Record $170mn Fine after Google and YouTube Abused Kids’ Privacy

Google and its YouTube subsidiary have agreed to pay a record USD170mn fine after admitting they illegally collected personal data from children without the consent of their parents. The penalty will be paid to the US Federal Trade Commission (FTC) and the New York Attorney General after they both accused Google and YouTube of violating the US Children’s Online Privacy Protection Act (COPPA).

The FTC’s announcement stated that:

YouTube violated the COPPA Rule by collecting personal information — in the form of persistent identifiers that are used to track users across the Internet — from viewers of child-directed channels, without first notifying parents and getting their consent. YouTube earned millions of dollars by using the identifiers, commonly known as cookies, to deliver targeted ads to viewers of these channels, according to the complaint.

The FTC also clarified how COPPA should be followed in practice.

The COPPA Rule requires that child-directed websites and online services provide notice of their information practices and obtain parental consent prior to collecting personal information from children under 13, including the use of persistent identifiers to track a user’s Internet browsing habits for targeted advertising. In addition, third parties, such as advertising networks, are also subject to COPPA where they have actual knowledge they are collecting personal information directly from users of child-directed websites and online services.

This led to a double standard within YouTube, where they knowingly promoted their ability to reach children through targeted content, whilst arguing that YouTube, when considered as a whole, is not uniquely directed towards kids. They hence benefited by tracking the behavior of children whilst claiming to be exempt from child protection rules by arguing their site serves a more general audience. This settlement establishes that much of the content on YouTube is specifically directed at kids, and so COPPA privacy rules apply to those portions of YouTube like they would to any website aimed at children. The FTC observed that:

…the defendants knew that the YouTube platform had numerous child-directed channels. YouTube marketed itself as a top destination for kids in presentations to the makers of popular children’s products and brands. For example, Google and YouTube told Mattel, maker of Barbie and Monster High toys, that “YouTube is today’s leader in reaching children age 6-11 against top TV channels” and told Hasbro, which makes My Little Pony and Play-Doh, that YouTube is the “#1 website regularly visited by kids.”

Several channel owners told YouTube and Google that their channels’ content was directed to children, and in other instances YouTube’s own content rating system identified content as directed to children. In addition, according to the complaint, YouTube manually reviewed children’s content from its YouTube platform to feature in its YouTube Kids app. Despite this knowledge of channels directed to children on the YouTube platform, YouTube served targeted advertisements on these channels. According to the complaint, it even told one advertising company that it did not have users younger than 13 on its platform and therefore channels on its platform did not need to comply with COPPA.

The settlement extends beyond the financial penalty and also requires significant changes to the way Google and YouTube do business.

…the proposed settlement requires Google and YouTube to develop, implement, and maintain a system that permits channel owners to identify their child-directed content on the YouTube platform so that YouTube can ensure it is complying with COPPA. In addition, the companies must notify channel owners that their child-directed content may be subject to the COPPA Rule’s obligations and provide annual training about complying with COPPA for employees who deal with YouTube channel owners.

The settlement also prohibits Google and YouTube from violating the COPPA Rule, and requires them to provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.

The FTC has five Commissioners, but only three approved this decision, whilst two opposed it. The supporters were Republicans: Chairman Joe Simons (pictured above) and Commissioners Christine Wilson and Noah Phillips. The settlement was opposed by the two Democrat Commissioners, Rohit Chopra and Rebecca Kelly Slaughter. This continued the disturbing American trend of every important decision relating to tech, comms, data and privacy resulting in a split along party lines.

Commissioner Noah Phillips wrote a standalone response that argued for the settlement whilst discussing the more general question of how to calculate an appropriate penalty when someone’s privacy has been violated.

Common sense also dictates that we punish more that which threatens more harm.

Improperly calibrated penalties can deter companies from exploring innovative and consumer friendly products and services; the risk may simply be too great. Even properly calibrated enforcement can impose costs. While the injunctive relief in this settlement will ensure that Google and YouTube comply with the COPPA Rule, it also will curtail behavioral advertising for child-directed programming. Because behavioral advertising generates more revenue than contextual advertising, our order may reduce content creators’ incentives to develop child directed programming. While kids may see advertising less tied to their Internet activity, they may also see less and lower quality content. In this case, this result is justified by COPPA, which is intended to safeguard children, who deserve special protection.

The privacy legislation Congress is now considering may address many privacy harms that not only result in little to no tangible consumer harm, but also are not experienced by a vulnerable class such as children. To account for the impact penalizing such harms may have, I believe that the Commission should consider consumer harm and that any penalty scheme crafted by Congress should balance a range of factors, including consumer harm, to permit the innovation and choice many consumers want.

In contrast, the dissenting statement of Commissioner Rohit Chopra focused on the frightening extent of Google’s influence.

It is important to evaluate the outcome of this investigation within the broader context of the market. With the majority of commerce and communications now happening online, Google’s reach has become unprecedented in both scale and scope. As one of the biggest platform companies in the world, Google wields enormous power to shape our lives and especially those of children. Google’s ever-expanding empire of online properties plays a key role in forming our children’s view of the world and their place in it.

It was only two weeks ago that one of Google’s most senior engineers argued that blocking cookies is bad for customer privacy. That disingenuous argument appears all the more ridiculous now that Google admits it used cookies to illegally monitor children.

Some mainstream commentators lambasted the FTC for being too soft on Google, describing the fine as ‘a pittance’ or ‘meager’, even though it was a record amount. Many also referred to Google’s apparent cynicism, and I would agree that Google is an extraordinarily cynical and self-serving enterprise. However, I would argue that Google became so cynical because many of the politicians and journalists that now side against their business were previously gushing, uncritical admirers. Were they gullible, naïve, or were they simply turning a blind eye to Google’s wrongdoing because it was fashionable to laud their success? No less a figure than President Obama described the USA as “the nation of Google and Facebook” in his 2011 State of the Union centerpiece speech.

What we can do – what America does better than anyone – is spark the creativity and imagination of our people. We are the nation that put cars in driveways and computers in offices; the nation of Edison and the Wright brothers; of Google and Facebook. In America, innovation doesn’t just change our lives. It’s how we make a living.

“A week is a long time in politics,” according to a saying attributed to British politician Harold Wilson. Some of the outspoken critics of Google should try to remember what they thought and said about the Californian tech superpower whilst it was still inventing the abuses that are now being punished. Perhaps you might also want to reconsider your previous feelings towards Google. Whilst you are thinking, you may also want to watch the following five-minute video of FTC Chairman Joseph Simons explaining this settlement to the press.

Eric Priezkalns
Eric Priezkalns
Eric is the Editor of Commsrisk. Look here for more about the history of Commsrisk and the role played by Eric.

Eric is also the Chief Executive of the Risk & Assurance Group (RAG), a global association of professionals working in risk management and business assurance for communications providers.

Previously Eric was Director of Risk Management for Qatar Telecom and he has worked with Cable & Wireless, T‑Mobile, Sky, Worldcom and other telcos. He was lead author of Revenue Assurance: Expert Opinions for Communications Providers, published by CRC Press. He is a qualified chartered accountant, with degrees in information systems, and in mathematics and philosophy.