On 4 September, the Federal Trade Commission (FTC) announced a fine would be imposed on Google for collecting the personal data of children through YouTube without the due consent of their parents.
YouTube’s fine amounts to 170 million dollars. In addition to that and as part of the agreement, Google and YouTube have committed themselves to develop, implement, and maintain a system that allows for the identification of content aimed at children to ensure compliance with US federal law under the Children’s Online Privacy Protection Act (COPPA).
This rule means that websites and online services directed to children under 13 must clearly describe the use and processing of their personal information, as well as obtain verifiable parental consent before proceeding to process the data from children. In UK law, the similar obligations imposed on online service providers are established in Article 8 of the GDPR and in Chapter 2 of the Data Protection Act 2018.
In the case of YouTube, despite having the YouTube Kids platform, exclusively aimed at children, the rules regarding children were breached by tracking the users and monetising the videos by showing personalised advertising on this platform. YouTube has also allowed children to post comments without the consent of their parents.
Parts of the doctrine as well as international experts have criticised the penalty for falling short. Just to get a rough idea: Alphabet earned $30.7 billion in profit last year, the vast majority of which came from behavioural advertising and targeted ads. Along the same lines, Pere Simón recently affirmed in a forum on security and privacy held in Toronto,
“Big Tech’s invasion of children’s lives is appalling. When companies like Google and YouTube repeatedly break the law and track kids online, the FTC must demand structural change and executive accountability—not just fines.”.
Pere Simón – DPO
That is to say that monetary sanctions, like this YouTube fine, are not enough since a financial penalty does not imply a real, structural change in the provision of services whose business model is based on a brutal lack of respect for privacy, as well as for the privacy of children. The inclusion of strong measures in the law aimed at increasing the responsibility of the executives of these large companies or at establishing structural changes in their business models could be a true solution in order to guarantee a level of respect and protection suitable to the requirements laid out in the GDPR.
Beyond the YouTube fine, there are still many questions in terms of the internet about how to guarantee that consent is obtained from the parents and not from the child.
