Disney is set to pay $10 million to settle allegations that it violated the Children’s Online Privacy Protection Rule (“COPPA Rule”) by failing to properly label videos that it uploaded to YouTube as “Made for Kids” (“MFK”).
The COPPA Rule applies to any operator of a commercial website or online service directed to children that collects, uses, and/or discloses personal information from children. The Rule requires an operator to meet specific requirements prior to processing children’s personal information, including clearly disclosing its information practices directly to parents, posting a prominent and clearly labeled link to an online notice of its information practices with regard to children, and obtaining parental consent prior to collecting, using, and/or disclosing personal information from children. A violation of the Rule constitutes an unfair or deceptive act or practice in violation of Section 5(a) of the Federal Trade Commission (“FTC”) Act.
A lawsuit filed by the Department of Justice, acting upon the FTC’s notification, in September last year alleged that Disney makes popular videos directed towards children available through YouTube and fails to properly mark videos as child-directed in some cases, allowing targeted advertising through collection of personal information from children without parental notice or consent. During the relevant time period of 2020 through the present, Disney allegedly operated and uploaded videos to more than 1,250 YouTube channels through numerous subsidiaries.
Following a 2019 settlement with the FTC over allegations it violated COPPA, YouTube informed content creators, including Disney, that they would be “required to tell [YouTube] if [their] content is made for kids” to comply with COPPA. YouTube allows content creators to mark their channel as “Made for Kids” or “Not Made for Kids,” or review settings for each video, and relies on this designation to determine what functionality and advertising it should make available on videos. When a video is set as MFK, certain functionality is disabled by YouTube, for example, comments and targeted advertising, and when a video is marked as MFK it will exclusively autoplay to other videos marked as MFK.
The Complaint alleges that Disney sets the audience designation for a channel as MFK or NMFK, and adheres to the designation when uploading individual videos to that channel. Accordingly, when a video is uploaded to a channel Disney has designated as NMFK, Disney would allow the video to remain by default designated as NMFK, even if the video were child-directed. Many of these videos allegedly feature clips of popular kids’ characters and movies, including Mickey Mouse, Frozen, Moana, Cars, Tangled, Ratatouille, and Toy Story, that include subject matter, music, and other content directed to children.
According to the lawsuit, YouTube informed Disney in June 2020 that it had changed the designations from NMFK to MFK for more than three hundred videos on channels that included Pixar, Disney, Disney Movies, Walt Disney Animation Studios, and Oh My Disney. However, Disney did not revise its policy of designating videos based on the channel-level default rather than designating individual videos as MFK.
In late December, a federal judge approved a Settlement Order requiring Disney to comply with the COPPA’s notice and consent requirements, establish a 10-year program to review its YouTube videos and designate appropriate videos as MFK, and pay a civil penalty of $10 million. Disney will also be required to submit a compliance report to the FTC one year after the entry of the Order, and create and maintain records relating to COPPA compliance for 10 years after the entry of the Order. The FTC has been empowered to monitor compliance with the Order, including being able to request additional compliance reports or information and take depositions.
This massive settlement and strict compliance regime highlight the heightened scrutiny companies face when dealing with children’s data. If your website or online services are directed to children under 13, or collect personal information from children under 13, make sure you have the required notices in place – or reach out to us for assistance!
You can read the Settlement Order here.
CIPAWorld 