Examining COPPA and the Google-YouTube Settlement

  • Published on Oct 9, 2019
Written by: Innovative Driven

On September 4, 2019 the Federal Trade Commission (FTC) announced that Google and its subsidiary YouTube agreed to “pay a record $170 Million to settle allegations by the Federal Trade Commission and the New York Attorney General that the YouTube video-sharing service illegally collected personal information from children without their parents’ consent” (the “Google-YouTube Settlement”).
[1] Specifically, the FTC and the State of New York (NYS) jointly alleged that YouTube violated the Children’s Online Privacy Protection Act (COPPA) Rule by collecting personal information from minors under the age of 13 by persistent identifiers, commonly known as cookies, to deliver targeted behavioral advertising to children on a variety of “child-directed” YouTube channels. This article examines the COPPA Rule, the FTC and NYS action against Google and YouTube, and the immediate and foreseeable impacts of the Google-YouTube Settlement.

What is COPPA?

The Children’s Online Privacy Protection Act of 1998
[2] and associated FTC COPPA Rule
[3] impose several requirements on two categories of “operators” of websites and online services: 1) operators whose services are directed to children under 13 years of age, and 2) operators whose who have actual knowledge that they are collecting personal information from a child under 13 years of age. The requirements placed on these operators include:

  1. Providing notice to parents of:
    1. what information is collected from children,
    2. how that personal information is used, and
    3. the service operator’s disclosure practices for such information;
  2. Obtaining verifiable parental consent for the collection, use or disclosure of a child’s personal information (“PI”), including the option for consent for the collection and use of the child’s PI without consenting to the disclosure of that PI to third parties;
  3. Providing an identified parent, upon request:
    1. a description of the specific PI collected from their child,
    2. opportunity to opt-out of:
      1. further use or retention of collected PI from that child, and
      2. future collection from that child,
    3. reasonable means to obtain any PI collected;
  4. Prohibiting conditioning participation in-game, offering of prizes, or other activities upon a child’s disclosure of PI; and
  5. Establishing and maintaining reasonable procedures for protecting the confidentiality, security, and integrity of PI collected from children.
    [4]

COPPA came into effect on April 21, 2000, following the FTC issuance of its final Rule (16 CFR Part 312) on October 20, 1999.

The Google-YouTube Settlement

On September 4, 2019, the Federal Trade Commission and the Attorney General of the State of New York jointly filed a complaint in the District Court of the District of Columbia asserting that in numerous instances defendants Google and YouTube, jointly and severally, “collected, used, and/or disclosed personal information from children in violation of the [COPPA] Rule…” (the “Complaint”).
[5]  Specifically, defendants were accused of failing to provide sufficient notice to users of their privacy practices regarding children, failing to provide direct notice to parents of the collection of PI about their children, and failing to obtain verifiable parental consent before collection or use of PI from children. Plaintiffs alleged, inter alia, that the defendants promoted and directed targeted behavioral advertising towards children under the age of 13, rewarding YouTube content creators (a/k/a Channel Owners) for selecting the use of behavioral advertising to monetize their content.  The government further alleged that YouTube told potential advertisers that its platform was the best means to reach children and that was not subject to COPPA.  Moreover, the FTC and NYS alleged that defendants willfully targeted content to children under 13 and had actual knowledge that content was being viewed by children, thus placing them squarely within the scope of the Rule.

Along with the Complaint, the parties simultaneously filed their proposed Stipulated Order.  Without admitting or denying any of the allegations in the Complaint, defendants Google and YouTube accepted civil penalties along with multiple injunctions and ongoing compliance reporting and monitoring obligations.

The civil penalties totaling $170 Million certainly received the most attention, with $136 Million going to the FTC and $34 Million to the State of New York.  But to put it in perspective, Alphabet, the Google parent company, recorded 2018 profits of a little over $30.7 Billion, or $84.2 Million per day.  That was on an income of $136.8 Billion. Thus, while this civil fine for a COPPA violation was certainly the largest to date by far, Google was fined less than 2 days of revenue, and merely 9 hours of income.  The real impact on Google and YouTube resides in the stipulated injunctions and the compliance and monitoring provisions.

To start, Google and YouTube are required to develop, implement, and maintain a system for creators to designate whether their content is directed to Children, as well as provide annual training regarding compliance with COPPA for all personnel who manage the channel creator relationships. Secondly, defendants are required to make reasonable efforts to ensure that proper notices are provided to parents, notices of the defendants’ information practices are prominently and clearly linked on home pages or landing screens, and verifiable parental consent is obtained, all in accordance with the COPPA Rule. Finally, defendants are ordered to refrain from disclosing, using, or benefiting from any PI previously collected from children.

In addition to the injunctions, Google and YouTube agreed that for the next 5 years, a copy of the order must be delivered to all executive management, along with employees, agents and representatives responsible for COPPA enforcement, and that must obtain and keep a signed and dated acknowledgment of receipt from each individual.  Further, defendants agreed to submit detailed annual reporting to the FTC and NYS for the next 10 years relating to their compliance with the injunctions. Concurrently, defendants stipulated to long term records keeping requirements, as well as monitoring and the use of ongoing civil discovery, without leave of the court, under Federal Rules of Civil Procedure 29, 30, 31, 33, 34, 36, 45 and 69.  Finally, the companies agreed to permit the FTC and NYS to directly request interviews with employees (with counsel present), and to allow FTC and NYS agents to pose as consumers, suppliers, or other individuals or entities to covertly monitor the defendant’s compliance.

Immediate and Foreseeable Impacts of the Settlement

The most immediate and direct visible impact of the settlement is that when logging into YouTube (at least on a Roku device), users are now requested, although not required, to login with a saved, registered Google account, or as a Guest. Users are not, at the time of this writing, presented with any challenge to determine if they are an adult or a child under 13.   Additionally, at this time this is no option for allowing a child under 13 to select an existing child profile created under a Google family account.  As a result, a child must currently either select a parent’s account from the list of saved accounts or enter as a guest.  Under either option, that child will be subject to behavioral advertising without any notice to a parent or attempt at obtaining verifiable parental consent.

The stipulated injunctions do not specify a grace period for compliance, other than for terminating use of the prior collected PI of children, which must stop within 90 days of entry of the order. I expect will see further changes over the next two to three months.

What are the foreseeable longer-term impacts of the settlement?  First, companies that are subject to COPPA, but have made little to no effort at compliance to date, are likely to begin a review of their options.  It is likely that many companies have made some effort to segregate child-directed content from adult content, but have, like YouTube, failed to focus on the core notice-consent requirements.  Either they’ll resolve those issues promptly or face potentially significant fines and injunctive orders in line with this settlement.

Takeaways

COPPA requires the process and execution of notice-consent obligations.  However, as I’ll discuss in greater detail in my next post, COPPA is NOT designed to stop the buying and selling of children’s personal information. A company that wants to profit off the collection, use, and widespread distribution of PI of children under 13 are free to do so as long as they follow the rules for providing proper fair information notices, specifically required parental notices, and securing verified parental consent.  If your company provides services that fall within the scope of COPPA, now is the time to bring in some experts to take a look at your systems and procedures for fulfilling your notice and consent obligations. If you have been letting this slide due to a lack of enforcement actions, now it is definitely the time to get your house in order.

[1] Fed. Trade Comm. et al v. Google et al, Doc. 2-1 (Stipulated Order for Permanent Injunction and Civil Penalty Judgment), Case 1:19-cv-02642 (D.D.C.) (Sept. 4., 2019), available at:
https://www.ftc.gov/system/files/documents/cases/172_3083_youtube_coppa_consent_order.pdf.

[2] 15 U.S.C. §§ 6501-6508.

[3] 16 C.F.R. §312

[4] 15 U.S.C. § 6502 (2019), 16 C.F.R. §312.

[5] Fed. Trade Comm. et al v. Google et al, Doc. 1 at 17 (Complaint for Permanent Injunction Civil Penalties, and other Equitable Relief), Case 1:19-cv-02642 (D.D.C.) (Sept. 4., 2019), available at:
https://www.ftc.gov/system/files/documents/cases/youtube_complaint.pdf.