Google, YouTube reach $170M ‘groundbreaking’ settlement for violating children’s privacy

Under terms of the settlement, Google and YouTube will pay $136 million to the FTC and $34 million to New York for allegedly violating the Children’s Online Privacy Protection Act (COPPA) Rule. “The $170 million total monetary judgment is almost 30 times higher than the largest civil penalty previously imposed under COPPA,” FTC Chairman Joe Simons and Commissioner Christine Wilson said Wednesday in a joint statement announcing the settlement. 

In their complaint filed against Google and YouTube, the FTC and New York Attorney General allege YouTube violated the COPPA Rule by collecting personal information—in the form of persistent identifiers that are used to track users across the Internet—from viewers of child-directed channels, without first notifying parents and getting their consent. YouTube earned millions of dollars by using the identifiers, commonly known as cookies, to deliver targeted ads to viewers of these channels, according to the complaint.

The COPPA Rule requires child-directed Websites provide notice of their information practices and obtain parental consent prior to collecting personal information from children under 13, including the use of identifiers to track a user’s Internet browsing habits for targeted advertising. Third parties—such as advertising networks—are also subject to COPPA where they have actual knowledge they are collecting personal information directly from users of child-directed Websites and online services.

“The settlement’s provisions requiring a function for content creators to disclose whether the content is child-directed may have the perverse effect of allowing Google to pin the blame on content creators, even when they already know when YouTube videos are clearly for children.”

FTC Commissioner Rohit Chopra

“YouTube touted its popularity with children to prospective corporate clients,” Simons said. “Yet, when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were clearly directed to kids. There’s no excuse for YouTube’s violations of the law.”

The YouTube platform allows Google account holders, including large commercial entities, to create “channels” to display their content. According to the complaint, eligible channel owners can choose to monetize their channel by allowing YouTube to serve behaviorally targeted advertisements, which generates revenue for both the channel owners and YouTube.

In the complaint, the FTC and New York Attorney General allege that while YouTube claimed to be a general-audience site, some of YouTube’s individual channels—such as those operated by toy companies—are targeting children and therefore must comply with COPPA.

According to the complaint, the defendants knew YouTube had numerous child-directed channels. YouTube marketed itself as a top destination for kids in presentations to the makers of popular children’s products and brands. Several channel owners told YouTube and Google their channels’ content was directed to children, and in other instances YouTube’s own content rating system identified content as directed to children.

Additionally, according to the complaint, YouTube manually reviewed children’s content from its YouTube platform to feature in its YouTube Kids app. Despite this knowledge of channels directed to children, YouTube served targeted advertisements on these channels. According to the complaint, it even told one advertising company it did not have users younger than 13 on its platform and therefore channels on its platform did not need to comply with COPPA.

YouTube announces child privacy updates

 

Wednesday, YouTube CEO Susan Wojcicki announced in a blog post the following changes regarding kids and data protection on the platform:

 

• Limited data collection and use on videos made for kids, including the stopping of personalized ads and disabling of comments and notifications.
• Requirement for creators to signal content is geared toward kids, with machine learning to back it up.
• Reduction to the number of channels on the YouTube Kids app, and the introduction of a desktop version of YouTube Kids to encourage further use.
• The establishment of a $100 million fund, disbursed over three years, dedicated to the creation of thoughtful, original children’s content on YouTube and YouTube Kids globally.
• New, mandatory annual training championing protections YouTube has in place for children.

“Today’s changes will allow us to better protect kids and families on YouTube, and this is just the beginning,” Wojcicki said. “We know how important it is to provide children, families and family creators the best experience possible on YouTube and we are committed to getting it right.”

New rules put compliance onus on content creators

In addition to the monetary penalty, the proposed settlement includes strong new rules that go beyond the technical requirements of COPPA and could change YouTube’s business model going forward.

Under COPPA, third parties that host and serve ads on child-directed content—but do not themselves create the content—are not responsible for making inquiries about whether the content is child-directed. “This settlement now makes defendants responsible for creating a system through which content creators must self-designate if they are child-directed,” Simons and Wilson said in their joint statement.

“This obligation exceeds what any third party in the marketplace currently is required to do,” Simons and Wilson added. “It represents the first and only mandated requirement on a platform or third party to seek actual knowledge of whether content is child-directed.”

As such, YouTube has liability as a third party. When the Commission amended the COPPA Rule in 2013, it stated platforms are only responsible for child-directed content that appears on them if the platform possesses actual knowledge that it is collecting personal information from users of a child-directed site or service. “As detailed in the complaint, YouTube did possess actual knowledge as evidenced by its own marketing efforts, information received from channels, and its review of channel content to curate for the YouTube Kids App,” said Simons and Wilson.

Furthermore, the complaint requires Google and YouTube to:

• Develop, implement, and maintain a system that permits channel owners to identify their child-directed content on the YouTube platform so that YouTube can ensure it is complying with COPPA;
• Notify channel owners that their child-directed content may be subject to the COPPA Rule’s obligations and provide annual training about complying with COPPA for employees who deal with YouTube channel owners; and
• Provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.

Dissenting views

The Commission voted 3-2 to authorize the complaint. Those who dissented—Commissioners Rebecca Slaughter and Rohit Chopra—contend the FTC should have obtained more in the settlement, in terms of both injunctive provisions and monetary relief.

As to injunctive relief, Commissioner Slaughter would like to have seen the order include a technological backstop to identify undesignated child-directed content and turn off behavioral advertising. “Here is the heart of my objection: The order does not require YouTube to police the channels that deceive by mis-designating their content, such as by requiring YouTube to put in place a technological backstop to identify undesignated child-directed content and turn off behavioral advertising,” Slaughter stated. “True, a technological backstop is not explicitly mandated by COPPA’s text, but such a requirement would, I believe, be appropriate and necessary fencing-in relief.”

“The order’s requirement that channel owners designate content as child-directed is also not required by COPPA, yet it is a good start to fencing-in relief, to which YouTube has consented, to redress YouTube’s own COPPA violations and reduce its facilitation of others’ violations,” Slaughter added. 

In his dissent, Commissioner Chopra cited similar concerns. “I agree with Commissioner Slaughter’s assessment of the injunctive provisions of the settlement,” he wrote. “They are insufficient, and I would add that Google and YouTube made a business decision to allow behavioral advertising without human review.”

“The settlement’s provisions requiring a function for content creators to disclose whether the content is child-directed may have the perverse effect of allowing Google to pin the blame on content creators, even when they already know when YouTube videos are clearly for children,” Chopra added. “Absent an enforceable commitment from Google that it will fundamentally change its business practices to ensure that child-directed content is not subject to impermissible data harvesting, children will still be at risk.”

Chopra was also critical of what he saw as a monetary fine that was just a fraction of the revenue YouTube pulls in. 

“In my view the Commission often makes a low opening bid for monetary relief,” he said. ”Then, Commissioners point to litigation risk, lack of clear authority, and resource constraints to rationalize an outcome that allows a defendant to profit from the wrongdoing. Financial penalties need to be meaningful or they will not deter misconduct.”

In their joint statement, however, Simons and Wilson argued Commissioner Chopra’s dissent does not account for the “significant costs” the injunctive relief will impose on Google. “The company will be required to create a system for self-designation of child-directed content and train employees about that system and about COPPA’s requirements overall. None of the other platforms—Twitter, Facebook (including Instagram), Snapchat, Apple, Amazon, Netflix, or others—are required to implement such a system. No other advertising network is required to ask child-directed content providers to affirmatively assert whether they are child-directed,” they wrote.

Other COPPA efforts

The settlement is only one of several actions the Commission recently has taken to protect children online. In July 2019, the Commission announced it is seeking comment on the COPPA Rule and will be holding a public workshop on Oct. 7.

The FTC said it has initiated this workshop to seek comment on whether the Rule correctly articulates factors to consider in determining whether a Website or online service is directed to children; whether the Rule should be amended to better address Websites and online services that may not include traditionally child-oriented activities but have a large number of child users; and whether the Rule should be modified to encourage general audience platforms to identify and police child-directed content uploaded by third parties.