Advertising Law Blog

The FTC’s Children’s Online Privacy Protection Act (“COPPA”) Rule imposes certain obligations on operators of websites or online services directed to children under the age of 13 that collect, use and/or disclose certain personal information.  The FTC and NYAG alleged that YouTube’s conduct violated three key provisions of the COPPA Rule:

• First, a child-directed website or online service—or a site that has actual knowledge it is collecting or maintaining personal information from a child—must give clear notice on its site of “what information it collects from children, how it uses such information, and its disclosure practices for such information.”
• Second, the site or service must give direct notice to parents of its practices “with regard to the collection, use, or disclosure of personal information from children.”
• Third, before collecting personal information from children, COPPA-covered companies must obtain verifiable parental consent. COPPA’s definition of “personal information” specifically includes persistent identifiers used for behavioral advertising.  

The complaint alleged that, despite YouTube’s knowledge that certain channels on its platform were directed to children, the company tracked visitors to those sites without disclosing such practice and without obtaining parents’ verifiable consent.

In addition to the $170 million monetary judgment—to be paid to the U.S. Treasury and the State of New York—the proposed settlement requires YouTube and Google to: (i) notify channel owners that their child-directed content may be subject to the COPPA Rule; (ii) implement a system that allows channel owners to identify their content as child-directed so that YouTube can ensure COPPA compliance; and (iii) provide annual COPPA compliance training for employees.

Read the FTC announcement here.

Takeaway: Considering new laws, including the EU’s General Data Protection Regulation and California’s Consumer Privacy Act (effective January 1, 2020), and the FTC’s expanded enforcement of COPPA, companies must increase their awareness and compliance efforts when collecting, using or disclosing personal data that may belong to children.  It is important to note that the recent FTC settlement impacts not only those companies whose websites or online services specifically target or serve children but also those that merely collect personal information that may belong to children and have actual knowledge of such collection.