TR Daily FTC, N.Y. Settle YouTube Child Privacy Probes for $170M
News
Wednesday, September 4, 2019

FTC, N.Y. Settle YouTube Child Privacy Probes for $170M

The Federal Trade Commission and the New York Office of Attorney General have reached a $170 million agreement with Google LLC and its YouTube LLC subsidiary to settle their investigations into allegations that YouTube violated the Children’s Online Privacy Protection Act by collecting personal information from children under the age of 13 without their parent’s consent and then used it for targeting advertising.

Of the total $170 million settlement, $34 million will go to New York and $136 million to the FTC.

The FTC’s decision on adopting the settlement was 3-2, with the two Democratic Commissioners dissenting on grounds that the settlement concessions were not strong enough, views echoed by Democrats on Capitol Hill, some of whom called for congressional action to strengthen children’s online privacy protections.

The complaint and settlement were filed with the U.S. District Court for the District of Columbia. The settlement is subject to court approval.

During a press conference this morning, FTC Chairman Joseph Simons and Consumer Protection Bureau Director Andrew Smith defended the settlement—which Mr. Simons said is 10 times larger than the monetary relief obtained in all previous FTC COPPA cases combined—as a good result, given the difficulty the agency would have faced in demonstrating that YouTube knew that the content in question was directed toward children. Under the COPPA statute, the content and channel creators on YouTube are strictly liable for COPPA compliance, but general audience platforms like YouTube are only liable if they had direct, actual knowledge of child-directed content, they said.

The settlement also requires YouTube to create a mechanism for content creators to designate whether their content is child-directed; to notify channel owners that their content may be subject to COPPA; provide annual training on COPPA compliance to YouTube employees who work directly with channel owners. It also contains provisions on document-production and interviews with YouTube employees to enable the FTC and New York Attorney General’s Office to audit compliance.

“Once our order has been effective for a period of time, the FTC will conduct a sweep of the YouTube platform … in order to determine if channels themselves are complying with COPPA,” Chairman Simons said.

Bureau Director Smith said that he was “a little saddened with the partisan divide” on the settlement, which he said is “very strong.” He added that both dissents “indicate that this is a strong settlement. … It’s just that they wish there was more of it.”

While some parties criticized the settlement for not requiring YouTube to destroy data previously collected, Mr. Smith said, “Under the order YouTube is prohibited from using this already collected data for any purpose.”

Mr. Smith also said that concerns that channels might have incentives to misidentify content as not child-directed are “valid,” but that “one response to that is that’s why we’re conducting the sweep. … There will be consequences for content creators that misdesignate, including being kicked off the YouTube platform.” He added that the FTC believes that YouTube “has strong incentives to police its platform,” both to avoid future enforcement against itself and to avoid having its platform degraded by repeated enforcement actions against channels that have become “fish in a barrel.”

Mr. Smith also disputed assertions that the settlement indicates relatively more lenient treatment of large firms like Google, especially with respect to the lack of individual liability under today’s announcement. He said individual liability is a tool to address the possibility that an owner might shut down a business and then open a new one using the same business practices, which is a risk that does not seem likely with a large company like Google or YouTube, he said.

Asked how the monetary figure was determined, Mr. Smith said that it was revenue-based, and the revenue numbers were proprietary, so all he could say was that it was “a multiple” of revenue determined to be linked to targeted advertising based on information collected from children without parental consent.

In a statement, New York AG Letitia James (D.) said, “Google and YouTube knowingly and illegally monitored, tracked, and served targeted ads to young children just to keep advertising dollars rolling in. These companies put children at risk and abused their power, which is why we are imposing major reforms to their practices and making them pay one of the largest settlements for a privacy matter in U.S. history. My office is committed to protecting children and holding those who put our kids in harm’s way—both on and offline—accountable.”

In a blog post today, YouTube said, “We are changing how we treat data for children’s content on YouTube. Starting in about four months, we will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user. This means that we will limit data collection and use on videos made for kids only to what is needed to support the operation of the service. We will also stop serving personalized ads on this content entirely, and some features will no longer be available on this type of content, like comments and notifications. In order to identify content made for kids, creators will be required to tell us when their content falls in this category, and we’ll also use machine learning to find videos that clearly target young audiences, for example those that have an emphasis on kids characters, themes, toys, or games.”

Mr. Smith told reporters that the FTC had concluded that placing a requirement in the settlement for YouTube to use machine learning would have been unenforceable, coming down to a battle of experts over whether the machine learning was effective, and that a court might decide that “a tie goes to the runner,” which, in this case, would be YouTube.

In his dissent, Commissioner Rohit Chopra said, “The terms of the settlement were not even significant enough to make Google issue a warning to its investors.” He added, “The approach in this matter is inconsistent with other children’s privacy enforcement actions against small companies, where individuals are closely scrutinized and settlement terms are crippling. This outcome reinforces my concerns that the Commission brings down the hammer on small firms, while allowing large firms to get off easier.”

In a redacted paragraph, Commissioner Chopra said that if the FTC had applied the same method for determining the financial penalty that it used in its 2012 settlement with Google, which was “more than five times the company’s unjust gains. … that would result in a target of [redacted] billion.”

Commissioner Chopra added, “If Congress enacts privacy legislation, it should not cut and paste COPPA’s approach to penalties. It should move away from vague factors for civil penalties and shift toward ones that are easier for agencies and courts to administer. There are many alternative approaches, such as requiring a minimum penalty per violation, adjusted upward if the violation is intentional or reckless. In addition, Congress should give all enforcers of any privacy law a robust set of enforcement tools, including penalties. In COPPA, state attorneys general can only seek forfeiture of ill-gotten gains and refunds to victims, but not financial penalties beyond that. In this matter, the New York Attorney General was unable to pursue civil penalties, since the FTC has exclusive authority to do so. This should change.

“Finally, Congress must address how mass surveillance and privacy intrusions can harm competition. YouTube dominates the online video marketplace, allowing it to tax content creators at massive rates. When companies ingest so much data, either by legal or illegal means, this data can be weaponized to increase barriers to entry for new platforms and businesses, allowing a dominant company to charge higher fees to those operating on their platform with less innovative features and services. Enforcers and honest businesses need the legal tools to redress harms to competition from poor privacy practices,” he said.

The other dissenting commissioner, Rebecca Kelly Slaughter, expressed concern about compliance and enforcement going forward.

“While we cannot know for certain how creators will respond to the prompt to designate their content, I imagine that many high-profile content creators identified in the complaint—especially those such as Mattel and Hasbro who make most of their money from selling toys rather than from advertising—will forthrightly designate all of their child-directed content as child-directed. They will do so even though the contextual advertising served instead is far less lucrative because they will accurately predict that their risk of COPPA liability for deceitfully designating their content is high,” Commissioner Slaughter said. “My concern is with the vast universe of content creators who will conduct a different cost-benefit analysis in which the perceived payoff of monetizing child-directed content through behavioral advertising outweighs the perceived risk of being caught violating COPPA. And that universe is indeed vast. Google marketed YouTube as the new ‘Saturday Morning Cartoons,’ but, unlike the Saturday morning cartoons of old, YouTube is not three channels—it is a virtually infinite smorgasbord of content with, according to recent estimates, more than 23 million channels that upload a combined 500 hours of video every minute,” she continued.

“Many if not most of those channels are located outside the United States and therefore likely beyond COPPA’s and the FTC’s practical reach. Many are small enterprises with opaque operations that would be difficult subjects to investigate. Under the order, they will all have to make a designation of whether their content is child-directed. In light of the steep financial cost of such a designation—and the low likelihood of COPPA enforcement for channels under the radar or originating outside of the United States—it is reasonable to anticipate that there will be significant deceit.

“And here is the heart of my objection: The order does not require YouTube to police the channels that deceive by mis-designating their content, such as by requiring YouTube to put in place a technological backstop to identify undesignated child-directed content and turn off behavioral advertising. True, a technological backstop is not explicitly mandated by COPPA’s text, but such a requirement would, I believe, be appropriate and necessary fencing-in relief. The order’s requirement that channel owners designate content as child-directed is also not required by COPPA, yet it is a good start to fencing-in relief, to which YouTube has consented, to redress YouTube’s own COPPA violations and reduce its facilitation of others’ violations. Fencing-in relief that goes beyond bare-minimum statutory requirements is a common and important aspect of effective Commission orders,” Commissioner Slaughter said.

“When it comes to fencing-in relief, the current order looks like a fence but one with only three sides. The missing fourth side is a mechanism to ensure that content creators are telling the truth when they designate their content as not child-directed. And such a mechanism is surely within YouTube’s mighty technological capacity. It already algorithmically classifies videos into age categories, as the complaint details with respect to ‘Y’-rated videos for ages 0–7. Applying the same or similar classifier to identify mis-designated child-directed content would provide an important technological backstop to the relief already in the order. Would such a classifier mechanism eliminate every last incorrect designation of child-directed content? Surely not. But, especially coupled with adequate training and progressive discipline for recidivist channels, it would fundamentally alter the incentive to profit illegally off of behavioral advertising to children, especially for channels unlikely to face enforcement action by the Commission, such as foreign channels,” she said.

Democrats in Congress were critical of the settlement.

In a joint statement, House Energy and Commerce Committee Chairman Frank Pallone Jr. (D., N.J.) and consumer protection and commerce subcommittee Chair Jan Schakowsky (D., Ill.) said, “YouTube’s illegal exploitation of children’s personal information was a betrayal of its users’ trust. The settlement imposed by the FTC should have done more to protect this vulnerable population going forward. That is why comprehensive federal privacy legislation is critical to provide clear protections and impose strict penalties on companies that abuse personal information, especially children’s information.”

House Judiciary antitrust subcommittee Chairman David Cicilline (D., R.I.) said, “Just a few weeks after the FTC gave Facebook a sweetheart deal, they’re now giving Google the same family and friends treatment. Google illegally harvested data from children on YouTube. They illegally and relentlessly targeted kids with ads. They knew what they were doing was wrong, but they did it anyway.”

Chairman Cicilline added, “The seriousness of this misconduct cries out for a serious penalty. In this regard, the FTC has failed to deliver. This fine is barely even a fraction of Google’s annual revenue. No single executive is being held accountable, and this settlement does nothing to change the incentives that led Google to break the law in the first place.

“The FTC is supposed to protect consumers, not powerful corporations. They failed to do that here,” Rep. Cicilline concluded.

Sen. Ed Markey (D., Mass.), a member of the Senate Commerce, Science, and Transportation Committee, said that the FTC “did not go far enough to put in place critical new rules for accountability. The FTC let Google off the hook with a drop-in-the-bucket fine and a set of new requirements that fall well short of what is needed to turn YouTube into a safe and healthy place for kids.”

Sen. Markey added, “The FTC should have issued a colossal fine that fits Google’s crime and demanded that Google make significant structural changes to their business practices for the sake of the millions of children who use Google every day. The FTC should have required Google to delete all data it has collected from children under 13 because it never should have amassed an untold amount of this data in the first place. The FTC should have prohibited Google from launching any new kids’ offerings before review and approval by independent experts because Google has forfeited the benefit of the doubt when it comes to putting kids’ well-being first. And the FTC should have required annual public audits into Google’s children’s privacy practices because parents deserve to know if this tech behemoth continues to track kids.”

He continued, “Where the FTC fails, Congress must act swiftly and strongly to pass new legislation for children online. We can start by passing my COPPA 2.0 legislation with Senator [Josh] Hawley [R., Mo.] that extends privacy protections to teens, creates an eraser button so that young users can eliminate personal information they’ve posted, and bans targeted ads directed at children. But we must look beyond privacy invasions to other pressing threats to children and teens online. I soon will introduce legislation to ban damaging website design features like auto-play that harm children, limit advertising and commercial content on child-directed platforms, and stop the amplification of dangerous and inappropriate content to kids [TR Daily, Aug. 23]. I call on my colleagues in Congress to join me in these efforts to keep the nation’s children and teens safe in today’s online ecosystem.”

Sen. Richard Blumenthal (D., Conn.), another member of the Commerce Committee, said, “A financial settlement is no substitute for strict reforms that will stop Google and other tech companies from invading our privacy—particularly when children are concerned. I continue to be alarmed by Big Tech’s policies and practices that invade children's lives. When companies like Google repeatedly break the law, the FTC must demand structural change and executive accountability. I am concerned that the divided vote reflects a lack of resolve and a lost opportunity to impose necessary accountability measures to rein in Google’s pattern of privacy abuses.”

Sen. Amy Klobuchar (D., Minn.), ranking member of the Senate Judiciary antitrust, competition policy, and consumer rights subcommittee, said, “It is unacceptable that Google and YouTube made millions of dollars by allowing companies to track and advertise to children under the age of 13 without their parents’ consent. A one-time penalty of $170 million for a company with profits exceeding $100 billion will not necessarily prevent this type of egregious behavior from happening again. In addition, the settlement places the burden on the companies that upload videos onto YouTube to identify content directed at children, but it places no responsibility on Google or YouTube to ensure that children aren’t being inappropriately targeted. It’s time for Congress to act.” —Lynn Stanton, [email protected]

MainStory: FederalNews NewYorkNews FTC Privacy InternetIoT

Back to Top

Interested in submitting an article?

Submit your information to us today!

Learn More