KidAware Bulletin – October 2019
YouTube and channels sued over kids’ privacy; FTC considers revisions to COPPA; and (lots of) other news.
New class-action lawsuit claims Google, YouTube and channel owners harmed kids through personal data collection
A class action lawsuit filed last month alleges that YouTube and a host of kids’ brands and channel operators collected personal data from kids, invading their privacy and breaching the standard set by COPPA. The lawsuit follows on the heels of (and references) the FTC’s recent settlement with YouTube and Google for COPPA violations.
A California mom is bringing the claim under state law, using the ‘intrusion upon seclusion’ statute to assert that her daughter’s reasonable expectation of privacy has been violated. The lawsuit relies extensively on evidence made public in the FTC settlement agreement, including the fact that Google had ‘actual knowledge’ of kids using its platform, and that the data it collected generated revenue for YouTube and channel owners through the sort of targeted advertising that is prohibited under COPPA.
Good analysis from The Guardian’s Chris Stokel-Walker is here.
Previous lawsuits over kids privacy that relied upon the ‘intrusion upon seclusion’ claim have failed, including earlier this year when a South Carolina judge dismissed a similar lawsuit against Google.
The new complaint aims to prove injury by showing how YouTube used profile data to “manipulate and exploit” kids to extend their viewing time, which enabled more advertising and led viewers into a ‘rabbit hole’ of disturbing content. The claim further argues that the kids’ data has given Google a “significant first-mover advantage which cannot be undone,” as the “algorithms now incorporate ill-gotten data from billions of children’s YouTube video views. The deep insights gleaned from these viewing sessions […] will solidify the Google dominance in the market for child-related content.”
TL;DR for YT advertisers: although we have yet to see any advertiser held liable for kids’ data privacy on YouTube, our recommendation remains unchanged: only use contextual targeting methods to reach kids’ audiences, and buy only on hand-picked, curated channels. Don’t use YouTube’s keyword targeting tools, which are assumed to contribute to the collection of personal data from kids’ channels.
If you are working with kids’ influencers, agree upfront whether a given paid-for video will be tagged as child-directed under YouTube’s new system. You may have to agree some flexibility with content creators on viewing targets until the impact on reach of these changes is fully settled.
TL;DR for YT channel owners: If you operate a YouTube channel with content appealing to kids, request access from YouTube to the new tool that will allow you to tag your content as being child-directed. Once this is available, you will have responsibility for how your users are treated for data collection.
If you operate an influencer channel popular with kids, you will need to make a decision on a per-video basis whether it is primarily child-directed or not. This will often mean a difficult choice between lower revenue or risk of potential COPPA violations. YouTube is offering to work with creators to mitigate the effect of this transition, so you should seek out their advice.
FTC review of COPPA in full swing
The Federal Trade Commission (FTC) hosted a workshop in Washington DC in October to discuss potential changes to COPPA. This was part of the agency’s full review of the law, launched in August—ahead of the normal 10-yearly review cycle. At the event, policy makers, legal experts, activists and corporate counsels debated the effectiveness of the current Rule and explored potential improvements.
The FTC’s review and public consultation examines every aspect of the law, including
- The definition of ‘directed to children’ and how it could be amended so that more kids’ viewing general audience content are also protected under the law;
- The definition of ‘actual knowledge’ of children using a service and whether a ‘constructive knowledge’ standard would be better, eg a service should reasonably know if its audience is made up of kids;
- How to ensure the Rule protects kids when they are using new types of digital services such as podcasts, OTT/VOD services, voice assistants and connected toys;
- Whether to expand the scope of ‘personal information’ to include new types of data, such as biometric data;
- How to improve the rules for schools and edtech providers so that they can act in loco parentis in relation to providing consent for use of student’s personal data;
- Whether to limit or amend the so-called internal operations exemption which allows the collection of persistent identifiers in some circumstances; and,
- How to improve the mechanisms for verifying parental identity when seeking consent to collect personal data.
In spite of concerns voiced by some senators and by the editorial board of The New York Times, the FTC commissioners who spoke at the event made clear that there is no intention to reduce protections for children, or to roll back provisions of the law. On a panel discussion about persistent identifiers, SuperAwesome’s Kate O’Loughlin showed how kids’ privacy could be better protected by eliminating the internal operations exemption and encouraging investment in contextual advertising that does not require any personal data.
The consultation period has been extended to 9 December.
In Other News
We street-proof our kids. Why aren’t we data-proofing them? (The Conversation, 29 Sept 2019)
New research shows how big tech and media conglomerates are using ‘dark patterns’ to bypass privacy regulations, leading to widespread personal data collection from kids. The author believes current US rules on student privacy in schools are inadequate and calls for Canada to implement better regulation.
China has released its version of COPPA (IAPP, 1 Oct 2019)
China’s new “Measures on Online Protection of Children’s Personal Data” came into force on 1 October, prohibiting the collection of personal information from children under 14. For advertisers, this means no more behavioural advertising or retargeting to kids and tweens in China.
Teens find circumventing Apple’s parental controls is child’s play (Washington Post (paywall), 15 Oct 2019)
The Post analyses ways in which teens and tweens are bypassing Screentime and similar parental controls on their devices with some surprisingly simple tricks—such as changing the time on their device.
Disney Has a Huge Problem With Hulu Showing Inappropriate and Mature Content to Children (Inc.com, 3 Sept 2019)
A journalist points out that some advertising delivered on kids’ channels in Hulu’s service are inappropriate for the audience. The research highlights the difficulty—and importance—of delivering appropriate contextual advertising in an OTT environment, and the need for dedicated kidtech to ensure compliant delivery.
Judge in Alexa recording lawsuit rejects Amazon attempt to require arbitration (Seattle Times, 22 Oct 2019)
The lawsuit claims that even though parents entered into a contract with Amazon by buying and setting up an Alexa-enabled device, their children did not. The judge’s ruling means that Amazon can’t force the case into arbitration, since the kids in question did not agree to it. The case raises important questions about service provider responsibility when there are multiple users of a product, eg family members or friends.
Why marketers must conduct GDPR Data Protection Impact Assessments of RTB (Brave.com blog, 24 Sept 2019)
Dr Johnny Ryan provides very practical advice on how marketers should audit their delivery of ads in response to the ICO’s RTB adtech report and expected regulatory guidance on how GDPR will restrict the current practice of profile-based targeting in programmatic advertising.
ASA Ruling on Paramount Pictures International (ASA, 30 Oct 2019)
The ASA has ruled a video ad from Paramount for the film ‘Pet Sematary’ breached the CAP Code because it was likely seen by children viewing Fortnite content YouTube. The case highlights the high standard the ASA requires from marketers of age-restricted products: it confirms that limiting viewership to logged-in, adult users on YouTube is not sufficient, and marketers must also negatively target content that is likely to be popular with children.
