content uploaded by others) are directed to children under age 13.