In a record-breaking settlement, Google agreed to pay $170 million in fines for violating the Child Online Privacy Protection Act and change how it gathers and stores information about how kids use YouTube.
YouTube, a Google subsidiary, collected personal information from children without their parent’s consent when it tracked users of channels directed at kids. It used this information to target ads at kids, earning millions in the process according to the complaint, filed jointly by the Federal Trade Commission and the New York Attorney General.
While it explicitly told advertisers that it could connect them with children (to Mattel: “YouTube is today’s leader in reaching children age 6-11 against top TV channels”) the company “refused to acknowledge that portions of its platform were clearly directed to kids,” FTC Chairman Joe Simons said in a statement.
The settlement is by far the biggest privacy judgment the company has ever paid, about three times a fine levied by the French Data Protection Authority earlier this year. It also dwarfs the previous largest fine in an FTC children’s privacy case, $5.7 million paid by TikTok earlier this year.
In addition to the money, YouTube will set up a system that asks channel owners to flag videos aimed at children. In a blog post, the CEO of YouTube said the company would also rely on artificial intelligence to identify children’s content.
YouTube also pledged to not place targeted ads on children’s content, gather data of anyone who watches it, and eliminate features like commenting that require the use of personal information.
That’s all well and good, but privacy advocates and the two Democrats on the five-person FTC don’t think the settlement goes far enough.
Commissioner Rohit Chopra wanted the settlement to hold company executives personally accountable for the data-mining. Commissioner Rebecca Kelly said the agreement didn’t go far enough to ensure YouTube would proactively identify children’s videos on its platform.
Jerffrey Chester, the executive director of the Center for Digital Democracy told the New York Times that simply requiring Google to follow the law was wholly inadequate. The CDD asked the FTC to “impose effective means for monitoring compliance” in the form of a 20-year consent decree that would mean much stricter monitoring than the company has ever faced.
The CDD also called the financial penalty “woefully low,” and it has a point. Google’s parent company made $38.9 billion in revenue during the second quarter of this year, so it’s difficult to argue that a $170 million fine comes close will have a big encouh impact to serve as a true deterrent to future violations.