In the largest settlement pertaining to children’s privacy, Google LLC and its subsidiary YouTube LLC on September 4 agreed to pay $170 million to settle charges by the Federal Trade Commission (FTC) and the New York Attorney General (NYAG) for illegally collecting personal data from children without their parents’ consent and serving them with targeted advertising in violation of the Children’s Online Privacy Protection Act, 1998 (COPPA).
COPPA requires websites and online services directed to children under the age of 13 years to provide notice of their information practices and obtain parental consent prior to collecting personal information from children, including using persistent identifiers to track a user’s Internet browsing habits for targeted advertising. This requirement also applies to advertising networks and any third parties that have actual knowledge that they are collecting personal information from the child-directed websites and online services.
In the complaint filed by the FTC and NYAG, it was alleged that the video-streaming company used identifiers or cookies to track the users of hosted channels directed to child audience, and collected personal information from the child-viewers without first notifying and obtaining their parents’ consents as required by COPPA. YouTube allegedly used this personal information, which included children’s Internet browsing habits, to deliver targeted advertisements to the underage viewers of these channels that are created by Google account holders, including commercial entities such as toy companies, who use the YouTube platform to display their content. By delivering behaviorally targeted ads to child-viewers of child-directed channels without obtaining parent consents, YouTube and channel owners violated the privacy of children while benefitting from increased viewership and revenue. The FTC and NYAG presented ample evidence that YouTube and the channel owners had knowledge of the viewership and popularity of child-directed channels on YouTube platform.
In the wake of this settlement, platforms must now implement systems to permit content creators to identify their child-directed content on the platform so that the platform can ensure compliance with COPPA. Further, platforms are now obligated to actively notify the owners of hosted channels that their child-directed content may be subject to COPPA. In this regard, such platforms are required to train their employees in compliance with COPPA so that the employees can identify such child-directed content. Besides these measures, platforms may also need to develop ways to identify channels and content directed to young audiences so as to mitigate the risk of hosting them inadvertently or without proper notice by the channel owner. As a result of this settlement, we may see significant changes in YouTube’s privacy safeguards and marketing strategies with respect to child-directed content, so as to meet the raised bar that COPPA now holds. In particular, YouTube is expected to treat any data from child-directed channels that are notified as such and those that YouTube itself identifies through machine learning, as subject to COPPA.
In sum, not only is this landmark deal a significant boost to children’s privacy on the Internet, but it is also an acknowledgement that the obligation to protect children’s privacy applies not only to those who create online content but also to the platforms that host it.