COMMENT IT'S COPPA-CATED: PROTECTING CHILDREN'S PRIVACY IN THE AGE OF YOUTUBE - Houston Law Review
←
→
Page content transcription
If your browser does not render page correctly, please read the page content below
58 HOUS. L. REV. 965 (2021)
COMMENT
IT’S COPPA-CATED: PROTECTING
CHILDREN’S PRIVACY IN THE AGE OF
YOUTUBE
ABSTRACT
The Federal Trade Commission (FTC) levied its largest fine
to date under the Children’s Online Privacy Protection Act
(COPPA) against YouTube in 2019. In addition to paying the fine,
YouTube agreed to make several changes to its platform in an
effort to improve compliance with the law. Almost simultaneously,
the Commission announced its intent to revise the COPPA rule
and requested comments from stakeholders. This Comment seeks
to explain the shortcomings of the FTC’s enforcement action
against YouTube and offer some proposals for sensible COPPA
reforms.
TABLE OF CONTENTS
I. INTRODUCTION ............................................................. 966
II. BACKGROUND ............................................................... 967
A. A Primer on COPPA Mechanics ........................... 967
1. Purpose and Definitions. ............................... 967
2. Website Categories. ........................................ 969
3. FTC Enforcement Mechanisms. .................... 971
B. COPPA as Applied to YouTube ............................. 972
J.D. Candidate 2021, University of Houston Law Center. I would like to extend
my gratitude to the editorial staff of the Houston Law Review for their hard work on this
Comment. Thanks are due to Professor Amanda Watson for her encouragement throughout
the writing process. I am eternally grateful to my family and friends for their support
throughout my time in law school; I would not have made it this far without them.
96558 HOUS. L. REV. 965 (2021)
966 HOUSTON LAW REVIEW [58:4
C. FTC v. YouTube .................................................... 974
D. YouTube’s Policy Changes Following the
Settlement ............................................................. 976
III. COPPA REFORM ........................................................... 978
A. Content Directed Towards Children ..................... 978
B. Rebuttable Presumption that Children Are the
Users of Child-Directed Websites .......................... 981
C. Enable Children’s Content Creators to Monetize
Their Content by Incentivizing the Safe Harbor
Framework ............................................................ 983
IV. CONCLUSION ................................................................. 985
I. INTRODUCTION
The Children’s Online Privacy Protection Act (COPPA)
directed the Federal Trade Commission (FTC) to promulgate rules
to protect children’s privacy and data on the internet, and to vest
decision-making authority about what to do with that data in the
hands of parents. In September 2019, the FTC and YouTube
entered into the largest monetary settlement under COPPA to
date for violations of the existing rules.1 Following the settlement,
the FTC announced in July 2019 that it would begin accepting
comments on possible revisions to the COPPA rule.2
The notice and comment period generated over 175,000
comments from industry groups, content creators, privacy
advocates, government officials, and other interested parties.3 The
battle lines have largely been drawn in this case. YouTube (and its
parent company, Google), trade groups, and content creators
believe the rules are overly inclusive and will result in a drastic
decrease in revenue for child-appropriate content. Any hit to the
1. Press Release, Fed. Trade Comm’n, $170 Million FTC-NY YouTube Settlement
Offers COPPA Compliance Tips for Platforms and Providers (Sept. 4, 2019), https://www.ft
c.gov/news-events/blogs/business-blog/2019/09/170-million-ftc-ny-youtube-settlement-offer
s-coppa [https://perma.cc/AZW4-WENQ].
2. Press Release, Fed. Trade Comm’n, FTC Extends Deadline for Comments on
COPPA Rule Until December 9 (Oct. 17, 2019), https://www.ftc.gov/news-events/press-relea
ses/2019/10/ftc-extends-deadline-comments-coppa-rule-until-december-9 [https://perma.cc/
M5RF-J9HU].
3. See Fed. Trade Comm’n, Request for Public Comment on the Federal Trade
Commission’s Implementation of the Children’s Online Privacy Protection Rule,
REGULATIONS.GOV (July 24, 2019), https://www.regulations.gov/document/FTC-2019-0054-
0001 [https://perma.cc/7PH2-6JJ7].58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 967
pocketbooks of content creators is likely to result in an
environment where high-quality, child-appropriate content is
simply no longer available because of a lack of incentive to develop
it. Privacy advocates on the other side argue that the stringent
protections are necessary in order to protect children’s online
identities. The rule should be strengthened given the embedded
nature of the internet in our daily lives.
This Comment will begin by explaining the major features of
COPPA and the COPPA rule. Next, this Comment will explore the
unique nature of YouTube and the difficulties of COPPA
compliance for a platform that relies on third-party content
creators. The next Part will outline the arguments for
strengthening and loosening the rule and will assess their
strengths and weaknesses. Finally, this Comment will suggest
some prescriptive measures that the FTC should take prior to
amending the rule.
II. BACKGROUND
A. A Primer on COPPA Mechanics
1. Purpose and Definitions. The drafters of COPPA sought
to achieve four goals with the enactment of the bill: (1) empower
parents to protect the privacy of children online; (2) protect
children’s safety in their use of online channels; (3) ensure the
security of children’s personally identifiable information; and
(4) require parental consent when collecting personal information
from children.4
The Act directed the FTC to promulgate rules requiring
website and online service operators to obtain “verifiable parental
consent” when the website has actual knowledge that the user is
a child.5 The FTC issued the first iteration of the “COPPA rule” in
1999, taking effect in April 2000.6 Since the bill was enacted,
internet use among children and teens has increased
dramatically.7 Further, tablets and mobile devices have changed
4. 144 CONG. REC. 23926 (1998) (statement of Sen. Bryan).
5. 15 U.S.C. § 6502(b)(1)(A).
6. Press Release, Fed. Trade Comm’n, New Rule Will Protect Privacy of Children
Online (Oct. 20, 1999), https://www.ftc.gov/news-events/press-releases/1999/10/new-rule-wi
ll-protect-privacy-children-online [https://perma.cc/89B3-P3KE].
7. Compare ERIC C. NEWBURGER, U.S. CENSUS BUREAU, HOME COMPUTERS AND
INTERNET USE IN THE UNITED STATES: AUGUST 2000, at 2 (2001), https://www.census.gov/
prod/2001pubs/p23-207.pdf [https://perma.cc/CT3N-8L6H] (citing Census Bureau data58 HOUS. L. REV. 965 (2021)
968 HOUSTON LAW REVIEW [58:4
the way children play, learn, communicate, and entertain
themselves.8 The FTC issued the final round of amendments to the
rule in 2012, taking effect in 2013.9 The 2013 revisions expanded
the categories of data collected that qualify as personal
information, in addition to extending the types of websites covered
by the rule.10 While the FTC normally reviews rules and
regulations every ten years,11 the agency announced in July 2019
that the rule would be reviewed for revisions and opened the floor
for public comments.12 The proposed topics for comment included
the verifiable parental consent requirement, the correct factors for
determining whether a website qualifies as child-directed, and
whether smart TVs and video games fall under the guise of the
rule, among others.13
The COPPA rule defines a child as any person under the age
of thirteen.14 Operators of websites or online services are
prohibited from collecting15 personal information16 from children
indicating 19% of children aged three to seventeen used the internet at home in 1998), with
Computer and Internet Access in the United States: 2012, U.S. CENSUS BUREAU (Aug. 24,
2016), https://www.census.gov/data/tables/2012/demo/computer-internet/computer-use-20
12.html [https://perma.cc/76XK-VPPQ] (indicating 62% of children accessed the internet at
home in 2012).
8. While TV still dominates “screen time” of both teens and tweens, “mobile devices
now account for 41 percent of all screen time among tweens and 46 percent among teens.”
COMMON SENSE MEDIA, THE COMMON SENSE CENSUS: MEDIA USE BY TWEENS AND TEENS
16 (2015), https://www.commonsensemedia.org/sites/default/files/uploads/research/censu
s_researchreport.pdf [https://perma.cc/X75C-TUEX]. Teens spend over half of their time on
computers and mobile devices playing games, browsing the internet, using social media,
video chatting, texting, and creating content. Id.
9. Press Release, Fed. Trade Comm’n, FTC Strengthens Kids’ Privacy, Gives
Parents Greater Control Over Their Information by Amending Childrens Online Privacy
Protection Rule (Dec. 19, 2012), https://www.ftc.gov/news-events/press-releases/2012/12/ft
c-strengthens-kids-privacy-gives-parents-greater-control-over [https://perma.cc/T6R4-N5P
Q].
10. Id.
11. See generally Retrospective Review of FTC Rules and Guides, FED. TRADE
COMM’N, https://www.ftc.gov/enforcement/rules/retrospective-review-ftc-rules-guides [http
s://perma.cc/SLT2-9P7X] (last visited Feb. 6, 2021).
12. Lesley Fair, New Block on the Kids? FTC Announces COPPA Review and
Workshop, FED. TRADE COMM’N: BUS. BLOG (July 17, 2019, 3:29 PM), https://www.ftc.gov/ne
ws-events/blogs/business-blog/2019/07/new-block-kids-ftc-announces-coppa-review-worksh
op [https://perma.cc/BE4E-WG52].
13. Request for Public Comment on the Federal Trade Commission’s Implementation
of the Children’s Online Privacy Protection Rule, 84 Fed. Reg. 35842, 35843 (proposed July
25, 2019) (to be codified at 16 C.F.R. pt. 312).
14. 16 C.F.R. § 312.2 (2020).
15. “Collection” is defined as gathering personal information by any means, including
passive tracking using cookies. Id.
16. “Personal information” is defined in the rule and includes names, physical or
electronic addresses, and geolocation information. Id. The rule was amended in 2013 to58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 969
if the website is directed towards children17 or the operator has
actual knowledge a child is using the site or service,18 unless the
operator has obtained verifiable parental consent.19 Operators are
also required to take “reasonable steps” to ensure that when a
child’s personal information is shared with third parties, that
those third parties are also COPPA-compliant.20
2. Website Categories. For purposes of COPPA compliance,
the FTC specifies that there are three categories of websites:
(1) child-directed websites; (2) general audience websites; and
(3) mixed audience websites.21 A website qualifies as child-
directed based on the subject matter of content, the visual
appearance of the website, the site’s marketing practices, and data
regarding the actual users of the site.22 Websites that qualify as
child-directed are subject to the restrictions on collection of
personal information and are subject to heightened privacy
requirements.23 Under the COPPA rule, child-directed websites or
cover “persistent identifiers”—indicia that it can be used to identify “a user over time and
across different Web sites or online services.” Id.
17. The rule provides that the FTC will consider various factors to determine if a site
is directed towards children, including:
[I]ts subject matter, visual or audio content, age of models, [presence of child
celebrities or celebrities who appeal to children], language or other characteristics
of the website or online service, as well as whether advertising promoting or
appearing on the website or online service is directed to children. The Commission
will also con-sider competent and reliable empirical evidence regarding audience
composition; [and] evidence regarding the intended audience[.]
Id.; see also infra Section III.A for further discussion.
18. Id. § 312.3.
19. Verifiable parental consent (VPC) may be obtained via methods outlined in the
rule. Id. § 312.5(b). The FTC has also approved additional methods of obtaining VPC. See
Verifiable Parental Consent and the Children’s Online Privacy Rule, FED. TRADE COMM’N,
https://www.ftc.gov/tips-advice/business-center/privacy-and-security/verifiable-parental-
consent-childrens-online-privacy-rule [https://perma.cc/LSJ5-6BNQ] (last visited Feb. 6,
2021).
20. 16 C.F.R. § 312.8; see also id. § 312.2 (indicating release of personal information
includes for the purpose of delivering personalized or “contextual advertising”).
21. See Complying with COPPA: Frequently Asked Questions, FED. TRADE COMM’N
[hereinafter COPPA FAQs], https://www.ftc.gov/tips-advice/business-center/guidance/comp
lying-coppa-frequently-asked-questions#General%20Audience [https://perma.cc/4SBZ-R4
RK] (July 2020).
22. See 16 C.F.R. § 312.2 (providing the list of factors in the rule); COPPA FAQs,
supra note 21 (“If your service targets children as one of its audiences – even if children are
not the primary audience – then your service is ‘directed to children.’” (emphasis added)).
23. 16 C.F.R. § 312.3.58 HOUS. L. REV. 965 (2021)
970 HOUSTON LAW REVIEW [58:4
service operators are required to treat all users as if they are
children.24
General audience websites are not defined in the rule or the
statute. The simplest answer as to what type of website qualifies
as general audience is a website that hosts content not directed at
a child audience.25 The FTC offered clarification as to the type of
content the agency would expect to find on a general audience
website in response to questions generated during the notice and
comment period in 2019.26 Content including “traditionally adult
activities like employment, finances, politics, home ownership,
home improvement, or travel, [is] probably not covered.”27 General
audience websites do not fall under the COPPA restrictions unless
they have actual knowledge that a child is using their website.28
Like general audience websites, mixed audience websites are
not defined in the rule. Mixed audience websites are websites
intended for a primary audience other than children but may
contain content or subject matter that attracts children as a
secondary audience.29 A website that targets teens as the primary
audience is not strictly directed toward children because the
primary audience is over the age of thirteen; however, the website
may still qualify as child-directed if the factors balance in that
direction.30 Mixed audience websites are subject to the COPPA
rule if they have actual knowledge that a child is using the site.31
Further, they are permitted to “age gate”32 their websites to
24. In the rule’s most current statement of basis and purpose, the Commission
responded to comments requesting the requirement to treat all users of child-directed
websites to be replaced with a rebuttable presumption that a user of a child-directed
website was actually a child. Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3972,
3983–84 (Jan. 17, 2013) (to be codified at 16 C.F.R. pt. 312). The Commission responded
that “sites or services whose primary target audience is children must continue to presume
all users are children and to provide COPPA protections accordingly.” Id.
25. See generally Kristin Cohen, YouTube Channel Owners: Is Your Content Directed
to Children?, FED. TRADE COMM’N: BUS. BLOG (Nov. 22, 2019, 12:56 PM), https://www.ftc.go
v/news-events/blogs/business-blog/2019/11/youtube-channel-owners-your-content-directed-
children [https://perma.cc/L3FS-7G2X] (noting that content that is not directed towards
children is not subject to the COPPA rule, even though children may view it).
26. Id.
27. Id. (emphasis added).
28. 16 C.F.R. § 312.3.
29. See COPPA FAQs, supra note 21 (noting that a website that has a large number
of users under the age of thirteen is a child-directed website).
30. The FTC notes that mixed-audience website operators should consider the factors
when making choices about content. Id.
31. 16 C.F.R. § 312.3.
32. Age gates are screening procedures used to identify a child that may be using the
website. See COPPA FAQs, supra note 21. Child-directed websites are not required to
screen for children. Id.58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 971
prevent collection of personal information from children or obtain
consent prior to doing so.33
3. FTC Enforcement Mechanisms. A violation of COPPA
regulations is treated as an “unfair or deceptive act or practice”
and therefore falls under the auspices of the FTC Act.34 The FTC
Act allows the Commission to enforce regulations through civil
penalties, injunctions, and compliance monitoring.35 State
Attorneys General may also bring an action on behalf of state
residents under COPPA for violations of the rule.36
COPPA also allows for self-regulation through the safe harbor
provision. The COPPA safe harbor program allows for industry
groups to set up and administer a self-regulatory compliance
program.37 The safe harbor privacy protection regulations are
required to meet a minimum standard amounting to
“substantially . . . the same or greater” protections as outlined in
COPPA38 and must submit guidelines before being approved by
the FTC.39 Safe harbors allow for application and website
developers, content creators, and other entities that publish
content for children to receive regulatory guidance without being
subject to enforcement action. Existing safe harbors include the
Children Advertising Review Unit (CARU),40 Entertainment
Software Rating Board (ESRB),41 Privacy Vaults Online (PRIVO),
and TRUSTe.42 Once a company has signed on and demonstrated
compliance with the policies of the safe harbor, they are able to
display a seal of approval to signify to consumers that the website,
33. Id.
34. 16 C.F.R. § 312.9.
35. 15 U.S.C. § 45. Civil penalties have been adjusted for inflation to $42,530. Press
Release, Fed. Trade Comm’n, FTC Publishes Inflation-Adjusted Civil Penalty Amounts
(Mar. 1, 2019), https://www.ftc.gov/news-events/press-releases/2019/03/ftc-publishes-inflati
on-adjusted-civil-penalty-amounts [https://perma.cc/AK3Z-UMV8].
36. 15 U.S.C. § 6504(a). Similar enforcement mechanisms are available to the states:
injunctions, monetary relief, and compliance enforcement. Id.
37. 16 C.F.R. § 312.11 (2020).
38. Id. § 312.10(b)(1)–(3).
39. Id. § 312.10(a).
40. CARU is owned and administered by the Better Business Bureau (BBB) as part
of a larger initiative to self-regulate advertising in all forms of media. See Better Bus.
Bureau Nat’l Programs, Children’s Advertising Review Unit, BETTER BUS. BUREAU, http
s://bbbprograms.org/programs/caru [https://perma.cc/AJH5-6UMN] (last visited Feb. 6,
2021).
41. The ESRB is the primary authority that rates video games in mobile, online, and
console formats. See Program Services, ENT. SOFTWARE RATING BD., https://www.esrb.org/p
rivacy/ [https://perma.cc/EU8L-A7TD] (last visited Feb. 6, 2021).
42. See generally COPPA Safe Harbor Program, FED. TRADE COMM’N, https://www.ft
c.gov/safe-harbor-program [https://perma.cc/FH89-LHBR] (last visited Feb. 6, 2021).58 HOUS. L. REV. 965 (2021)
972 HOUSTON LAW REVIEW [58:4
game, or application is COPPA-compliant.43 More importantly,
failure to comply with the safe harbor’s standards is considered an
unfair and deceptive trade practice and subject to enforcement by
the FTC.
B. COPPA as Applied to YouTube
YouTube is an online video hosting and sharing platform.44
YouTube is the second-most-visited website in the world,
outclassed only by its parent company, Google.45 One of the
features that makes YouTube unique is that content is created and
presented by users called “channel owners.”46 Channel owners post
videos to their channels where other users can watch, comment,
like, share, and subscribe to see more content from that channel.47
YouTube does not require an account for users to watch videos;
users only need an account to comment and post their own
content.48 In order to create a Google or YouTube account, users
must certify that they are thirteen years of age or older.49 YouTube
is free to use;50 however, channel owners can monetize their videos
by enabling advertising.51 On average, “YouTubers” pull in almost
$10 per 1,000 views in advertising revenue.52
43. See ENT. SOFTWARE RATING BD., supra note 41; see also, e.g., COPPA Safe Harbor
Program, PRIVO, https://www.privo.com/coppa-safe-harbor-program [https://perma.cc/F2C
Z-M5WN] (last visited Feb. 6, 2021).
44. What Is YouTube?, GOODWILL CMTY. FOUND., https://edu.gcfglobal.org/en/youtub
e/what-is-youtube/1/ [https://perma.cc/5LTV-MLNA] (last visited Feb. 7, 2021).
45. See Top Websites Ranking, SIMILARWEB, https://www.similarweb.com/top-websit
es/united-states [https://perma.cc/HR2G-AQ4J] (Dec. 1, 2020) (ranking methodology can be
found here: https://www.similarweb.com/corp/ourdata/ [https://perma.cc/59EJ-A7CR]); The
Top 500 Sites on the Web, ALEXA, https://www.alexa.com/topsites [https://perma.cc/GW24-
U2M2] (last visited Jan. 8, 2020) (ranking methodology can be found here: https://support.al
exa.com/hc/en-us/articles/200449744-How-are-Alexa-s-traffic-rankings-determined [https:/
/perma.cc/85L9-73Z5]).
46. Complaint for Permanent Injunction, Civ. Penalties, and Other Equitable Relief
at 7, Fed. Trade Comm’n v. Google, LLC, No. 1:19-cv-2642, 2019 WL 4195860 (D.D.C. Sept.
4, 2019) [hereinafter Complaint for Permanent Injunction].
47. Id. at 6.
48. Id.
49. Create a Google Account for Your Child, GOOGLE, https://support.google.com/famil
ies/answer/7103338?hl=en [https://perma.cc/8RKU-HT88] (last visited Feb. 7, 2021).
50. Id.
51. Advertiser-Friendly Content Guidelines, YOUTUBE HELP, https://support.googl
e.com/youtube/answer/6162278?hl=en&ref_topic=9153642 [https://perma.cc/TF9H-AACF]
(last visited Feb. 7, 2021).
52. Advertisers pay approximately $0.18 per view, but YouTube retains forty-five
percent of an individual’s ad revenue. Holly Hunt, How Much Do YouTubers Make (and
How You Can Make It, Too), G2 (Dec. 4, 2019), https://learn.g2.com/how-much-do-youtuber
s-make [https://perma.cc/3VN4-KKQH].58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 973
Channel owners uploading content to YouTube fall under
COPPA’s statutory definition of “website or online service.”53 In
terms of compliance, channel owners are treated as if they are
their own website or online service.54 The FTC has been clear that
the agency intends to bring enforcement action against individual
channel owners if they are found to be violating COPPA.55 Andrew
Smith, then-chief of the FTC Bureau of Consumer Protection,
indicated that the agency would sweep the YouTube platform to
ensure that child-directed content was being properly handled by
channel owners.56
An analysis of the most popular channels on YouTube
revealed content directed at children, especially content featuring
a child under the age of thirteen, was more popular in terms of
views and appeared on channels with more subscribers than
content aimed at a general audience.57 The popularity of children’s
content on YouTube is probably not a surprise to parents. A Pew
Research Center survey revealed “81% of all parents with children
age 11 or younger . . . let their child watch videos on YouTube,”
with 34% indicating that they allow their child to do this
regularly.58 YouTube itself marketed the platform as “the #1
website regularly visited by kids” and the “new Saturday Morning
Cartoons.”59 While the popularity of YouTube among children is
undeniable, YouTube is not a child-directed website. The
difficulties of determining which audience definitions under
COPPA apply to a platform like YouTube are instructive for the
complexities of compliance with the rule.
53. 15 U.S.C. § 6501(10)(A); see also Cohen, supra note 25.
54. Cohen, supra note 25.
55. Id.
56. Smith analogized the Commission’s enforcement strategy toward YouTube to
“shooting fish in a barrel and YouTube is the barrel and the content creators are the fish.”
Andrew Smith, Dir., Bureau of Consumer Prot., Fed. Trade Comm’n, FTC Press Conference
on Settlement with Google / YouTube (Sept. 4, 2019), https://www.ftc.gov/news-events/audi
o-video/video/ftc-press-conference-settlement-google-youtube [https://perma.cc/HPQ7-UKH
C].
57. PATRICK VAN KESSEL ET AL., PEW RSCH. CTR., A WEEK IN THE LIFE OF POPULAR
YOUTUBE CHANNELS 18–19 (2019), https://www.pewresearch.org/internet/2019/07/25/popul
ar-youtube-channels-produced-a-vast-amount-of-content-much-of-it-in-languages-other-th
an-english/ [https://perma.cc/7W73-5FED].
58. AARON SMITH ET AL., PEW RSCH. CTR., MANY TURN TO YOUTUBE FOR CHILDREN’S
CONTENT, NEWS, HOW-TO LESSONS 7 (2018), https://www.pewresearch.org/internet/2018/1
1/07/many-turn-to-youtube-for-childrens-content-news-how-to-lessons/ [https://perma.cc/N
Y2S-F6AD].
59. Complaint for Permanent Injunction, supra note 46, at Exhibits A, C (attached
exhibits A and C contain Google/YouTube’s marketing materials that are quoted above).58 HOUS. L. REV. 965 (2021)
974 HOUSTON LAW REVIEW [58:4
YouTube operates in a COPPA gray area. While some of the
content hosted on the site is directed towards children, it is also
fairly characterized as a general audience platform hosting
content related to sports, politics, instructional videos, and
product reviews.60 YouTube does offer a “kid-friendly” version of
its platform called YouTube Kids;61 however, Common Sense
Media conducted a poll in partnership with SurveyMonkey
indicating that 81% of parents let their child watch YouTube via
the general audience platform, either through the mobile app or
on a computer.62 Only 24% of parents indicated their children
watch YouTube via the YouTube Kids application.63
C. FTC v. YouTube
The FTC entered into its largest settlement under COPPA
against YouTube in September 2019.64 The principal complaint
levied against YouTube is that, despite meeting the COPPA rule’s
definition of a child-directed website, YouTube insisted to channel
owners and advertisers alike that the platform was intended for a
general audience and did not require COPPA compliance.65
However, the COPPA rule applies to websites that have actual
knowledge that a child is using their website,66 and the FTC
argued that YouTube’s representations to advertisers and channel
owners showed the company had actual knowledge that children
were using the site.67
There is no way to know for sure how much advertising
revenue YouTube generated from inappropriate content directed
towards children. However, the FTC’s complaint against YouTube
revealed that among the channels highlighted, “which represent
60. See VAN KESSEL ET AL., supra note 57, at 6 (cataloging median views per video on
YouTube by topical category); SMITH ET AL., supra note 58, at 2–5 (finding that over one-
third of all adults in the United States use YouTube to learn new skills and one in five users
stay abreast of current events through YouTube).
61. A Safer Online Experience for Kids, YOUTUBE, https://www.youtube.com/kids/safe
r-experience/ [https://perma.cc/SA9U-4ZW7] (last visited Feb. 7, 2021) (explaining that
YouTube Kids features curated videos appropriate for children and does not allow
behavioral advertising or commenting on videos).
62. Common Sense Media/SurveyMonkey YouTube Poll Topline, COMMON SENSE
MEDIA, https://www.commonsensemedia.org/sites/default/files/uploads/pdfs/commonsense-
surveymonkey-youtube-topline.pdf [https://perma.cc/5TRY-B8LW] (last visited Feb. 7,
2021).
63. Id.
64. $170 Million FTC-NY YouTube Settlement, supra note 1.
65. Complaint for Permanent Injunction, supra note 46, at 8–9.
66. 16 C.F.R. § 312.3 (2020).
67. Complaint for Permanent Injunction, supra note 46, at 14–15.58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 975
only a few examples of the possible universe of child-directed
content,” YouTube earned nearly $50 million.68 Further, a recent
study indicated that 85% of children’s videos contained at least one
advertisement, and videos targeting early-childhood-age children,
elementary-age children, and teens had higher total ad counts
than videos directed towards adults.69 The FTC’s complaint did
spawn a shareholder derivative lawsuit against Alphabet Inc.70
(Google and YouTube’s parent company), but it does not appear
that the $170 million judgment against YouTube will make much
of a financial dent in the company’s deep pockets.71 In some ways,
the FTC is limited by its own willingness to levy relatively small
penalties on companies for violating consumers’ privacy.72 Thus,
while many may argue that a larger fine was warranted against
YouTube, the FTC was bound by the constraints of “injury to the
public.”73 The FTC has other enforcement mechanisms in its
arsenal,74 and it employed some of them against YouTube.75 The
consent decree appeared to incentivize YouTube to change its
68. Id. at 14.
69. JENNY S. RADESKY ET AL., COMMON SENSE MEDIA, YOUNG KIDS AND YOUTUBE:
HOW ADS, TOYS, AND GAMES DOMINATE VIEWING 15 (2020), https://d2e111jq13me73.cloudfr
ont.net/sites/default/files/uploads/research/2020_youngkidsyoutube-report_final-release_f
orweb.pdf [https://perma.cc/NV8Y-ZE5C].
70. Verified Stockholder Derivative Complaint at ¶ 1, Wessels v. Page, No. 5:19-cv-
06880, 2019 WL 5420582 (N.D. Cal. Oct. 22, 2019).
71. See Video Swells to 25% of US Digital Ad Spending, EMARKETER (Oct. 9, 2018),
https://www.emarketer.com/content/video-swells-to-25-of-us-digital-ad-spending [https://p
erma.cc/X54E-QFMW] (reporting that YouTube’s total ad revenue in 2018 amounted to
$3.36 billion).
72. Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of
Privacy, 114 COLUM. L. REV. 583, 607–08 (2014) (arguing that while consent orders are not
legally binding precedent, they function as precedent in part because businesses rely on the
principles set down in the orders to guide their future activity).
73. Id. at 605 (citing United States v. Danube Carpet Mills, Inc., 737 F.2d 988, 993
(11th Cir. 1984) (holding “injury to the public” as an essential element the government must
prove to levy civil penalties)).
74. Id. at 614–19 (outlining the FTC’s use of the following tools in its data protection
and privacy enforcement regime: consumer notification and remediation, orders to delete
data, requirement to change privacy policies, requirements to implement more stringent
data protection programs, independent assessment, “compliance reports,” and notification
to the agency when compliance circumstances change).
75. Stipulated Order for Permanent Injunction and Civil Penalty Judgment at 10–
12, Fed. Trade Comm’n v. Google, LLC, No. 1:19-cv-2642 (D.D.C. Sept. 10, 2019), https://w
ww.ftc.gov/system/files/documents/cases/172_3083_youtube_coppa_consent_order_signed.
pdf [https://perma.cc/K8G6-DCMJ] (enjoining YouTube from continuing to collect personal
information from children without VPC, requiring the company to “develop, implement,
and maintain a system for Channel Owners to designate whether their Content on the
YouTube Service is directed to Children,” and prohibiting YouTube and content creators
from using the personal information they had already collected).58 HOUS. L. REV. 965 (2021)
976 HOUSTON LAW REVIEW [58:4
policies and practices.76 Yet, the question remains whether a
prohibition on the activity that led to the enforcement action in the
first place will be any more effective at deterring the conduct than
the pre-existing rules and regulations.
D. YouTube’s Policy Changes Following the Settlement
To comply with the court’s order, YouTube implemented a
number of policy changes impacting creators and channel owners
throughout its ecosystem. First, YouTube mandated that all
channel owners need to designate an audience for already-
published videos and forthcoming videos.77 This policy impacts all
YouTube users regardless of their location.78 Channel owners
must designate their videos as “made for kids” or not made for
kids.79 The audience setting can be done on a video-by-video basis
or on a channel level as a whole.80 YouTube will also use machine
learning to identify and classify videos as made for kids; however,
the site warns creators not to “rely on our systems to set your
audience for you because our systems may not identify content
that the FTC or other authorities consider to be made for kids.”81
YouTube advises creators that they are unable to provide guidance
to creators as to whether their audience is set correctly, instead
deferring to the FTC’s guidelines.82
The “made for kids” audience setting restricts the features
available on YouTube videos and channels. The most significant
impact to creators is that personalized advertising will no longer
be available on videos with the made for kids designation.83
YouTube notes that this “may result in a decrease in revenue for
76. Changes implemented will include requiring channel owners to designate
whether their content is directed towards children, removing personalized advertisements
on this content, and eliminating features like commenting. YouTube also indicated they
would “use machine learning to find videos that clearly target young audiences.” Susan
Wojcicki, An Update on Kids and Data Protection on YouTube, YOUTUBE: OFF. BLOG (Sept.
4, 2019), https://blog.youtube/news-and-events/an-update-on-kids?visit_id=6374895099637
35032-2588776809&hl=en&rd=1 [https://perma.cc/KT8V-S3BH].
77. YouTube Help: Set Your Channel or Video’s Audience, GOOGLE [hereinafter
YouTube Audience Settings], https://support.google.com/youtube/answer/9527654 [https://p
erma.cc/C5RA-JGLQ] (last visited Jan. 9, 2020).
78. Id.
79. Id.
80. Id.
81. Id.; see also Wojcicki, supra note 76 (stating that machine learning will be utilized
to identify “videos that clearly target young audiences, for example those that have an
emphasis on kids characters, themes, toys, or games”).
82. YouTube Audience Settings, supra note 77. See generally Cohen, supra note 25.
83. YouTube Audience Settings, supra note 77.58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 977
some creators who mark their content as made for kids.”84 The
same restrictions will apply to videos that YouTube’s machine
learning algorithm designates as made for kids.85 YouTube has not
indicated what creators should expect in terms of how significant
the financial impact will be as a result of these policy changes, but
the expectation is that the impact will be substantial.86 In order to
facilitate the creation of family-friendly content, one of YouTube’s
top earning content categories,87 YouTube pledged over $100
million to a fund “dedicated to the creation of thoughtful, original
children’s content on YouTube and YouTube Kids globally.”88
Other features that will be disabled on made for kids videos
include auto play, commenting, channel branding, and save to
playlist and watchlist features.89 At the channel level, in addition
to the features that will not be available on individual videos,
made for kids channels will not have channel memberships,
notifications, or posts and stories.90
News of YouTube’s impending policy changes was met with
praise from children’s privacy advocates91 and disdain from
content creators.92 The FTC appears poised to make a change to
the COPPA rule that will carve out an exception for mixed
audience sites, that is, sites not directed towards children but,
84. Id.
85. YouTube will allow creators to change a made for kids designation to a “not made
for kids” audience setting; however, YouTube also notes that if they “detect[] error or
abuse,” the designation will be changed and the creator will have to appeal to submit
feedback to change it back. Id.
86. During an unofficial experiment, creators disabled personalized advertising on
their videos for a short time to simulate the conditions of a made-for-kids video. The
experiment showed that the impact of disabling personalized ads was anywhere between a
60% and 90% loss in revenue. Jonathan Katz & Victoria Fener, Is a YouTube COPPAcalypse
Coming? FTC Rules Could Start Demonetizing Creators in 2020, TUBEFILTER (Nov. 5,
2019), https://www.tubefilter.com/2019/11/05/youtube-coppa-adpocalypse-ftc-rules-demone
tizing-child-directed/ [https://perma.cc/D6CL-WGQR].
87. See VAN KESSEL ET AL., supra note 57; SMITH ET AL., supra note 58.
88. Wojcicki, supra note 76.
89. YouTube Audience Settings, supra note 77.
90. Id.
91. Press Release, Campaign for a Com.-Free Childhood, Advocates Who Filed the
Privacy Complaint Against Google/YouTube Laud Improvements, but Say FTC Settlement
Falls Far Short (Sept. 4, 2019), https://commercialfreechildhood.org/advocates-who-filed-th
e-privacy-complaint-against-google-youtube-laud-improvements-but-say-ftc-settlement-fal
ls-far-short/ [https://perma.cc/7VHF-72X3].
92. Some content creators whose genre focuses on video games expressed concern
that the mixed-use nature of their channels was in danger by the requirement to designate
as either child-directed or general audience. See Julia Alexander, YouTubers Say Kids’
Content Changes Could Ruin Careers, VERGE (Sept. 5, 2019), https://www.theverge.com/201
9/9/5/20849752/youtube-creators-ftc-fine-settlement-family-friendly-content-gaming-mine
craft-roblox [https://perma.cc/P3KL-YF3J].58 HOUS. L. REV. 965 (2021)
978 HOUSTON LAW REVIEW [58:4
nevertheless, have a large number of children that use it.93 Some
have viewed this question, and comments that FTC commissioners
have made, as a sign that the agency is ready to weaken the
COPPA rule in favor of incentivizing content creators to create
better content subsidized by personalized advertising.94 The next
Part will discuss the debate regarding revisions to the COPPA
rule, the positions of the major stakeholders, and the efficacy of
their arguments.
III. COPPA REFORM
The FTC’s request for comments on the future of the COPPA
rule generated nearly 175,000 comments. Politicians, privacy
advocates, industry and trade associations, YouTubers (and their
army of fans), online businesses, and others participated in the
process.
A. Content Directed Towards Children
The FTC requested comments on the definitions provided in
the rule.95 Specifically, the request for comment sought feedback
as to whether the rule considers the correct factors, whether the
factors need to be clarified, and whether the definition should be
amended to account for websites that have mixed audiences.96
Google, YouTube’s parent company, responded to the request
for comment to articulate its position on this precise question.97
Google believes that the distinction between general audience
content and child-directed content is easiest to determine at the
extreme ends of the spectrum where content is designed to appeal
93. See Request for Public Comment on the Federal Trade Commission’s
Implementation of the Children’s Online Privacy Protection Rule, 84 Fed. Reg. 35842,
35843–44 (proposed July 25, 2019) (to be codified at 16 C.F.R. pt. 312) (requesting public
comment regarding the efficacy of the factors that determine whether a website is child-
directed as outlined in 16 C.F.R. § 312.2 and whether any changes should address sites
“that do not include traditionally child-oriented activities, but that have large numbers of
child users”).
94. Opinion, Don’t Weaken Privacy Protections for Children, N.Y. TIMES (Oct. 10,
2019), https://www.nytimes.com/2019/10/10/opinion/coppa-children-online-privacy.html [ht
tps://perma.cc/2FMP-NRMT].
95. See Request for Public Comment on the FTC’s Implementation of the Children’s
Online Privacy Protection Rule, 84 Fed. Reg. at 35843–44.
96. Id. at 35843.
97. Google, Response to Request for Comments on the Federal Trade Commission’s
Implementation of the Children’s Online Privacy Protection Rule (Dec. 9, 2019, 3:45 PM)
[hereinafter Google’s COPPA Comment], https://www.regulations.gov/document?D=FTC-2
019-0054-21661 [https://perma.cc/MFK4-JVSA].58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 979
exclusively to a child audience or general audience website.98 The
distinction becomes much more difficult to parse out for mixed
audience channels.99 This is a problem articulated by YouTubers
as well.100 Gaming-related content is one of the most popular
content categories on YouTube.101 Some gaming content features
characters that are likely to appeal to children,102 yet the general
tone and language of the video may be entirely inappropriate for
an audience under the age of thirteen.103 Thus, on its face, the
content of the video may indicate that the video is intended to
target children as a primary or secondary audience. Viewed in
context, however, a reasonable observer would probably conclude
that the creator had no intention of targeting children, but rather
a general audience.104 The factors provided in the rule make it
difficult for content creators to determine whether they are
making videos that could be construed as directed towards
children for purposes of COPPA compliance; some creators have
98. At one end of the spectrum, there is content that is clearly intended for adults
like finance, politics, and home improvement projects. At the other end, early childhood
educational videos teaching reading and math skills are clearly directed towards children.
Id. at 14; see also Cohen, supra note 25 (identifying the types of content that qualifies as
directed to a general audience).
99. “[I]t is difficult to ascertain the line between a service that targets children as one
audience, but not the primary audience, and general audience sites that do not target
children as any audience but may have children users on their site.” Google’s COPPA
Comment, supra note 97.
100. See, e.g., Dollightful, Help Save Our Channels, YOUTUBE (Nov. 15, 2019), http
s://www.youtube.com/watch?v=Y0HGa4qQhUk [https://perma.cc/3B9X-X2RH]; The Game
Theorists, Game Theory: Will Your Favorite Channel Survive 2020? (COPPA), YOUTUBE
(Nov. 22, 2019), https://www.youtube.com/watch?v=pd604xskDmU [https://perma.cc/N7RK
-PRMF].
101. Ekaterina Petrova & Netta Gross, 4 Reasons People Watch Gaming Content on
YouTube, THINK WITH GOOGLE (June 2017), https://www.thinkwithgoogle.com/consumer-in
sights/statistics-youtube-gaming-content/ [https://perma.cc/L3HZ-MW4D].
102. One study indicates that forty-five percent of parents of children aged three to
twelve reported that their children play Minecraft. Jane Mavoa et al., Children and
Minecraft: A Survey of Children’s Digital Play, 20 NEW MEDIA & SOC’Y 3283, 3289 (2018).
103. One example is a channel that features gameplay from the popular game
Minecraft. The video contains gameplay from Minecraft overlaid with commentary from
the channel owner. The commentator uses several swear words and discusses topics that
most parents would probably deem inappropriate for their children aged thirteen and
under. WILDCAT, The Most Inappropriate Minecraft Series on YouTube. . . Ep 1, YOUTUBE
(June 22, 2019), https://www.youtube.com/watch?v=fC-U64_yS9I [https://perma.cc/GBG2-
MU8Z].
104. Google’s position on this matter is that the Commission needs to take a balanced
approach when considering the factors that indicate a website or service is child-directed.
Further, it argues that for a platform like YouTube, which hosts content created by third
parties, the balance of content and context is especially important given that “platforms
generally have access only to the content itself, and are not privy to information regarding
content creators’ actual or intended audience.” See Google’s COPPA Comment, supra note
97, at 15–16.58 HOUS. L. REV. 965 (2021)
980 HOUSTON LAW REVIEW [58:4
resorted to shedding their signature costumes in order to avoid the
made for children designation.105
Drawing on lessons from the FTC’s enforcement action
against Yelp,106 presumably one method a website could use to
avoid compliance with COPPA is to refrain from asking for age at
all or not to allow children under the age of thirteen to create an
account.107 The COPPA rule attempts to account for the willful
disregard of a user’s age by requiring that any website that is
directed towards children comply with the personal information
minimization procedures and verifiable parental consent
requirements.108
While there is some common sense to the request for clarity,
some advocates have argued that Google’s position on this point is
disingenuous at best.109 Google is in the business of personalized
marketing,110 and its algorithms are able to accurately predict a
user’s attributes such as age, education level, home ownership
105. In one example, the channel hosts wear unicorn one-piece pajama outfits and
provide commentary on a variety of topics, many of which contain humor directed towards
adults. Video titles from this channel include “I got pregnant from swimming in a pool[,]”
“People who met their online ‘Friend,’” and “The hardest questions asked at Google
interviews.” In an effort to comply with COPPA, the hosts stopped wearing the unicorn
pajamas so as not to be misconstrued as being directed towards children. An important note
here is that the actual content of the videos has not changed other than the hosts’
appearance. See ReactiCorns, How YouTube Killed Our Unicorn Onesies. . . *SERIOUS*,
YOUTUBE (Dec. 26, 2019), https://www.youtube.com/watch?v=pEdnbvpTzvs [https://perma.
cc/DE8V-XWGR]; ReactiCorns, Video Uploads, YOUTUBE, https://www.youtube.com/chann
el/UCsxMvzm3AumF6SHsQBva-AA/videos [https://perma.cc/M994-QDYM] (last visited
Jan. 10, 2020).
106. Yelp was penalized $450,000 by the FTC for using an age verification system in
a mobile application that allowed users under the age of thirteen to register accounts. Yelp
used a third party to implement the age-verification system and was operating under the
belief that no users were able to create accounts if they were under the age of thirteen.
Because Yelp was collecting personal information from mobile application users, and at
least some of them were under the age of thirteen, the FTC found Yelp had actual
knowledge that a child was using its website. See United States v. Yelp Inc., No. 3:14-cv-
4163, 2014 WL 4721673 (N.D. Cal. Sept. 16, 2014).
107. YouTube employees responded to an advertiser’s question regarding COPPA
compliance using this same logic: “we don’t have users that are below 13 on YouTube . . . so
there is no channel/content that is child-directed and no COPPA compliance is needed.” See
Complaint for Permanent Injunction, supra note 46, at 8–9.
108. 16 C.F.R. § 312.3 (2020).
109. See Hector Balderas et al., Att’y Gen. of N.M., Comment Letter on COPPA Rule
Review (Dec. 9, 2019) [hereinafter New Mexico Attorney General’s COPPA Comment], htt
ps://www.regulations.gov/document?D=FTC-2019-0054-21675 [https://perma.cc/52F7-3UK
X].
110. About Demographic Targeting, GOOGLE SUPPORT, https://support.google.com/goo
gle-ads/answer/2580383?hl=en [https://perma.cc/AMZ7-BTU2] (last visited Dec. 30, 2020).58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 981
status, and other interests.111 Advertising networks boast that
they can drill down target audiences to such specificity as to target
people who have visited hospitals or medical care facilities.112 “In
other words, these companies possess information that can and
should be used to affirmatively identify websites or online services
that are child-directed in practice . . . .”113 The irony of this
proposition is that in order for companies to accurately predict the
age of a user without implementing an age-gate system, they
would be required to engage in passive tracking of children—in
violation of current COPPA rules.
B. Rebuttable Presumption that Children Are the Users of Child-
Directed Websites
One possible solution to the audience identification
conundrum is to allow website operators to rebut the presumption
that users of child-directed content are children. Google advocated
for this policy change arguing that third-party platforms that host
child-directed content should be able to “treat their adult users as
adults, with the appropriate safeguards . . . .”114 This option was
on the table during the 2013 COPPA revisions, but ultimately, the
commission chose to maintain the policy that users of child-
directed content were to be treated as children.115 Under a
rebuttable presumption model, adult users logged in to profiles on
general audience platforms that engage with child-directed
content would be treated normally.116 Users engaging with child-
directed content that were not signed into a profile would be
treated as children.117 Google’s rationale for the implementation of
the rebuttable presumption policy is that the statute itself only
prohibits collection of data and personal information from
children; adults were never intended to be covered by the
111. See generally Michael Carl Tschantz et al., The Accuracy of the Demographic
Inferences Shown on Google’s Ad Settings, WORKSHOP ON PRIV. ELEC. SOC’Y (Oct. 15, 2018),
https://www1.icsi.berkeley.edu/~mct/pubs/wpes18.pdf [https://perma.cc/5NAC-KVXH].
112. See, e.g., Hospital, Clinic and Medical Center Visitors, INMOBI, https://intelligenc
e.inmobi.com/audience/f15cbffb-f6e6-483c-bd62-f5f7edf51f08 [https://perma.cc/S569-22CQ]
(last visited Jan. 19, 2021).
113. New Mexico Attorney General’s COPPA Comment, supra note 109, at 6.
114. Google’s COPPA Comment, supra note 97, at 7.
115. See generally Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3972, 3983–
84 (Jan. 17, 2013).
116. Users in this category would be able to use the full functionality of YouTube (i.e.,
commenting, personalized advertisements, etc.). Google’s COPPA Comment, supra note 97,
at 7–9.
117. Id. at 7.58 HOUS. L. REV. 965 (2021)
982 HOUSTON LAW REVIEW [58:4
statute.118 Thus, a rebuttable presumption model more accurately
accomplishes the law’s intended purpose. Google’s proposed
mechanism for rebutting the presumption is to use a similar
approach to verifiable parental consent.119
Google’s proposal, while practical, has some obvious flaws.
First, the rebuttable presumption standard assumes that anyone
signed in as an adult is an adult. YouTube does not allow users to
register for accounts if they are under the age of thirteen,120 thus,
many children use their parent’s general audience YouTube
account.121 The proposal does not account for the data that will be
collected from children using their parents’ YouTube accounts.
YouTube is responsible for the content that is hosted on its
application, but parental supervision will always be the last line
of defense against privacy violations and inappropriate content
being directed towards children. However, many parents have
assisted their children in subverting the privacy protections
currently available to children.122
Second, verifiable parental consent has not been implemented
effectively, in part because of the lack of guidance from the rule.
Some ambiguity in the wording of the rule is probably necessary
in order to allow for flexibility in approaches to implementation.
However, it is surprising that Google would want to introduce
more vagueness into the rule when one of the principal complaints
levied against COPPA is the lack of clarity.123
Future implementation of the COPPA rule will need to engage
in some give-and-take to both sides of the argument. The FTC
118. 16 C.F.R. § 312.3 (2020) (emphasis added). “It is unlawful for an operator of a
website or online service . . . to collect personal information from a child . . . .” 15 U.S.C.
§ 6502(a)(1).
119. “Rather than prescribe the use of a specific technology, we encourage the
Commission to adopt a standard similar to what currently exists for verifiable parental
content, allowing for a diversity of ‘reasonably calculated’ methods that provide reasonable
assurance that the person engaging with the content is an adult.” Google’s COPPA
Comment, supra note 97, at 10.
120. Terms of Service, YOUTUBE, https://www.youtube.com/static?template=terms [htt
ps://perma.cc/KB86-JV24] (last visited Jan. 15, 2021).
121. Colin Dixon, YouTube Used by More Children than YouTube Kids,
NSCREENMEDIA (Nov. 24, 2020), http://www.nscreenmedia.com/more-kids-youtube-versus-
youtube-kids/ [https://perma.cc/T56D-RSDU].
122. danah boyd et al., Why Parents Help Their Children Lie to Facebook About Age:
Unintended Consequences of the ‘Children’s Online Privacy Protection Act,’ FIRST MONDAY
(Oct. 31, 2011), https://journals.uic.edu/ojs/index.php/fm/article/view/3850/3075 [https://per
ma.cc/DM4Q-T4UE] (reporting findings that many parents did not understand the purpose
of age requirements was intended to protect their children’s privacy; rather, they believed
that their children were mature enough to use the site).
123. See Google’s COPPA Comment, supra note 97, at 12–14 (asking the FTC for
further guidance on the directed towards children factors).58 HOUS. L. REV. 965 (2021)
2021] PROTECTING CHILDEN’S PRIVACY 983
should certainly not grant Google a wish list of proposed COPPA
reforms, but rather should engage in a balancing of interests on
both sides of the argument. There is undoubtedly a need to protect
children online, but COPPA has largely targeted the wrong parties
with ineffective methods.
C. Enable Children’s Content Creators to Monetize Their Content
by Incentivizing the Safe Harbor Framework
Content creators, websites, and application developers need
to have an economic incentive to create child-friendly content. On
YouTube, channel owners who enable personalized advertising
have an opportunity to earn more from advertisements displayed
on their videos than those with contextual advertisements.124
Further, mobile application developers depend on analytics from
application usage to drive monetary earnings.125 One possible
solution to ease the tension between privacy and monetization that
the FTC should explore is expanding COPPA’s existing safe harbor
framework.
Even though safe harbors purport to offer at least the same
level of privacy protection as currently guaranteed by COPPA,
there is evidence to indicate that safe harbors may not be any more
effective in implementing the required privacy standards.126 One
element of the impending COPPA rule change the FTC should
consider is strengthening the standards required for safe harbors,
124. YouTube “enable[s] behavioral advertising by default on monetized
channels . . . . The checkbox that allows the channel owner to opt out of behavioral
advertising contains text stating that doing so ‘may significantly reduce [the] channel’s
revenue.’ When a channel owner opts out of behavioral advertisements . . . [YouTube]
serve[s] contextual advertising on the channel, which generates less revenue for the
channel owner and [YouTube].” Complaint for Permanent Injunction, supra note 46, at 7.
125. According to a poll conducted by the App Association, 100% of developers cited
loss of analytics as a barrier to developing mobile applications for children. “Without
analytics, [companies] are completely in the dark, not making any money, and no chance to
make things better.” Morgan Reed, President, The App Ass’n, Presentation at The FTC’s
The Future of the COPPA Rule Workshop, Developers and COPPA: Their Real-World
Experience (Oct. 7, 2019), https://www.ftc.gov/system/files/documents/public_events/15353
72/slides-coppa-workshop-10-7-19.pdf [https://perma.cc/3WM7-HNVB].
126. Researchers analyzed 5,855 child-directed applications governed by COPPA
available for free in the Google Play store. The researchers used a bot to test the
functionality of the applications and monitored the data the applications accessed, and the
packets being sent from the application. The focus of the study was to monitor data being
accessed by applications and the parties with whom the applications shared that data. Of
the applications tested, 237 applications were confirmed to be members of safe harbor
programs. The study found that over 65% of the applications belonging to safe harbors were
sending sensitive data to third parties, while 73% of the general marketplace applications
were observed transmitting this data. See Irwin Reyes et al., “Won’t Somebody Think of the
Children?” Examining COPPA Compliance at Scale, PROC. ON PRIV. ENHANCING TECH.,
June 6, 2018, at 66, 69, 74–75.You can also read
