Google-owned YouTube is the focus of a new petition by a number of children’s advocacy groups, who allege that the platform has illegally collected data on children and want the United States Federal Trade Commission to investigate. One specific law, the Children’s Online Privacy Protection Act, sits at the center of the petition. The law essentially boils down to the prohibition of subjecting children under 13 years of age to the sort of data collection that YouTube and Google have as the backbone of their business models without parental consent. If the investigation and possible subsequent case all end badly for YouTube, it could be facing fines well into the tens of millions of dollars.
YouTube has yet to put out any official word on the petition as of this writing, but it has many protections in place to keep this sort of thing from happening. Unfortunately, no protection can be perfect, and YouTube could still be held liable if its protections are found to be inadequate in any way. Officially, children under 13 years of age cannot have their own Google accounts without family management, and even then, there are some services that they are unable to use, such as the full version of YouTube. The YouTube Kids app performs far less data collection than the full app, and the data that is collected pertains mostly to the device or Google service being used, along with device and user identifiers that allow a profile to follow the child from device to device. Things like location data, mobile phone number of a device accessing a service, and Google app usage data are all examples of the sort of data collected. The text of the COPPA law clearly states that persistent identifying information falls within the law’s purview.
Though a privacy notice for Family Link managed accounts does exist, the advocacy groups in the letter to the FTC are alleging that this is not adequate notice of these practices to constitute parental consent. A potential violation also lies in the fact that some data is collected on viewers without accounts, though not as much as those with accounts. Though creating an account is age-gated, simply watching is not, unless you try to watch content that has been flagged as potentially inappropriate for minors. It is also worth noting that it is entirely possible to fake your age when creating a Google account, or any other online account, and there are multiple ways to do it. Though COPPA only requires a good-faith attempt to verify a user’s age, this factor could come into play if there is an investigation.