Entertainment Law

Author: Elyot Waller

Disclaimer.  The following is the opinion of the author in his individual capacity and is not intended as legal advice and the author expresses no opinion on U.S. legal matters or statutes.

On September 4, 2019, Google reached a US $170 million dollar settlement with the Federal Trade Commission (FTC) and the State of New York over repeated breaches of the Children’s Online Privacy Protection Act of 1998 (COPPA). According to a number of press reports this is the largest award in COPPA’s history.

The basis of the complaint was that YouTube was profiting by selling the personal information of children under thirteen years of age to third party advertisers targeting those children. In order to collect, use and distribute protected information about anyone under thirteen years of age, among other things, COPPA requires verifiable, parental consent. This is typically the most challenging requirement of COPPA compliance as the consent has to be independently verifiable as coming from the child’s actual parents. The FTC’s published list of acceptable methods of providing parental consent is attached as Appendix I. As an example, returning a signed consent form by mail, fax or email is a form of verifiable parental consent.

The complaint identified YouTube channels run by Mattel, Hasbro, Cartoon Network and a few other major kids content owners as evidence that certain YouTube services were directed and targeted at children. YouTube earned over US $50 million from “behavioral”, i.e., targeted, ads directed at children on those channels alone. The complaint identified YouTube’s practice of providing ‘persistent identifiers’ (e.g. cookies) to third party advertisers in order to boost the value of ads sold as a breach of children’s privacy protections under COPPA. COPPA includes persistent identifiers that can be used to identify or track an individual or device in a lengthy list of children’s protected personal information.

Following the ruling YouTube announced that it would no longer allow targeted ads on programs intended for children and youth consumption. Contextual ads will still be allowed. This change could be a substantial blow to some children’s and family channels and content owners receiving revenue from YouTube streams. YouTube provided channel owners with the ability to opt out of targeted advertising by checking a box. However, next to the box was a statement to the effect that opting out of targeted advertising, “may significantly reduce the channel’s revenue.” According to the complaint, when a channel operator opts out of targeted ads, YouTube would provide only contextual ads, which would generate less revenue for the channel owner. I expect the difference is substantial.  Per  one  channel  owner,  the  expectation  is  for  more  than  a  50%  decline  in  ad revenues.

Presumably to help cushion this blow, YouTube has announced a US $100 million fund to assist creators of Kid’s content. We’ll be happy to provide you with updates on the rules for accessing that fund on request. In addition, the settlement order provides YouTube and Google with four months to comply and stop using targeted ads in conjunction with kid oriented content. The good news is that this provides anyone relying on this revenue stream with a transition period to adapt and change their practices.

While this has been the first major salvo by the FTC in its battle to enforce COPPA on kids streaming services, it is unlikely to be the last. Content and channel owners have been put on notice that the FTC will be taking aim at them next, and our expectation is that they will increase their scrutiny of kid focused websites and apps as well. According to Andrew Smith, Director of the FTC’s Bureau of Consumer Protection:

“We would have strong penalties in future cases against content creators and channel owners, as well — particularly when we would have a situation where the channel owner was specifically asked ‘are you child-directed?,’  and the channel owner said ‘No,”

The expectation is that the next step will be a broad sweep on kids’ channels on YouTube and similar services in the U.S.

As a content or channel owner you need to ask yourself if your content is directed at kids and if you collect any of their personal information. The answers to these questions can be quite nuanced, and if you have any doubt you should seek professional advice. In particular, if you are providing information on views or usage to third party ad networks who pay you a premium to post targeted ads to your site or app you are likely offside. While we are unable to advise on U.S. law we’d be happy to discuss options.

Over  the  past  year,  the  Shaw  Rocket  Fund  has  been  running  the  pilot  Rocket  Online  Safety Program. This pilot program provided access to the “kidSAFE Seal” Program. We understand the pilot  program  has  been  extended. The  kidSAFE  Seal  Program  includes  a  kidSAFE  COPPA Certified Seal. Since 2014, the FTC has considered websites and apps certified by the kidSAFE COPPA certification process as qualifying as a ‘safe harbor’ under COPPA. Having the kidSAFE COPPA Seal on your site will mean that you would be subject to the rules of the kidSAFE Program as a safe harbor against formal review, investigation and possible fines by the FTC.

Given the importance of the subject matter, we strongly urge channel operators/content owners to review their COPPA compliance process, and we would welcome the opportunity to advise on the process  for  safe  harbor  certification.  You may  contact  the  author  at  ewaller@meplaw.ca  or +1.778.329.9036.

Appendix I

Acceptable methods of obtaining verifiable parental consent, per the FTC, include having the parent:

  • Sign a consent form and send it back to you via fax, mail, or electronic scan;
  • Use a credit card, debit card, or other online payment system that provides notification of each separate transaction to the account holder;
  • Call a toll-free number staffed by trained personnel;
  • Connect to trained personnel via a video conference;
  • Provide a copy of a form of government issued ID that you check against a database, as long as you delete the identification from your records when you finish the verification process;
  • Answer a series of knowledge-based challenge questions that would be difficult for someone other than the parent to answer; or
  • Verify a picture of a driver’s license of other photo ID submitted by the parent and then comparing that photo to a second photo submitted by the parent, using facial recognition technology.