On Wednesday, the Federal Trade Commission announced a settlement with YouTube for repeated, knowing violations of children’s privacy laws. The fine: $170 million. For YouTube’s parent company, Alphabet, that works out to roughly two days’ worth of profit. That’s not a slap on the wrist; it’s a delicate tap. With a feather. In zero gravity.
Over the last year or so, a series of high-profile FTC enforcement actions have left critics of tech’s biggest privacy offenders—Google, Facebook, Equifax—somewhere between frustrated and apoplectic. Time and again, the money extracted from the tech giants amounts to a pittance. The structural remedies that accompany those fines—the part where companies agree to change the offending parts of their behavior—can arguably have greater effect. But blaming the FTC for inadequately bringing Silicon Valley to heel on its own is like blaming a fork for not holding soup. Could it do more? Should it? Just don’t expect real privacy change without strong privacy laws in place.
The YouTube case presents a unique locus for those frustrations. The FTC and the New York Attorney General’s office alleged that the Alphabet subsidiary collected personal information from minors, using persistent identifiers to track them across the internet, without first gaining the consent of their parents. That’s a violation of the Children’s Online Privacy Protection Act, which carries specific penalties that broader FTC privacy actions don’t. It was, more simply put, an opportunity to come down hard.
The three FTC commissioners who voted in favor of the settlement argue that it did just that. As FTC chairman Joseph Simons noted in a press conference Wednesday, the fine is 30 times larger than the previous record COPPA civil penalty, which social music app Musical.ly—since acquired by TikTok—paid out in February. In fact, the YouTube fine is 10 times larger than all 31 prior COPPA enforcements combined. “A penalty of this magnitude sends a strong signal about the importance of children’s privacy,” Simons said.
Or does it? Consider that COPPA specifies a maximum penalty of $42,530 per violation, which can be meted out on a per child or per day basis. Or more to the point, consider FCC commissioner Rohit Chopra’s dissenting statement, in which he calculates Google’s actual liability—based on ill-gotten gains—to be in the billions of dollars. “The terms of the settlement were not even significant enough to make Google issue a warning to its investors,” Chopra writes. For some perspective, here’s Alphabet’s net income last year versus the record-setting fine.
Andrew Smith, director of the FTC’s Bureau of Consumer Protection, said at Wednesday’s press conference that the particulars of how the agency arrived at the fine were confidential, but that the figure was based on a multiple of revenue that it felt it could prove YouTube knowingly gained from tracking children. “I hope that business does not doubt our resolve. This is a historic penalty,” Smith said. “It is staggeringly large in the privacy world and the COPPA world.”