$170 million FTC-NY YouTube settlement offers COPPA compliance tips for platforms and providers

Had you asked yesterday, we would have said the largest financial remedy for violations of the Children’s Online Privacy Protection Act Rule was $5.7 million. Today’s $170 million total monetary judgment against YouTube and its parent company Google raises the stakes when it comes to COPPA compliance. Filed jointly with the New York Attorney General’s Office, the record-breaking FTC settlement offers three primary takeaways for other companies.

How popular is YouTube with children under 13? The answer YouTube gave depended on who was asking. When pitching its platform to companies selling kid-related products, YouTube described itself as “today’s leader in reaching children age 6-11 against top TV channels” and “the #1 source where children discover new toys + games.” YouTube also touted that it “was unanimously voted as the favorite website for kids 2-12” and that “93% of tweens visit YouTube to watch videos.” Many parents wouldn’t be surprised by that description.

But when an advertiser raised the issue of COPPA, a Google employee said this: “[W]e don’t have users that are below 13 on YouTube and platform/site is general audience, so there is no channel/content that is child-directed and no COPPA compliance is needed.” That statement would likely raise parental eyebrows. And it gets to the heart of where the FTC and the New York AG say YouTube violated COPPA.

Individuals and businesses that upload videos to YouTube can create channels to display their content. Of course, companies want viewers to watch what they’ve uploaded, but YouTube offers another way for businesses to make money through their channels. By default, YouTube enables behavioral advertising (also known as targeted advertising) on monetized channels. That means YouTube collects information about viewers of content in the form of persistent identifiers – for example, cookies that allow YouTube to track viewers over time and across websites – and uses that data to serve them tailored ads. The channel owner makes money from the advertiser and so does YouTube.

YouTube used that money-making model across its platform. That included channels geared to a general audience, but also channels YouTube knew were geared toward kids under 13. How did YouTube know? In some instances, channel owners told YouTube their content was directed to children. In other cases, YouTube’s own rating system identified content as kid-directed. And yet even with that knowledge, YouTube used persistent identifiers on channels directed to children – identifiers that allowed YouTube to track kids online, deliver them targeted ads, and make millions in the process.

Beginning in January 2016, YouTube offered channel owners the option to disable behavioral advertising and instead use contextual ads, a less precise method of anticipating ads to which a viewer might respond. But YouTube cautioned channel owners that turning off behavioral ads “may significantly reduce [the] channel’s revenue.” The unspoken concern was that it also would reduce how much money YouTube would make.

Congress enacted COPPA to make it clear that parents – not marketers – are in charge when it comes to whether companies can collect information from kids online. The FTC and the New York AG allege that YouTube’s behind-the-scenes conduct violated three key COPPA provisions.

First, under the COPPA Rule, a child-directed website or online service – or a site that has actual knowledge it’s collecting or maintaining personal information from a child – must give clear notice on its site of “what information it collects from children, how it uses such information, and its disclosure practices for such information.” Second, the site or service must give direct notice to parents of their practices “with regard to the collection, use, or disclosure of personal information from children.” Third, before collecting personal information from kids under 13, COPPA-covered companies must get verifiable parental consent. COPPA’s definition of “personal information” specifically includes persistent identifiers used for behavioral advertising. Importantly, third-party platforms are subject to COPPA when they have actual knowledge they’re collecting personal information from users of a kid-directed site. Therefore, the complaint charges that YouTube knew certain channels on its platform were directed to children and yet tracked visitors to those sites without disclosing that practice and without getting parents’ verifiable consent.

In addition to the $170 million judgment – which goes to the U.S. Treasury and the State of New York – the proposed settlement requires YouTube and parent company Google to notify channel owners that their child-directed content may be subject to the COPPA Rule. YouTube and Google also must implement and maintain a system that lets channel owners identify content as child-directed so YouTube can ensure it’s complying with COPPA. In addition, YouTube and Google must provide annual COPPA compliance training for employees who deal with channel owners.

What tips can other companies take from the settlement?

Content creators need to be conversant with COPPA. Do you upload child-directed content to platforms like YouTube for commercial purposes? The COPPA Rule may apply if you allow the collection of personal information from viewers of your content. That includes the collection of persistent identifiers used for behavioral advertising.

A warning to platforms: Actual knowledge that content is kid-directed kicks in COPPA obligations. If a platform hosting third-party content knows that content is directed to children, it’s illegal to collect personal information from viewers without getting verifiable parental consent.

Like real estate, a website can be “mixed use.” It’s fine for most commercial sites geared to a general audience to include a corner for kids. But if that part of your site collects information from users, you now have obligations under COPPA.

Check the Business Center’s COPPA portal for compliance resources.