Under COPPA, how do I know if my channel is “directed to children”? Since the FTC and New York Attorney General announced their September 2019 settlement with YouTube for violations of the Children’s Online Privacy Protection Act Rule, we’ve heard that question from channel owners – sometimes called content creators. If you’re a channel owner who shares content on user-generated platforms like YouTube, read on for FTC staff guidance about the applicability of the COPPA Rule and how those covered by the Rule can comply with its requirements.
The FTC action against YouTube and Google
The lawsuit against YouTube and Google alleged that the companies illegally collected personal information from children, in violation of COPPA. According to the complaint, the companies collected that information from viewers of child-directed YouTube channels in the form of persistent identifiers that track users across the Internet, but didn’t notify parents and get their consent. To settle the case, YouTube and Google agreed to create a mechanism so that channel owners can designate when the videos they upload to YouTube are – to use the words of COPPA – “directed to children.” The purpose of this requirement is to make sure that both YouTube and channel owners are complying with the law.
A COPPA recap
That provision of the settlement has raised questions among content creators about how to determine if what they upload to YouTube or other platforms is “directed to children.” The answer requires a brief summary of some key COPPA provisions. Passed by Congress in 1998, the Children’s Online Privacy Protection Act is a federal law that protects the privacy of children under 13. COPPA’s foundational principle is one that most people can agree on: Parents – not kids, companies, platforms, or content creators – should be in control when it comes to information collected from children online.
The FTC enforces the law through the COPPA Rule. In general, COPPA requires operators of commercial websites and online services that are directed to children (more about that in a minute) to provide notice and obtain verifiable parental consent before they collect personal information from kids under 13.
The COPPA Rule defines “personal information” to include obvious things like a child’s first and last name or home address, but that’s not all. Under COPPA, personal information also covers what are called persistent identifiers – behind-the-scenes code that recognizes a user over time and across different sites or online services. That could be an IP address or a cookie when it’s used to serve targeted ads. Keep in mind that an operator also might be collecting personal information through an open comment field on its site or service that allows a user under 13 to make personal information publicly available. For example, think of a comment like this on a child-directed site: My name is Mary Jones from Springfield. I love this video!
How COPPA applies to channel owners
So how does COPPA apply to channel owners who upload their content to YouTube or another third-party platform? COPPA applies in the same way it would if the channel owner had its own website or app. If a channel owner uploads content to a platform like YouTube, the channel might meet the definition of a “website or online service” covered by COPPA, depending on the nature of the content and the information collected. If the content is directed to children and if the channel owner, or someone on its behalf (for example, an ad network), collects personal information from viewers of that content (for example, through a persistent identifier that tracks a user to serve interest-based ads), the channel is covered by COPPA. Once COPPA applies, the operator must provide notice, obtain verifiable parental consent, and meet COPPA’s other requirements. For information on how to comply with COPPA, please visit the FTC’s COPPA page for our Six-Step Compliance Plan for Your Business.
How channel owners can determine if their content is directed to children
Under COPPA, there is no one-size-fits-all answer about what makes a site directed to children, but we can offer some guidance. To be clear, your content isn’t considered “directed to children” just because some children may see it. However, if your intended audience is kids under 13, you’re covered by COPPA and have to honor the Rule’s requirements.
The Rule sets out additional factors the FTC will consider in determining whether your content is child-directed:
- the subject matter,
- visual content,
- the use of animated characters or child-oriented activities and incentives,
- the kind of music or other audio content,
- the age of models,
- the presence of child celebrities or celebrities who appeal to children,
- language or other characteristics of the site,
- whether advertising that promotes or appears on the site is directed to children, and
- competent and reliable empirical evidence about the age of the audience.
The determination of whether content is child-directed will be clearer in some contexts than in others, but we can share some general rules of thumb. First, unless you’re affirmatively targeting kids, there are many subject matter categories where you don’t have to worry about COPPA. For example, if your videos are about traditionally adult activities like employment, finances, politics, home ownership, home improvement, or travel, you’re probably not covered unless your content is geared toward kids. The same would be true for videos aimed at high school or college students. On the other hand, if your content includes traditional children’s pastimes or activities, it may be child-directed. For example, the FTC recently determined that an online dress-up game was child-directed.
Second, just because your video has bright colors or animated characters doesn’t mean you’re automatically covered by COPPA. While many animated shows are directed to kids, the FTC recognizes there can be animated programming that appeals to everyone.
Third, the complaint in the YouTube case offers some examples of channels the FTC considered to be directed to children. For example, many content creators explicitly stated in the “About” section of their YouTube channel that their intended audience was children under 13. Other channels made similar statements in communications with YouTube. In addition, many of the channels featured popular animated children’s programs or showed kids playing with toys or participating in other child-oriented activities. Some of the channel owners also enabled settings that made their content appear when users searched for the names of popular toys or animated characters. Want to see the FTC’s analysis in context? Read pages 10-14 of the YouTube complaint.
Finally, if you’ve applied the factors listed in the COPPA Rule and still wonder if your content is “directed to children,” it might help to consider how others view your content and content similar to yours. Has your channel been reviewed on sites that evaluate content for kids? Is your channel – or channels like yours – mentioned in blogs for parents of young children or in media articles about child-directed content? Have you surveyed your users or is there other empirical evidence about the age of your audience?
What are the possible penalties for violating COPPA?
The Rule allows for civil penalties of up to $42,530 per violation, but the FTC considers a number of factors in determining the appropriate amount, including a company’s financial condition and the impact a penalty could have on its ability to stay in business. While Google and YouTube paid $170 million, in another COPPA case settled this year, the operator paid a total civil penalty of $35,000.
Isn’t the FTC taking another look at the COPPA Rule?
Yes, the FTC is currently evaluating the Rule in light of rapid changes in technology. If you would like to comment on the effectiveness of the COPPA Rule and whether changes are needed, the FTC has extended the comment deadline to December 9, 2019.
Where can channel owners go for more information?
A look at the factors in the COPPA Rule will help most channel owners determine if their content is directed to children. If you’re still unsure about how COPPA applies to you, consider contacting an attorney or consulting with one of the COPPA Safe Harbor programs – self-regulatory groups that offer guidance on how operators can comply with the law. Visit the FTC’s website for a list of currently approved Safe Harbor organizations. For more resources, visit the FTC’s Children’s Privacy page for our Six-Step Compliance Plan for Your Business.
The purpose of this blog and its comments section is to inform readers about Federal Trade Commission activity, and share information to help them avoid, report, and recover from fraud, scams, and bad business practices. Your thoughts, ideas, and concerns are welcome, and we encourage comments. But keep in mind, this is a moderated blog. We review all comments before they are posted, and we won’t post comments that don’t comply with our commenting policy. We expect commenters to treat each other and the blog writers with respect.
- We won’t post off-topic comments, repeated identical comments, or comments that include sales pitches or promotions.
- We won’t post comments that include vulgar messages, personal attacks by name, or offensive terms that target specific people or groups.
- We won’t post threats, defamatory statements, or suggestions or encouragement of illegal activity.
- We won’t post comments that include personal information, like Social Security numbers, account numbers, home addresses, and email addresses. To file a detailed report about a scam, go to ReportFraud.ftc.gov.
We don't edit comments to remove objectionable content, so please ensure that your comment contains none of the above. The comments posted on this blog become part of the public domain. To protect your privacy and the privacy of other people, please do not include personal information. Opinions in comments that appear in this blog belong to the individuals who expressed them. They do not belong to or represent views of the Federal Trade Commission.
In reply to These rules are incredibly by Guest
Under Step #1 of the Six Step Compliance Plan for Your Business, you must comply with COPPA if:
Your website or online service is directed to children under 13 and you collect personal information from them.
Your website or online service is directed to children under 13 and you let others collect personal information from them.
Your website or online service is directed to a general audience, but you have actual knowledge that you collect personal information from children under 13.
Your company runs an ad network or plug-in, for example, and you have actual knowledge that you collect personal information from users of a website or service directed to children under 13.
In reply to Is this seriously it, or is by Guest
Follow the links in the blog for additional information.