The U.S. Federal Trade Commission is heralding its settlement with Google and its subsidiary YouTube as a historic moment and a "game changer" for enforcement under the Children's Online Privacy Protection Act.
"Google will pay a record $170 million to settle allegations by the Federal Trade Commission and the New York Attorney General that YouTube illegally collected personal information from children without their parents’ consent," the FTC said in its news release Wednesday.
It's the largest COPPA settlement ever obtained, and, noted FTC Chairman Joseph Simons at the FTC's press conference Sept. 4, "It's three times larger than any privacy penalty assessed against Google anywhere else in the world, and it is 10 times larger than the civil penalties we have obtained in all of our 31 prior COPPA cases combined." Simons added, "A penalty of this magnitude sends a strong signal about the importance of children's privacy."
Google and YouTube will pay $136 million to the FTC and $34 million to New York. The case holds Google and YouTube responsible for collecting children's information via cookies without getting parental consent, a violation of COPPA.
“YouTube touted its popularity with children to prospective corporate clients,” Simons said. “Yet when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were clearly directed to kids. There’s no excuse for YouTube’s violations of the law.”
Importantly, under COPPA, companies such as YouTube are not required to determine if videos posted by others, third parties, are directed at kids or not. But under the settlement, that changes. Going forward, "Google and YouTube will automatically have knowledge of, and COPPA liability for, all child-directed content designated through this mechanism. In this way, the order prevents YouTube and Google from turning a blind eye to the existence of kid's content on the YouTube platform."
According to the FTC and New York Attorney General, despite classifying itself as a "general audience site," Google and YouTube knew YouTube had channels directed at children, and YouTube even marketed itself as a "top destination" to prospective advertisers. "For example," the complaint alleged, "Google and YouTube told Mattel, maker of Barbie and Monster High toys, that 'YouTube is today’s leader in reaching children age 6-11 against top TV channels.'"
YouTube and Google will now be required to develop and maintain a system so that its channel owners, those posting content, can identify that their content is child-directed. The FTC did not specify the way the companies would need to do that, but today, along with a host of other changes, YouTube announced it would implement a machine learning tool to find content geared towards children on its site.
The complaint also alleges "YouTube manually reviewed children’s content from its YouTube platform to feature in its YouTube Kids app. Despite this knowledge of channels directed to children on the YouTube platform, YouTube served targeted advertisements on these channels."
The settlement requires YouTube to take measures to prevent targeted ads from being placed in content geared toward children and will forbid the company from using or benefiting from the personal data it has already collected, including uses permissible under COPPA.
The settlement isn't impressive to everyone at the FTC; it was a 3-2 split vote along party lines, with Democratic Commissioners Rohit Chopra and Rebecca Kelly Slaughter opposing.
Chopra said in a statement the fines are insufficient.
"The settlement’s provisions requiring a function for content creators to disclose whether the content is child-directed may have the perverse effect of allowing Google to pin the blame on content creators, even when they already know when YouTube videos are clearly for children. Absent an enforceable commitment from Google that it will fundamentally change its business practices to ensure that child-directed content is not subject to impermissible data harvesting, children will still be at risk."
In addition, Sen. Josh Hawley, R-Mo., who has introduced his own bipartisan legislation to update COPPA, expressed his dissatisfaction with the settlement on Twitter, tweeting, "Every day I lose more confidence in the FTC. This paltry fine is an insult to every parent in America who has had their children’s privacy violated. When big bureaucracy & Big Tech becomes allies, parents & families lose. Something has to change."
But Andrew Smith, director of the FTC's Bureau of Consumer Protection, said the fine is "staggeringly large in the privacy world and the COPPA world. I am a little saddened I have to say, by the partisan divide, personally. I think this is a really strong settlement, and I think this passes muster by anybody's standards."
To Slaughter, the problem is the lack of standards in place to be sure YouTube's self-policing of its channels is sufficient. What about content producers who claim the content is not geared toward children, when it actually is?
"The order does not require YouTube to police the channels that deceive by mis-designating their content, such as by requiring YouTube to put in place a technological backstop to identify undesignated child-directed content and turn off behavioral advertising. True, a technological backstop is not explicitly mandated by COPPA’s text, but such a requirement would, I believe, be appropriate and necessary fencing-in relief."
Notably, Slaughter's comments were released before YouTube announced, though without great specificity, it planned to implement machine learning to find violators. It's unclear at this point how effective such an algorithm will be.
Regardless, Simons defended the settlement's veracity, saying, "No other company in America is subject to these kinds of requirements, and they will impose significant costs on YouTube."
Chopra also took issue that the settlement did not hold individual executives liable, as the FTC sometimes does with violations of small businesses.
But Smith said the FTC takes an even-hand at enforcing both small and large businesses. He said generally individuals are held liable in a case if it's a concern that a small business owner in violation of a rule may simply shut down shop and move across the street and "do it again." He added, to prove a COPPA violation under civil penalty against individuals, the agency would have to prove an individual has actual knowledge.
"Actual knowledge can be a tricky thing to show and can be very fact-intensive," Smith said. "In this case, if we were to have gone to litigation ... we would have had to prove actual knowledge with respect to every single channel."
In response, YouTube announced Wednesday, in addition to implementing machine learning to catch child-geared content on the site, it would also make such changes as limiting data collection on videos aimed at kids to "only support the operation of the service," halting collection of personal data on that content and implementing machine learning to find videos that are specifically geared toward children.
YouTube isn't the only party that will do some hunting, however. The FTC announced it will also sweep YouTube in the coming months, to determine whether "child directed content is being properly designated as such in order to ensure that the channels themselves are complying with COPPA."
While Smith said the settlement with Google and YouTube is clearly the first battle of many COPPA enforcement actions, it's not to be overlooked.
"This is the importance of this case for me in additional historical penalty and injunctive relief, we are holding a platform liable under COPPA for content posted by somebody else. That’s a really big deal," he said. "And if you think about all the platforms in the world and the content they host, this is game changing.”
The settlement now goes to the U.S. Department of Justice for approval.
