×

YouTube, Google To Pay $170M For Collecting Children’s Personal Data Without Parents’ Consent

NEW YORK — Google LLC and YouTube LLC have agreed to pay $170 million in a national settlement, $34 million of which will go to New York state, for violating the Children’s Online Privacy Protection Act by specifically tracking and serving targeted advertisements to users watching videos directed to children under the age of 13 on YouTube.

“Google and YouTube knowingly and illegally monitored, tracked, and served targeted ads to young children just to keep advertising dollars rolling in,” said Letitia James, state attorney general. “These companies put children at risk and abused their power, which is why we are imposing major reforms to their practices and making them pay one of the largest settlements for a privacy matter in U.S. history. My office is committed to protecting children and holding those who put our kids in harm’s way – both on and offline – accountable.”

Congress enacted COPPA in 2000 to protect the online privacy of young children. COPPA prohibits operators of certain websites from collecting, using, or disclosing personal information (e.g. first and last names, e-mail addresses, etc.) of children under the age of 13 without first obtaining parental consent. Operators of websites and online services directed to children under the age of 13, and the operators of websites and online services that have actual knowledge that they are collecting personal information from users of other websites directed towards children under the age of 13, are subject to COPPA.

In July 2013, the definition of “personal information” was revised to include persistent identifiers that can be used to recognize a user over time and across websites, such as the ID found in a web browser “cookie” or an Internet Protocol (IP) address. The revision effectively prohibits covered operators from using cookies, IP addresses, and other persistent identifiers to track users across websites for most advertising purposes, to amass profiles on individual users, or to serve online behavioral advertisements on COPPA-covered websites.

Google and YouTube’s marketing materials have stated that YouTube is the “favorite website for kids 2-12” and the “#1 website regularly visited by kids.” Many of YouTube’s channels even self-identify in their “About” section as specifically intended for children. Additionally, Google and YouTube have actual knowledge that many of the channels and videos on the YouTube platform are directed towards children: through communications with channel owners (e.g., the owner of the “Barbie” and “Monster High” channels specifically informed Google and YouTube that their channels are directed towards children under the age of 13) and through manual and automated reviews of channel content (e.g., Google and YouTube review and rate all videos uploaded to YouTube, as well as channels as a whole, according to a content rating system that categorizes video content into age groups – Y for ages 0-7, G for all ages, PG for ages 10 and up, Teen for ages 13 and up, MA for ages 16 and up, and X for ages 18 and up).

Eligible channel owners on YouTube are able to monetize their channel by allowing Google and YouTube to serve advertisements to viewers. When a channel owner monetizes a channel, Google and YouTube, by default, track viewers of the channel using viewers’ cookies or mobile advertising identifiers and serve advertisements that are specifically tailored to those viewers’ inferred interests. COPPA effectively prohibits this type of tracking and online behavioral advertising when Google and YouTube have actual knowledge that the content is directed towards children younger than 13-years-old.

In a prior investigation into violations of COPPA, the office discovered that a well-known channel owner had repeatedly informed Google and YouTube that its videos were directed to children younger than 13-years-old.

The investigation found that Google and YouTube knowingly and illegally tracked and served targeted advertisements to children under the age of 13 on YouTube in violation of COPPA. The companies have agreed to injunctive provisions and reforms to their practices in an effort to prevent further violations of COPPA, including:

• Developing, implementing, and maintaining a system for users to designate whether the video content they have uploaded is directed to children;

• Notifying users that content directed towards children on YouTube may be subject to the COPPA Rule, and that users who have uploaded such content are obligated to designate it as child-directed;

• Providing annual COPPA compliance training to employees responsible for managing relationships with users that upload content to YouTube; and

• Obtaining verifiable parental consent before any collection, use, and/or disclosure of personal information from children.

• Google and YouTube have also agreed that personal information previously collected from children can no longer be used.

The Federal Trade Commission also obtained $136 million today in penalties.