The settlement requires Google to pay $136 million to the FTC and an additional $34 million fine to New York state for allegedly violating the Children's Online Privacy Protection Act (COPPA) Rule.
The COPPA rule requires child-directed websites and online services to explicitly obtain parental consent before collecting personal information from children under the age of 13 and then using it for targeted advertising.
However, an FTC investigation [PDF] against Google's video service for children, called YouTube Kids, revealed that it had illegally gathered kids' data under 13.
Zero Trust + Deception: Learn How to Outsmart Attackers!
Discover how Deception can detect advanced threats, stop lateral movement, and enhance your Zero Trust strategy. Join our insightful webinar!Save My Seat!
The data also includes children' persistent identification codes used to track a user's Internet browsing habits over time without notifying their parents and getting their consent.
According to the regulators, YouTube earned millions of dollars by using that collected information to deliver targeted advertisements to viewers of these channels.
"YouTube touted its popularity with children to prospective corporate clients," FTC Chairman Joe Simons said. "Yet when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were directed to kids. There's no excuse for YouTube's violations of the law."
To settle the charges, YouTube agreed to pay a penalty of $170 million, with $136 million going to the FTC and $34 million to New York State.
The penalty is by far the most significant amount the FTC has ever obtained in a case involving the COPPA rule since Congress enacted this law in 1998. However, it is just a fraction of the $5 billion fine the FTC imposed on Facebook this year for privacy violations.
Besides the monetary fine, the proposed settlement also requires Google and YouTube to make changes to protect children's privacy on YouTube by:
Developing and maintaining a system that lets channel owners identify 'child-directed content' on the video-sharing platform so that YouTube can ensure it is complying with COPPA.
Notifying channel owners that their child-directed content may be subject to the COPPA Rule's obligations and provide annual training about complying with the law for employees who deal with YouTube channel owners.
In response to the fine, YouTube CEO Susan Wojcicki said that "nothing is more important than protecting kids and their privacy," adding that "we will limit data collection and use on videos made for kids only to what is needed to support the operation of the service."
Additionally, Wojcicki said YouTube would also "stop serving personalized ads on this content entirely, and some features will no longer be available on this type of content, like comments and notifications.