YouTube may face billions in fines if FTC confirms child privacy violations

Four nonprofit groups seeking to protect kids' privacy online asked the Federal Trade Commission (FTC) to investigate YouTube today, after back-to-back reports allegedly showed that YouTube is still targeting personalized ads on videos "made for kids."

Now it has become urgent that the FTC probe YouTube's data and advertising practices, the groups' letter said, and potentially intervene. Otherwise, it's possible that YouTube could continue to allegedly harvest data on millions of kids, seemingly in violation of the Children's Online Privacy Protection Act (COPPA) and the FTC Act.

The first report alleging YouTube's noncompliance with federal laws came last week from Adalytics and was quickly corroborated by research from Fairplay, one of the groups behind the FTC letter, The New York Times reported. Both groups ran ad campaigns to test if YouTube was really blocking all personalized ads from appearing in children's channels, as YouTube said it was. Both found that "Google and YouTube permit and report on behavioral ad targeting on 'made-for-kids' videos, even though neither should be possible under COPPA."

Google spokesperson Michael Aciman told The New York Times that these reports "point to a fundamental misunderstanding of how advertising works on made-for-kids content."

"We do not allow ads personalization on made-for-kids content, and we do not allow advertisers to target children with ads across any of our products,” Aciman told The Times.

But in their letter, child advocates told FTC Chair Lina Khan that they have "serious questions" about whether Google is being honest about ad targeting. After running targeted ad campaigns, Fairplay reported that YouTube placed its behavioral ads on children's channels 1,446 times. If YouTube was operating in compliance with COPPA as it claimed, Fairplay said that these campaigns would have resulted in zero ad placements.

These impressions gleaned from Fairplay's ads represent only a small sliver of what groups—including Fairplay, the Center for Digital Democracy, Common Sense Media, and the Electronic Privacy Information Center—told the FTC that they see as a huge child privacy problem on YouTube in need of "robust remedies."

Currently, YouTube is under an FTC consent decree requiring COPPA compliance after already being hit with a $170 million penalty in 2019 for violating the child privacy law. This penalty was "the largest amount the FTC has ever obtained in a COPPA case since Congress enacted the law in 1998," the FTC said in 2019. But child advocacy groups now suspect that a second FTC probe into YouTube could result in a fine that dwarfs that 2019 record penalty. Their letter suggested that if millions of COPPA violations are discovered through the FTC probe, "the Commission should seek civil penalties upwards of tens of billions of dollars."

"If Google and YouTube are violating COPPA and flouting their settlement agreement with the Commission, the FTC should seek the maximum fine for every single violation of COPPA and injunctive relief befitting a repeat offender," Josh Golin, Fairplay's executive director, told Forbes.

Golin told Ars that when Adalytics released its report last week, he was surprised to see YouTube seemingly willing to "get its hand caught in the COPPA cookie jar again."

Golin told Ars that heftier fines may be needed to motivate YouTube to take more steps to protect kids on its platform. He recommended that instead of trusting YouTube to limit data collection, YouTube should be required to secure parental consent for all youth data collection—or cease monetizing youth data entirely.

Google did not immediately respond to Ars' request to comment.

Why the FTC might investigate YouTube

Golin told Ars that the FTC appears especially intolerant of tech companies repeatedly violating privacy laws. Fairplay found it encouraging when the FTC proposed a blanket prohibition preventing Facebook from monetizing youth data earlier this year after the tech company violated a 2020 privacy order.

His group's letter to the FTC recommended injunctions similarly preventing YouTube from monetizing any youth data, but also, and perhaps most importantly, "requiring YouTube to move all 'made for kids' videos to YouTube Kids and remove all such videos from the main YouTube platform."

Among the FTC commissioners who will consider child advocates' request is Rebecca Kelly Slaughter, who historically has seemed to have little confidence in YouTube's ability to uphold the consent decree.

In 2019, Slaughter wrote in a dissenting statement after the FTC's record settlement with YouTube that the video platform "is likely the online service that today hosts the most violations of COPPA." Her top concern then was that the consent decree "does not go far enough to ensure that child-directed content on YouTube will be treated in a COPPA-compliant manner."

At that time, Slaughter summarized YouTube's plan to remain compliant as:

YouTube and Google have agreed to ensure that, every time a video is uploaded to YouTube by a content creator, the content creator will have to designate the video as child-directed or not. For videos designated as child-directed, YouTube will not serve behavioral advertisements or track persistent identifiers. ... If YouTube does then serve behavioral advertisements using persistent identifiers or otherwise engage in tracking for such content, it will have violated both COPPA and the order.

In reports this month, Adalytics and Fairplay have alleged that YouTube is serving behavioral ads, employing persistent identifiers that could be used to track children on the platform, and possibly selling youth data. Fairplay's letter to the FTC asked the FTC to investigate four key areas of concern, probing whether YouTube illegally tracks users watching children's videos, serves personalized ads on children's videos, uses identifiers on children's videos that are then transmitted to third parties, and even possibly advertising its own products on children's videos.

So far, Google seems to be denying the relevance of these reports, though. Last week, a YouTube spokesperson told The Hill that Fairplay's report “makes completely false claims and draws uninformed conclusions based solely on the presence of cookies, which are widely used in these contexts for the purposes of fraud detection and frequency capping—both of which are permitted under COPPA.”

Child advocates have not directly accused YouTube of noncompliance with COPPA—that's for the FTC to figure out, their letter said.

“The FTC must launch an immediate and comprehensive investigation and use its subpoena authority to better understand Google’s black box child-directed ad targeting," Golin told The Hill.