YouTube Agrees to Historic Fine for COPPA Violations; Channel Operators Put On Notice
by: Benjamin Stein
The Federal Trade Commission announced a sweeping settlement with tech giant Google and its subsidiary YouTube over privacy violations stemming from the alleged illegal collection of personal information from children. The settlement not only requires Google and YouTube to pay a total of $170 million in penalties ($136 million to the FTC and $34 million to the State of New York) for alleged violations of the Children’s Online Privacy Protection Act, popularly known as COPPA, but also to undertake substantial compliance obligations to apply COPPA protections to child-directed content on its service going forward. The FTC has also put operators of child-directed YouTube channels on notice that, if they don’t take measures to comply with COPPA, they could be next.
In a complaint filed against Google and YouTube in the U.S. District Court for the District of Columbia on the same day the settlement was announced, the FTC and the New York Attorney General alleged YouTube violated COPPA’s prohibition against the collection of personal information from children younger than 13 without their parents’ consent by using persistent identifiers (such as cookie identifiers and unique device identifiers) to track and follow kids’ online activities across the internet for purposes of serving targeted advertisements.
The FTC’s complaint alleged that many existing channels on YouTube’s platform were directed to children. The complaint also details how YouTube actively marketed its targeted advertising services to companies seeking to reach children, often touting YouTube’s immense popularity with children in its pitches to prospective advertisers.
Notably, the FTC does not seem to have gone so far as to conclude that the YouTube service is, as a whole, a child-directed service based on the amount of children’s content available. Instead, the complaint concludes that entities that run a child-directed YouTube channel are “operators” of a website or online service under COPPA because “they permit [YouTube] to collect personal information [from channel visitors], such as persistent identifiers” and they benefit from YouTube’s collection of that personal information via advertising revenue.
The complaint details how YouTube channel owners can monetize their content by permitting YouTube to serve ads to viewers, for which both the channel owner and YouTube earn money. By default, behavioral ads are enabled, though a channel owner can manually switch to contextual ads (i.e., those served based on the content of the page on which they’re shown and not on perceived interests of the ad target).
Under COPPA, an online service can “be deemed directed to children when it has actual knowledge that it is collecting personal information directly from users of another Web site or online service directed to children.” Here, the complaint alleged that YouTube had actual knowledge of numerous child-directed channels operating on its platform. The complaint alleges that YouTube acquired actual knowledge:
through the manual and automated review processes that YouTube uses to assign each uploaded video a rating (which included a “Y” rating for videos appropriate for children 0-7) and to curate content posted to the main YouTube service for its own child-directed YouTube Kids service; and
through direct communications with the channel owners in some cases.
The complaint alleges that YouTube acted as the operator of a child-directed online service subject to COPPA because it collected personal information (persistent IDs) from users of channels it had actual knowledge to be child-directed. When YouTube then used that personal information for behavioral advertising purposes – without fulfilling COPPA’s requirement that it first secure verifiable parental consent – it violated COPPA.
In addition to the combined $170 million judgment, the settlement also requires Google and YouTube to – within four months of entry of the settlement – implement a system by which channel owners must identify content as directed to children, notify channel owners that child-directed content is subject to COPPA, and provide internal training for Google and YouTube employees who interact with channel owners. Google and YouTube must also bring their own practices with regard to collection of personal information from a child-directed channel into compliance with COPPA and must discontinue using or benefitting from any personal information previously collected from any user of a YouTube channel designated child-directed by its owner within sixty days of YouTube unveiling the new content-flagging system required under the settlement.
YouTube channel owners have also been put on notice by the FTC, which announced that following the implementation of the settlement, it will conduct a sweep of YouTube channels directed to children to determine whether the channel operators are COPPA compliant. Companies and individuals that post child-directed content through a YouTube channel and currently monetize that content through behavioral advertising should promptly move to contextual advertising (or discontinue monetizing their content) and should plan to use YouTube’s tool to self-identify their content as child-directed once available. (If you are unsure if your content would be considered “directed to children” younger than 13, review the FTC’s COPPA FAQs for guidance and consult legal counsel.)
Less clear at this stage are the full ramifications of the FTC’s determination that the providers of child-directed content on a third-party platform can be considered the operators of their own COPPA-regulated online service based on that conduct without themselves collecting personal information from platform users. The YouTube settlement identifies some such parties as the “operators” of child-directed online services under COPPA because they benefited from YouTube’s collection of personal information from viewers of their content through the revenue share generated by YouTube’s behavioral advertising practices. Where the line is for this “benefit” analysis is not yet clear.
Companies publishing child-directed content on third-party platforms on which they do not control the advertising or other information-collection practices – even where the company does not directly monetize its child-directed content – may need to reevaluate their use of such platforms in light of the YouTube settlement.
Key Takeaways:
Companies should re-evaluate ANY content directed to children;
Companies should carefully consider the content they designate as “child-directed” or not;
Companies should ensure that they are not inadvertently collecting personal information through third-party platforms;
Companies should review their content, websites, and online services with regard to any third parties collecting data from users who are children; and
Companies should take another look at their channels and similar controlled content on other platforms and third-party websites for overall compliance issues.