Youtube has assumed an incredibly important role in society over the years, becoming the go-to place for entertainment and education for many. It’s the second most visited website on the internet, averaging over 82 billion views a month.

The NYTimes broke news earlier in August that research from Adalytics strongly suggested Youtube has been showing personalized ads to children as well as tracking their activity on the site without parental consent. Google, Youtube’s parent company, quickly came out with a statement disputing the findings, but make no mistake: these are serious accusations.

To make matters more complicated, the Federal Trade Commission (FTC), the American governmental agency that enforces federal-level data privacy laws, has previous experience disciplining Youtube. In 2019, the two sides reached a $170 million settlement over the video platform’s violations of the Children’s Online Privacy Protection Act (COPPA). 

COPPA, which seeks to protect children under the age of 13 from unwanted data processing practices, was passed in 1998. The law requires online websites, apps, and services to provide notice and obtain parental consent before collecting any personal information from known children. Under COPPA, things like names, addresses, dates of birth, IP addresses, and third-party cookies are all considered to be personal information (although the latter two are not stated directly). 

Youtube’s unique setup in having people who are not employees create their own channels and content on the platform meant the site was harder to police since only select content was geared towards children, but the 2019 settlement ironed out that loophole to bring the content giant under the COPPA umbrella. 

Despite only protecting children under the age of 13 (compared to the age of consent in the GDPR being 16 and many other date regulations setting that bar even to 18) COPPA is one of the most enforced data privacy laws on the books. In the past 12 months, the FTC has fined Epic Games $500 million over COPPA violations and issued warnings to several others. 

With increased legislative push globally to protect children’s data, including the recently enacted Digital Services Act in the EU adding further restrictions on processing children’s data, a high profile COPPA case could seriously damage a brand. 

And yet, Youtube is back in the regulatory spotlight just four years after its FTC settlement, now drawing all kinds of ire and demands from concerned parties. 

A bipartisan Senate coalition has written to the FTC demanding the organization investigate these allegations, stating, “YouTube and Google cannot continue treating young people’s data as an unprotected commodity from which to profit with abandon. Not only must the FTC Act, but Congress must also pass legislation to protect young people’s privacy online and finally ban targeted advertising to kids and teens.”

Advocacy groups have taken things farther, with a collection including the Center for Digital Democracy (CDD), Fairplay, Common Sense Media, and the Electronic Privacy Information Center (EPIC) publicly suggesting a fine worth over $10 billion if the allegations are proven true. 

These groups have tried to replicate the findings from the Adalytics report, and the results do not look good for Google. “Both Fairplay and the ad buyers ran test ad campaigns on YouTube where they selected a series of users of attributes and affinities for ad targeting and instructed Google to only run the ads on “made for kids” channels. In theory, these test campaigns should have resulted in zero placements, because under Google and YouTube’s stated policy, no personalized ads are supposed to run on “made for kids” videos. Yet, Fairplay’s targeted $10 ad campaign resulted in over 1,400 impressions on “made for kids” channels and the ad buyers reported similar results.”

In light of these findings, the advocacy groups have put forth recommendations to the FTC to remedy the problem, including:

• A full prohibition on the monetization of minors’ data
• A removal of all algorithms trained on impermissibly collected data
• A full separation of content on Youtube, with all child-centric content published only on Youtube Kids
• The creation of a special independent oversight position to monitor Google’s operations involving minors and report back to the FTC

After Youtube’s second alleged violation of COPPA within five years, the FTC must act, and a fine, no matter how large, will not satisfy critics. Senator Edward Markey, one of the main signatories behind the Senate letter to the FTC last week, has long tried to pass COPPA 2.0 to update the law in-line with 2023 internet practices.

Ironically, despite the dystopian nature of one of the planet’s richest companies illegally processing children’s data and using it for targeted ads on one of the planet’s largest content centers, this development might spur real momentum for COPPA 2.0 to become law. 

While we wait for the FTC to take up the case and come to a conclusion, a strengthened COPPA is only a hope, but with increased focus on protecting children’s data and a public violation of this scale, the stars might be aligned for regulatory change. 

It’s a shame it had to come at the expense of millions of children having their data monetized and manipulated.