If you’re in business and doing your business (or at least some of it) on the internet (and who isn’t doing some of its business on the internet these days?), then you should sit up and take a good look at the massive, behemoth, gargantuan, settlement that YouTube has agreed to pay for allegedly violating COPAA.
First, what is COPPA?
Well, its one of those famous legal acronyms for a federal law, kind of like ERISA and COBRA.
COPAA stands for “Children’s Online Privacy Protection Act. And the Rule that was promulgated by the FTC based on COPPA is called the “COPPA Rule.” It appears in Code of Federal Regulations at 16 CFR Part 312.
And what COPPA generally provides is that online businesses are prohibited from getting information from internet users on their sites who are under the age of 13 without the express permission of a parent.
What YouTube is alleged to have done is violated COPPA by collecting personal information—in the form of persistent identifiers that are used to track users across the Internet—from viewers of child-directed channels, without first notifying parents and getting their consent. According to the FTC, YouTube earned millions of dollars by using the identifiers, commonly known as cookies, to deliver targeted ads to viewers of these channels.
In order to settle the case brought against it by the FTC, YouTube agreed to pay that whopping amount of $170 million ($136 million to the FTC and $34 million to the State of New York).
In addition to the $170 million penalty payment, the settlement between the government and YouTube requires Google and YouTube to develop, implement, and maintain a system that permits channel owners to identify their child-directed content on the YouTube platform so that YouTube can ensure it is complying with COPPA. In addition, the companies must notify channel owners that their child-directed content may be subject to the COPPA Rule’s obligations and provide annual training about complying with COPPA for employees who deal with YouTube channel owners.
The settlement also prohibits Google and YouTube from violating the COPPA Rule, and requires them to provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.
So, what’s the lesson to be learned for small and mid-sized businesses that do business on the internet?
Well, it is simply this: before you collect data from persons under the age of 13, make sure you have parental consent to do so. Or better yet, just don’t collect data from persons under the age of 13. Bottom line: review the provisions of COPPA and the COPPA Rule, make sure you’re familiar with it, and strictly comply with its provisions!
$170 million is a lot of money to anybody–even YouTube. But if you’re like most people, a massive, whopping fine of a gazillion dollars, give or take, might make your day a bit more challenging.