YouTube May Know My Kids Better Than I Do: The FTC hits YouTube with large fine

This post is authored by Bridget Mead, a third-year student at Drexel University’s Thomas R. Kline School of Law. Ms. Mead is a legal-intern with the XPAN Law Group.

On September 4th, just as many parents were sending their kids back to school after a long summer break, the FTC announced its $170 million settlement with Google and YouTube for illegally collecting data from children without their parents’ consent in direct violation of the Children’s Online Privacy and Protection Act (COPPA).  Unbeknownst to the many parents who likely assumed YouTube was no more than a platform offering videos for children, some of them oddly intriguing, the video sharing service was, in fact, using cookies to deliver targeted advertising to viewers, including those children.

This is the largest FTC COPPA fine ever levied and comes more than twenty years after the statute’s enactment. COPPA went into effect in 1998 for the purpose of protecting the safety and privacy of children online by requiring parental authorization for the collection of children’s personal information online. This prohibition against unauthorized collection applies to any website or online service directed to children under 13 years of age that collects or uses personal information from children.

The FTC’s 19 page complaint provides ample proof that YouTube indeed is an online service that is directed to children under 13. The FTC supports its assertion that YouTube is required to comply with COPPA by quoting YouTube’s own words: in a presentation to toy brand Mattel, YouTube stated, “YouTube is today’s leader in reaching children age 6-11 against top TV channels.” See Complaint, para. 23. Similarly, YouTube referred to themselves as “the new ‘Saturday Morning Cartoons.” Id. These instances illustrate, the FTC argues, that YouTube not only provides a service directed to children under age 13, but they actively market themselves as doing such. YouTube earned millions of dollars and allowed channel owners to monetize their channels by delivering behaviorally targeted ads to their viewers through the use of cookies, collected by YouTube.

With the quantity of videos available and the quickness with which a child can switch from one video to the next, the tracking data collected from even one household about the children could be extremely invasive. Not only would the data show which videos were viewed the longest, but also what time of day and for how long YouTube is open and active, further invading the privacy of those children. As the FTC settlement provides, Google and YouTube must notify channel owners that any child-directed content may be subject to COPPA and as such, must provide a mechanism for the collection of consent from parents. 

In the wake of the settlement, YouTube has announced changes to its policies and procedures. On YouTube’s Official Blog, the company acknowledged the increase in the number of children who use the video sharing service, explaining that a “boom in family content and the rise of shared devices, “ increased “the likelihood of children watching without supervision.” YouTube further explained that they will treat data from anyone watching children’s content on YouTube as coming from a child, no matter the age of the user. This default assumption will require them to limit the data collection to only what is needed to operate the service. Additionally, they will be completely removing the ability to comment on videos and working to improve the YouTube Kids app by “raising the bar for which channels can be a part of YouTube Kids.” They provided a rough timeline of four months to implement these changes.

Despite the substantial fine and YouTube’s promises to revise its practices, not everyone is satisfied with the outcome of the settlement.  Senator Edward Markey(D-Mass.), a co-author of COPPA, quipped that “FTC Stands for ‘Forgetting Teens and Children’” in a statement reacting to news of the settlement. “The FTC pulled the curtain back . . . but did not go far enough to put in place critical new rules for accountability,” said Markey. He called the fine a “drop in the bucket,” for Google and expressed that he wishes the FTC would have “demanded that Google make significant structural changes . . . for the sake of millions of children who use Google every day.”

In the absence of a federal general data privacy law, the FTC’s enforcement of industry specific data privacy regulations like COPPA is crucial to consumer protection. COPPA is a particularly important regulation, protecting the privacy of the most vulnerable consumers, children. What was 10 years ago a rarity, children with tablets and other connected devices of their own, is now commonplace, increasing their online presence and requiring increased vigilance by the FTC. 

* * * * * *

Nothing contained in this blog should be construed as creating an attorney-client relationship or providing legal advice of any kind.  If you have a legal issue regarding cybersecurity, domestic or international data privacy, or electronic discovery, you should consult a licensed attorney in your jurisdiction.