Practitioners’ Corner: The FTC is the COPPA on the Beat: The YouTube Settlement and What It Means for In-House Counsel
Practitioner’s Corner is a monthly focus on topics of interest to in-house counsel in the implementation of their privacy programs.
On September 4, 2019, the Federal Trade Commission (FTC) announced that Google and YouTube agreed to pay a total of $170 million for their failure to obtain verifiable parental consent before collecting online personal information, in the form of “persistent identifiers,” from children under 13. In-house counsel of organizations collecting information from children under 13 or have child-directed products or services should pay close attention to the implications of the YouTube settlement and to the FTC’s upcoming workshop on October 7.
This settlement and comments obtained through the workshop will inform any future FTC rulemaking that seeks to update the COPPA Rule, which the FTC last revised in 2013.
COPPA applies if an operator of a website or online service collects personal information online from children under 13. An operator does so if it has “actual knowledge” the person from whom it collects personal information is under 13, or manages a website or online service (or portion thereof) that is directed to children under 13 and collects personal information from users. Whether a website or online service is “directed” to children is a fact-specific inquiry.
For example, a website that has animated characters that appeal to children or child-oriented activities, language, and incentives likely would be “directed” to children.
YouTube Meets Operator Criteria
The FTC alleged that certain parts of YouTube’s service met these criteria. YouTube is an “operator” under COPPA because it manages a website and app. YouTube collected personal information because it used “persistent identifiers”—in this case, cookies or mobile advertising identifiers—to track users’ online activities to serve targeted advertising on YouTube and on third-party websites and apps.
Finally, YouTube had actual knowledge that it was collecting personal information from children under 13 because it curated children’s content intended for child audiences, applied or relied on content ratings for users under 13, and made statements to channel owners regarding the popularity of YouTube with users under age 13. (The FTC did not indicate whether each of these actions, standing alone, would have created “actual knowledge.”)
The YouTube settlement is notable because it is one of only two FTC COPPA enforcement actions against platforms (i.e., operators acting as service providers to other operators) – the other being InMobi PTE Ltd. Conversely, other past COPPA enforcement actions focused on website publishers and app developers that allegedly failed to implement COPPA’s notice and consent obligations.
Here are the key takeaways from the settlement:
An Operator Can Obtain "Actual Knowledge" From Context
The FTC alleged that YouTube gained actual knowledge it was collecting personal information from children under 13 through:
- Curating, via manual and automatic means, specific content for the YouTube Kids app that was drawn from content available on the general-audience YouTube platform;
- Creating content ratings, including ratings specific to children under 13, that it used to classify content automatically or through manual review; and
- Direct communications with channel owners that marketed YouTube’s popularity with children under 13.
Operators should proactively examine the content they may make available to users, their marketing statements, and other contextual factors to take a fresh look at whether their actions trigger COPPA. Operators take a risk if they assume they do not have actual knowledge simply because they do not collect users’ ages.
YouTube Became Subject to COPPA by Collecting Personal Information From Channels That It Knew Were Directed to Children
The FTC’s complaint alleged that YouTube triggered COPPA by collecting cookies and advertising IDs (i.e., personal information) on numerous channels directed to children. YouTube allegedly knew that those channels’ content was directed to children because it manually and automatically curated it for YouTube Kids.
This suggests that platform operators cannot passively permit third-party content to be uploaded to their websites or apps without pausing to consider its potential child-directed nature, especially if the operator decides to further curate the content. Instead, operators should be ready to investigate whether they have a COPPA compliance obligation if they discover third parties have uploaded child-directed content.
The FTC Imposed a Remedy That Placed the Burden to Comply with COPPA on YouTube, Not the Channels It Hosts
The settlement enjoins YouTube from “[f]ailing to develop, implement, and maintain a system for Channel Owners to designate whether their Content on the YouTube Service is directed to Children.” In other words, YouTube is now required to make a system available to channel owners to self-designate child-directed content, and if they do so, YouTube is obligated to either comply with COPPA before it collects personal information or cease collecting personal information from that channel. (YouTube committed to do this in its public statement.)
The FTC also required YouTube to notify channel owners that their child-directed content may be subject to COPPA.
COPPA was enacted in an era when consumers’ interaction with web-based services was simpler than it is today. This enforcement action and the FTC’s renewed focus on the COPPA Rule represent its latest effort to modernize COPPA.
In-house practitioners should stay ahead of the curve by freshly assessing the potentially child-directed nature of their client’s online service and examining their data maps to determine whether they collect personal information from children under 13. (As we frequently remind readers, data maps that precisely describe an organization’s collection, use, and disclosure of personal information are an invaluable tool for complying with privacy statutes!)