The Federal Trade Commission (FTC) announced a $10 million settlement with Disney, addressing allegations that the company failed to correctly label its child-directed videos on YouTube, which resulted in unlawful collection of children’s personal information.
Disney’s actions, the FTC alleged in its complaint, violated the Children’s Online Privacy Protection Act and corresponding rule (collectively “COPPA”), which require online services and website operators to, among other things, obtain verifiable parental consent before collecting personal data from children under 13.
The Alleged Violations
After a 2019 settlement with the FTC over alleged COPPA violations of its own, YouTube implemented safeguards requiring content creators to designate their videos as either “Made for Kids” (MFK) or “Not Made for Kids” (NMFK). When a video is designated as MFK, certain features—such as comments, the ability to save a video to a playlist, and targeted advertising using persistent identifiers—are disabled to prevent the collection of children’s personal information that would require notice and verifiable parental consent under COPPA.
The MFK or NMFK designation can be made at the channel level, such that all videos uploaded to the channel receive the selected designation by default, or on the individual video level, such that that each video must be individually designated. According to the FTC, YouTube advised Disney that it may face “compliance issues” if it failed to accurately designate its content.
Disney’s policy, which governed over 1,250 YouTube channels through numerous subsidiaries, mandated that audience designations be made on the channel level. As a result, the FTC alleged, certain child-directed videos uploaded to NMFK channels retained their default NMFK designation from 2020 to present. YouTube’s feature-disabling COPPA compliance mechanisms were not activated and YouTube, relying on Disney’s designations, allegedly collected personal information and placed targeted advertisements on child-directed videos on Disney’s behalf.
These alleged misclassifications also meant that, alongside YouTube, Disney itself ran targeted advertisement campaigns on child-directed videos incorrectly marked NMFK. Conducting targeted advertising on child-directed content without verifiable parental consent violates COPPA because it relies on collecting persistent identifiers that can be used to recognize a user over time and across different websites or online services. Such persistent identifiers qualify as personal information that is protected under COPPA.
In addition to the collection of children’s personal information for advertising purposes, the FTC emphasized that the “mislabeling exposed children to age-inappropriate YouTube features like autoplay to [NFMK] videos.”
In its complaint, the FTC highlighted the fact that the mislabeling issue had been brought to Disney’s attention as early as June 2020. At that time, YouTube notified Disney that it had changed the designations on over 300 Disney videos from NMFK to MFK to bring the videos into compliance. Despite this warning, the FTC claims that Disney did not take adequate steps to prevent future misclassification of videos, such as revising its policy of designating videos on the channel-level.
Settlement
In addition to paying $10 million, Disney agreed to implement comprehensive internal controls to ensure future COPPA compliance when uploading to third-party platforms. The proposed settlement requires Disney to establish and implement a mandatory Audience Designation Program “to review whether [individual] videos posted to YouTube should be designated as MFK—unless YouTube implements age assurance technologies that can determine the age, age range, or age category of all YouTube users or no longer allows content creators to label videos as MFK.” The order, the FTC explained in its press release, “would transform how the entertainment behemoth designates videos on YouTube…while encouraging adoption of age assurance technologies on YouTube.”
Takeaways
If your business produces, posts, or monetizes any content directed to children via third-party content sharing sites, then consider the following steps to mitigate potential risk:
- Audit your video and content labeling practices, ensuring that each video receives the appropriate audience designation.
- Invest in internal review programs of uploaded content, such as randomized audits and flagging systems for potentially problematic designations.
- Monitor developments regarding age-assurance technologies.
- Document policies and processes to demonstrate good-faith compliance efforts with COPPA requirements.
- Stay up to date on FTC enforcement actions to better understand the FTC’s expectations for creators and platforms dealing in child-directed content.
