YouTube fined $170m for covertly tracking kids online

YouTube can’t track kids online anymore without their parents’ permission, says the FTC – as it just fined the Google-subsidiary $170m to demonstrate just how serious it is.

The penalty follows a complaint filed by the FTC and the New York Attorney General that YouTube had violated the Children’s Online Privacy Protection Act (COPPA) Rule. Passed in 1998, the legislation advanced new rights for children under 13. It forced service providers to tell children what information they’re collecting and how they will use it, and get parental consent to do so. They must also enable parents to review the information collected and to prevent its further use.

YouTube failed at this. It used cookies to follow kids around the internet without getting consent from their parents to do so. This only happened with the regular YouTube service and not with YouTube Kids, the exclusively child-targeted service it launched in 2015.

The problem for YouTube was that some of its channels were specifically aimed at children and it marketed this to advertisers. It told Mattel:

YouTube is today’s leader in reaching children age 6-11 against top TV channels.

It bragged to Hasbro, referring to YouTube as “the new Saturday Morning Cartoons”, and also told the company:

YouTube was unanimously voted as the favorite website for kids 2-12

However, it also told another advertising company that fretted about COPPA:

We don’t have users that are below 13 on YouTube and platform/site is general audience, so there is no channel/content that is child-directed and no COPPA compliance is needed.

Under Wednesday’s settlement, YouTube must create a system for YouTube channel owners to designate their channels as targeting children. It must also train employees who deal with those channel owners in COPPA compliance. The company also has to notify parents that it wants to collect their children’s information and get their consent. The FTC also says that YouTube can’t use the information that it collected through child-targeted channels.

In a year, YouTube must report back on how it has prevented the tracking of children (including passive tracking, and the means for people to opt out of tracking). It also has to demonstrate how parents can review the information collected from their children, and how it lets them prevent the use of that data.

YouTube CEO Susan Wojcicki blogged that in four months the company will start treating data from anyone watching children’s content on YouTube as children’s data. It will limit data collection on those videos to just what’s needed to support the operation of the service, she said, and won’t deliver personalised ads on kid’s channels. She added:

We’ll also use machine learning to find videos that clearly target young audiences, for example those that have an emphasis on kids characters, themes, toys, or games.

Finally, the company will also spend $100m in the next three years on creating better children’s content on YouTube and YouTube kids.

Under the deal, Google will pay $136m to the FTC and $34m to the state of New York. $170m is a big chunk of change, and it’s the biggest fine that Google has shouldered to date, but it isn’t the company’s first tussle with the FTC. In 2012, it paid the agency $22.5m in a settlement over lying to Apple Safari users about not tracking them. And in 2011, it settled with the FTC over deceiving consumers and violating its own privacy policy during the launch of its social network, Google Buzz.