The Federal Trade Commission and New York Attorney General's office today announced that Google and its subsidiary YouTube agreed to an unprecedented $170 million in fines for allegedly using cookies to harvest personal data from minors without parental consent and then serve behavioral ads based on this information.
Such actions are in violation of the FTC's Children's Online Privacy Protection Act (COPPA) Rule, enacted in 1998. Under the terms of this regulation, website operators or online service providers that specifically cater to kids must provide public notice if they are collecting personal data from children and obtain their parents' permission. This includes browsing history data captured by cookies.
Typically, it's the actual content creators or service providers who are held liable for COPPA compliance. However, third parties that use cookies to serve targeted advertisements to websites are also subject to the law if they have actual knowledge that they are collecting information from users of child-oriented websites and online services -- as these users are most likely minors.
Consequently, in an official legal complaint filed in a D.C. district court, the FTC and the New York AG's office contend that YouTube and parent company Google violated COPPA by using cookies on individual YouTube channels that are specifically geared toward kids, including some operated by toy companies.
In prepared remarks at a press conference today, FTC Chairman Joe Simons said the $170 million judgment is 30 times larger than the next largest COPPA civil penalty in history, and three times larger than any privacy fine ever levied against Google around the world. A penalty of this magnitude sends a strong signal about the importance of children's privacy," said Simons.
Of the $170 million, $136 million will go to the FTC, while the remainder will be allocated to New York.
As part of the joint settlement, Google and YouTube have agreed to devise a system that will allow its channel owners to identify content aimed at children. "This is particularly significant because COPPA does not require platforms such as YouTube to determine whether the videos posted by others are directed to kids or not," Simons said. "Going forward, the companies will automatically have actual knowledge of, and COPPA liability for, all child-directed content designated through the mechanism. In this way, the order prevents the companies from turning a blind eye to the existence of kids’ content on YouTube."
Moreover, the two companies must notify channel owners that their content is subject to COPPA and provide COPPA training to employees who interact with these channel owners. "No other company in America is subject to these types of requirements, and they will impose significant costs on YouTube," Simons continued.
Google and YouTube have been given four months to comply to the above. The companies also must refrain from further disclosing, using or benefiting from children's data that was previously collected through cookies.
"Google and YouTube knowingly and illegally monitored, tracked and served targeted ads to young children just to keep advertising dollars rolling in," said New York Attorney General Letitia James, in a separate press release. "These companies put children at risk and abused their power, which is why we are imposing major reforms to their practices and making them pay one of the largest settlements for a privacy matter in U.S. history."
YouTube CEO Susan Wojcicki addressed the settlement in a blog post on her company's website.
"Responsibility is our number one priority at YouTube, and nothing is more important than protecting kids and their privacy," said Wojcicki in the post. "We've been taking a hard look at areas where we can do more to address this, informed by feedback from parents, experts, and regulators, including COPPA concerns raised by the U.S. Federal Trade Commission and the New York Attorney General that we are addressing with a settlement announced today."
"Starting in about four months, we will treat data from anyone watching children's content on YouTube as coming from a child, regardless of the age of the user. This means that we will limit data collection and use on videos made for kids only to what is needed to support the operation of the service," Wojcicki continued. "We will also stop serving personalized ads on this content entirely, and some features will no longer be available on this type of content, like comments and notifications. In order to identify content made for kids, creators will be required to tell us when their content falls in this category, and we’ll also use machine learning to find videos that clearly target young audiences, for example those that have an emphasis on kids characters, themes, toys or games."
The FTC voted 3-2 to authorize the complaint and stipulated order (settlement). All five commissioners were actually in favor of punishing Google and YouTube, but two of the commissioners did not think the penalties were severe enough.
In one dissent, Commissioner Rebecca Slaughter protested that the settlement "does not require YouTube to police the channels that deceive by mis-designating their content, such as by requiring YouTube to put in place a technological backstop to identify undesignated child-directed content and turn off behavioral advertising."
In another dissent, Commissioner Rohit Chopra opined that the Commission brings down the hammer on small firms, while allowing large firms to get off easier." Chopra also noted that "The terms of the settlement were not even significant enough to make Google issue a warning to its investors."
Multiple privacy organizations and children's advocacy groups agreed with the dissenters, including Campaign for a Commercial-Free Childhood (CCFC), the Center for Digital Democracy and the Electronic Privacy Information Center (EPIC). It was back in April 2018 that the CCFC and CDD filed an FTC complaint alleging COPPA violations on the part of YouTube. Twenty-one other privacy and consumer agencies officially supported the complaint, ultimately leading up to the federal agency taking action.
