YouTube fined $170 million for harvesting data from children

Google has agreed to pay $170 million in fines and bolster children’s privacy protections after regulators found that YouTube violated federal laws by collecting personal data from young users, and using that data to target them with ads.

The settlement comes about three years after the New York attorney general’s office first notified the Federal Trade Commission that YouTube, which is owned by Google, had apparently been violating federal privacy laws.

Regulators found that YouTube violated the Children’s Online Privacy Protection Act (COPPA), which requires websites to obtain parental consent before collecting any personal data from internet users under the age of 13. YouTube says its users must be 13 years or older to create accounts, but this rule is easily bypassed, and consequently, the video platform likely has millions of young users.

Similarly, there’s no shortage of child-directed content. Like all creators on YouTube who have enough subscribers, the creators of child-directed content can monetize their channels through two types of advertising: contextual or behavioral. Contextual ads are chosen based on the nature of the video or channel, while behavioral ads target specific users by utilizing their individual data, which has been tracked across the platform and other apps and websites.

Behavioral ads are almost always more profitable, both for YouTube and content creators. But targeting behavioral ads to users who are under 13 years old violates COPPA. YouTube was seemingly aware that many of its under-13 users were being targeted with behavioral ads but did nothing to prevent it.

“Google and YouTube knowingly and illegally monitored, tracked and served targeted ads to young children just to keep advertising dollars rolling in,” Letitia James, New York’s attorney general, said in a statement on Wednesday. “These companies put children at risk and abused their power.”

As part of the settlement, YouTube agreed to establish a new system that will require creators to designate when their content is directed toward children. For these videos, no behavioral ads will be allowed, no matter who’s viewing. The agreement also prohibits YouTube from using or sharing data from young users that it has already obtained unless a parent consents.

Some consider the settlement to be a slap on the wrist.

“Merely requiring Google to follow the law, that’s a meaningless sanction,” Jeffrey Chester, executive director of the Center for Digital Democracy, told The New York Times. “It’s the equivalent of a cop pulling somebody over for speeding at 110 miles an hour — and they get off with a warning.”

The FTC voted 3–2 in favor of the agreement, with both Democratic commissioners voting against. One of the Democratic commissioners, Rebecca Kelly Slaughter, criticized the agreement for failing to ensure that YouTube’s content creators, who are incentivized to enable behavioral ads, will tell the truth in designating their content as child-directed. YouTube, she argued, has the technological means to set up a system that could automatically detect videos that are directed toward children.

“The states could pursue an injunctive remedy that includes an enforceable promise of a technological backstop to keep content creators and YouTube honest about whether content is child-directed,” Slaughter wrote in a statement. “YouTube might insist that an algorithmic classifier should not be included because even better technology could soon eclipse it; I trust that the smart people who represent the states and YouTube alike would be able to draft an adaptable but enforceable provision that serves as the fourth wall to the fence that New York and the Commission have begun constructing.”

In a blog post, YouTube said it would use machine learning to automatically detect some portion of child-directed content. (Worth noting: It’s unclear whether such a system would inadvertently demonetize channels who’d complied with federal privacy laws and the platform’s guidelines. YouTube’s content creators, after all, have frequently criticized the platform for demonetizing channels – especially smaller – ones for ambiguous or unfair reasons.)

Still, the current agreement is likely bad news for many YouTube creators. That’s why the platform said it plans to direct $100 million toward creators of child-directed content over the next few years. Also, YouTube last week unveiled its YouTube Kids app, which offers only approved, family-friendly content for children.

What’s unclear is whether the $170 million fine — a relatively small penalty for one of the world’s most valuable companies — will nudge YouTube and other companies to bolster children’s privacy protections.

“Under COPPA, the children’s privacy law, the FTC had authority to impose tens of billions in fines against Google,” said the consumer advocacy group Public Citizen. “A penalty of no more than $200 million utterly fails to protect children’s rights. It neither punishes Google adequately nor deters Google or other companies from future violations.”