In a record-breaking settlement, Google agreed to pay $170 million in fines for violating the Child Online Privacy Protection Act and change how it gathers and stores information about how kids use YouTube.
YouTube, a Google subsidiary, collected personal information from children without their parent’s consent when it tracked users of channels directed at kids. It used this information to target ads at kids, earning millions in the process according to the complaint, filed jointly by the Federal Trade Commission and the New York Attorney General.
While it explicitly told advertisers that it could connect them with children (to Mattel: “YouTube is today’s leader in reaching children age 6-11 against top TV channels”) the company “refused to acknowledge that portions of its platform were clearly directed to kids,” FTC Chairman Joe Simons said in a statement.
The settlement is by far the biggest privacy judgment the company has ever paid, about three times a fine levied by the French Data Protection Authority earlier this year. It also dwarfs the previous largest fine in an FTC children’s privacy case, $5.7 million paid by TikTok earlier this year.
In addition to the money, YouTube will set up a system that asks channel owners to flag videos aimed at children. In a blog post, the CEO of YouTube also said the company would use artificial intelligence to identify children’s content.
YouTube pledged to not place targeted ads on children’s content, gather data of anyone who watches it, and eliminate features like commenting that require the use of personal information.
That’s all well and good, but privacy advocates and the two Democrats on the five-person FTC don’t think the settlement goes far enough.
Commissioner Rohit Chopra wanted the settlement to hold company executives personally accountable for the data-mining while Commissioner Rebecca Kelly said the agreement didn’t go far enough to ensure YouTube would proactively identify children’s videos on its platform.
Jerffrey Chester, executive director of the Center for Digital Democracy told the New York Times that simply requiring Google to follow the law was wholly inadequate. The CDD asked the FTC to “impose effective means for monitoring compliance,” a 20-year consent decree that would amount to much stricter monitoring than the company has ever faced.
It also called the financial penalty “woefully low,” and they have a point. Google’s parent company made $38.9 billion in revenue during the second quarter of this year, so it’s difficult to argue that a $170 million penalty is a true deterrent to future violations.