Google fined $170M for violating children's privacy

Google and subsidiary YouTube has been hit with a record $170 million fine by the Federal Trade Commission, to settle allegations the search company violated a law protecting children's privacy.

The fine is split into $136 million paid to the FTC and $34 million to New York, to end the investigation by the FTC and the New York Attorney General. The amount is the largest paid out for settling COPPA-related allegations.

It is alleged YouTube collected data on its youngest users and broke the law by not gaining consent from parents beforehand. The complaint further claims the collection was made via cookies, persistent identifiers which allowed YouTube and Google to target ads to viewers.

Google claims that YouTube is a general-audience site. But, since some channels are aimed at children, YouTube as a whole must comply with COPPA.

The Children's Online Privacy Protection Act (COPPA) is a rule that requires online services aimed at children to provide details of their information collection and usage practices, and to obtain parental consent before collecting any personal data for users aged under 13. The rules apply not only to sites and services, but also third parties like advertising networks, in cases where they know the age of the person they are profiling.

"YouTube touted its popularity with children to prospective corporate clients," said FTC Chairman Joe Simons. "Yet when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were clearly directed to kids. There's no excuse for YouTube's violations of the law."

Voted 3-to-2 in favor, the settlement also requires Google and YouTube to develop, implement, and maintain a system that allows channel owners to identify their content as child-directed, in order to ensure COPPA compliance. The channels must also be informed if their child-focused content may be subject to COPPS rules, and Google must also provide annual COPPA training to employees dealing with YouTube channel owners.

The settlement also requires both Google and Youtube to provide notice about their data collection practices and "obtain verifiable parental consent" before collecting personal information from children.

Following the settlement's announcement, a post has been published to the official YouTube blog outlining the new data practices for children's content, including limiting data collection to only information required to "support the operation of the service," and ceasing serving personalized ads on child-focused content. The post also notes updates affecting channel creators, including the use of machine learning to find videos that "clearly target young audiences."

It is also recommended for parents to use the YouTube Kids app if they plan to allow children under 13 to watch videos independently.