I. Introduction

The Children’s Online Privacy Protection Act (COPPA) directed the Federal Trade Commission (FTC) to promulgate rules to protect children’s privacy and data on the internet, and to vest decision-making authority about what to do with that data in the hands of parents. In September 2019, the FTC and YouTube entered into the largest monetary settlement under COPPA to date for violations of the existing rules.[1] Following the settlement, the FTC announced in July 2019 that it would begin accepting comments on possible revisions to the COPPA rule.[2]

The notice and comment period generated over 175,000 comments from industry groups, content creators, privacy advocates, government officials, and other interested parties.[3] The battle lines have largely been drawn in this case. YouTube (and its parent company, Google), trade groups, and content creators believe the rules are overly inclusive and will result in a drastic decrease in revenue for child-appropriate content. Any hit to the pocketbooks of content creators is likely to result in an environment where high-quality, child-appropriate content is simply no longer available because of a lack of incentive to develop it. Privacy advocates on the other side argue that the stringent protections are necessary in order to protect children’s online identities. The rule should be strengthened given the embedded nature of the internet in our daily lives.

This Comment will begin by explaining the major features of COPPA and the COPPA rule. Next, this Comment will explore the unique nature of YouTube and the difficulties of COPPA compliance for a platform that relies on third-party content creators. The next Part will outline the arguments for strengthening and loosening the rule and will assess their strengths and weaknesses. Finally, this Comment will suggest some prescriptive measures that the FTC should take prior to amending the rule.

II. Background

A. A Primer on COPPA Mechanics

1. Purpose and Definitions.

The drafters of COPPA sought to achieve four goals with the enactment of the bill: (1) empower parents to protect the privacy of children online; (2) protect children’s safety in their use of online channels; (3) ensure the security of children’s personally identifiable information; and (4) require parental consent when collecting personal information from children.[4]

The Act directed the FTC to promulgate rules requiring website and online service operators to obtain “verifiable parental consent” when the website has actual knowledge that the user is a child.[5] The FTC issued the first iteration of the “COPPA rule” in 1999, taking effect in April 2000.[6] Since the bill was enacted, internet use among children and teens has increased dramatically.[7] Further, tablets and mobile devices have changed the way children play, learn, communicate, and entertain themselves.[8] The FTC issued the final round of amendments to the rule in 2012, taking effect in 2013.[9] The 2013 revisions expanded the categories of data collected that qualify as personal information, in addition to extending the types of websites covered by the rule.[10] While the FTC normally reviews rules and regulations every ten years,[11] the agency announced in July 2019 that the rule would be reviewed for revisions and opened the floor for public comments.[12] The proposed topics for comment included the verifiable parental consent requirement, the correct factors for determining whether a website qualifies as child-directed, and whether smart TVs and video games fall under the guise of the rule, among others.[13]

The COPPA rule defines a child as any person under the age of thirteen.[14] Operators of websites or online services are prohibited from collecting[15] personal information[16] from children if the website is directed towards children[17] or the operator has actual knowledge a child is using the site or service,[18] unless the operator has obtained verifiable parental consent.[19] Operators are also required to take “reasonable steps” to ensure that when a child’s personal information is shared with third parties, that those third parties are also COPPA-compliant.[20]

2. Website Categories.

For purposes of COPPA compliance, the FTC specifies that there are three categories of websites: (1) child-directed websites; (2) general audience websites; and (3) mixed audience websites.[21] A website qualifies as child-directed based on the subject matter of content, the visual appearance of the website, the site’s marketing practices, and data regarding the actual users of the site.[22] Websites that qualify as child-directed are subject to the restrictions on collection of personal information and are subject to heightened privacy requirements.[23] Under the COPPA rule, child-directed websites or service operators are required to treat all users as if they are children.[24]

General audience websites are not defined in the rule or the statute. The simplest answer as to what type of website qualifies as general audience is a website that hosts content not directed at a child audience.[25] The FTC offered clarification as to the type of content the agency would expect to find on a general audience website in response to questions generated during the notice and comment period in 2019.[26] Content including “traditionally adult activities like employment, finances, politics, home ownership, home improvement, or travel, [is] probably not covered.”[27] General audience websites do not fall under the COPPA restrictions unless they have actual knowledge that a child is using their website.[28]

Like general audience websites, mixed audience websites are not defined in the rule. Mixed audience websites are websites intended for a primary audience other than children but may contain content or subject matter that attracts children as a secondary audience.[29] A website that targets teens as the primary audience is not strictly directed toward children because the primary audience is over the age of thirteen; however, the website may still qualify as child-directed if the factors balance in that direction.[30] Mixed audience websites are subject to the COPPA rule if they have actual knowledge that a child is using the site.[31] Further, they are permitted to “age gate”[32] their websites to prevent collection of personal information from children or obtain consent prior to doing so.[33]

3. FTC Enforcement Mechanisms.

A violation of COPPA regulations is treated as an “unfair or deceptive act or practice” and therefore falls under the auspices of the FTC Act.[34] The FTC Act allows the Commission to enforce regulations through civil penalties, injunctions, and compliance monitoring.[35] State Attorneys General may also bring an action on behalf of state residents under COPPA for violations of the rule.[36]

COPPA also allows for self-regulation through the safe harbor provision. The COPPA safe harbor program allows for industry groups to set up and administer a self-regulatory compliance program.[37] The safe harbor privacy protection regulations are required to meet a minimum standard amounting to “substantially . . . the same or greater” protections as outlined in COPPA[38] and must submit guidelines before being approved by the FTC.[39] Safe harbors allow for application and website developers, content creators, and other entities that publish content for children to receive regulatory guidance without being subject to enforcement action. Existing safe harbors include the Children Advertising Review Unit (CARU),[40] Entertainment Software Rating Board (ESRB),[41] Privacy Vaults Online (PRIVO), and TRUSTe.[42] Once a company has signed on and demonstrated compliance with the policies of the safe harbor, they are able to display a seal of approval to signify to consumers that the website, game, or application is COPPA-compliant.[43] More importantly, failure to comply with the safe harbor’s standards is considered an unfair and deceptive trade practice and subject to enforcement by the FTC.

B. COPPA as Applied to YouTube

YouTube is an online video hosting and sharing platform.[44] YouTube is the second-most-visited website in the world, outclassed only by its parent company, Google.[45] One of the features that makes YouTube unique is that content is created and presented by users called “channel owners.”[46] Channel owners post videos to their channels where other users can watch, comment, like, share, and subscribe to see more content from that channel.[47] YouTube does not require an account for users to watch videos; users only need an account to comment and post their own content.[48] In order to create a Google or YouTube account, users must certify that they are thirteen years of age or older.[49] YouTube is free to use;[50] however, channel owners can monetize their videos by enabling advertising.[51] On average, “YouTubers” pull in almost $10 per 1,000 views in advertising revenue.[52]

Channel owners uploading content to YouTube fall under COPPA’s statutory definition of “website or online service.”[53] In terms of compliance, channel owners are treated as if they are their own website or online service.[54] The FTC has been clear that the agency intends to bring enforcement action against individual channel owners if they are found to be violating COPPA.[55] Andrew Smith, then-chief of the FTC Bureau of Consumer Protection, indicated that the agency would sweep the YouTube platform to ensure that child-directed content was being properly handled by channel owners.[56]

An analysis of the most popular channels on YouTube revealed content directed at children, especially content featuring a child under the age of thirteen, was more popular in terms of views and appeared on channels with more subscribers than content aimed at a general audience.[57] The popularity of children’s content on YouTube is probably not a surprise to parents. A Pew Research Center survey revealed “81% of all parents with children age 11 or younger . . . let their child watch videos on YouTube,” with 34% indicating that they allow their child to do this regularly.[58] YouTube itself marketed the platform as “the #1 website regularly visited by kids” and the “new Saturday Morning Cartoons.”[59] While the popularity of YouTube among children is undeniable, YouTube is not a child-directed website. The difficulties of determining which audience definitions under COPPA apply to a platform like YouTube are instructive for the complexities of compliance with the rule.

YouTube operates in a COPPA gray area. While some of the content hosted on the site is directed towards children, it is also fairly characterized as a general audience platform hosting content related to sports, politics, instructional videos, and product reviews.[60] YouTube does offer a “kid-friendly” version of its platform called YouTube Kids;[61] however, Common Sense Media conducted a poll in partnership with SurveyMonkey indicating that 81% of parents let their child watch YouTube via the general audience platform, either through the mobile app or on a computer.[62] Only 24% of parents indicated their children watch YouTube via the YouTube Kids application.[63]

C. FTC v. YouTube

The FTC entered into its largest settlement under COPPA against YouTube in September 2019.[64] The principal complaint levied against YouTube is that, despite meeting the COPPA rule’s definition of a child-directed website, YouTube insisted to channel owners and advertisers alike that the platform was intended for a general audience and did not require COPPA compliance.[65] However, the COPPA rule applies to websites that have actual knowledge that a child is using their website,[66] and the FTC argued that YouTube’s representations to advertisers and channel owners showed the company had actual knowledge that children were using the site.[67]

There is no way to know for sure how much advertising revenue YouTube generated from inappropriate content directed towards children. However, the FTC’s complaint against YouTube revealed that among the channels highlighted, “which represent only a few examples of the possible universe of child-directed content,” YouTube earned nearly $50 million.[68] Further, a recent study indicated that 85% of children’s videos contained at least one advertisement, and videos targeting early-childhood-age children, elementary-age children, and teens had higher total ad counts than videos directed towards adults.[69] The FTC’s complaint did spawn a shareholder derivative lawsuit against Alphabet Inc.[70] (Google and YouTube’s parent company), but it does not appear that the $170 million judgment against YouTube will make much of a financial dent in the company’s deep pockets.[71] In some ways, the FTC is limited by its own willingness to levy relatively small penalties on companies for violating consumers’ privacy.[72] Thus, while many may argue that a larger fine was warranted against YouTube, the FTC was bound by the constraints of “injury to the public.”[73] The FTC has other enforcement mechanisms in its arsenal,[74] and it employed some of them against YouTube.[75] The consent decree appeared to incentivize YouTube to change its policies and practices.[76] Yet, the question remains whether a prohibition on the activity that led to the enforcement action in the first place will be any more effective at deterring the conduct than the pre-existing rules and regulations.

D. YouTube’s Policy Changes Following the Settlement

To comply with the court’s order, YouTube implemented a number of policy changes impacting creators and channel owners throughout its ecosystem. First, YouTube mandated that all channel owners need to designate an audience for already-published videos and forthcoming videos.[77] This policy impacts all YouTube users regardless of their location.[78] Channel owners must designate their videos as “made for kids” or not made for kids.[79] The audience setting can be done on a video-by-video basis or on a channel level as a whole.[80] YouTube will also use machine learning to identify and classify videos as made for kids; however, the site warns creators not to “rely on our systems to set your audience for you because our systems may not identify content that the FTC or other authorities consider to be made for kids.”[81] YouTube advises creators that they are unable to provide guidance to creators as to whether their audience is set correctly, instead deferring to the FTC’s guidelines.[82]

The “made for kids” audience setting restricts the features available on YouTube videos and channels. The most significant impact to creators is that personalized advertising will no longer be available on videos with the made for kids designation.[83] YouTube notes that this “may result in a decrease in revenue for some creators who mark their content as made for kids.”[84] The same restrictions will apply to videos that YouTube’s machine learning algorithm designates as made for kids.[85] YouTube has not indicated what creators should expect in terms of how significant the financial impact will be as a result of these policy changes, but the expectation is that the impact will be substantial.[86] In order to facilitate the creation of family-friendly content, one of YouTube’s top earning content categories,[87] YouTube pledged over $100 million to a fund “dedicated to the creation of thoughtful, original children’s content on YouTube and YouTube Kids globally.”[88] Other features that will be disabled on made for kids videos include auto play, commenting, channel branding, and save to playlist and watchlist features.[89] At the channel level, in addition to the features that will not be available on individual videos, made for kids channels will not have channel memberships, notifications, or posts and stories.[90]

News of YouTube’s impending policy changes was met with praise from children’s privacy advocates[91] and disdain from content creators.[92] The FTC appears poised to make a change to the COPPA rule that will carve out an exception for mixed audience sites, that is, sites not directed towards children but, nevertheless, have a large number of children that use it.[93] Some have viewed this question, and comments that FTC commissioners have made, as a sign that the agency is ready to weaken the COPPA rule in favor of incentivizing content creators to create better content subsidized by personalized advertising.[94] The next Part will discuss the debate regarding revisions to the COPPA rule, the positions of the major stakeholders, and the efficacy of their arguments.

III. COPPA Reform

The FTC’s request for comments on the future of the COPPA rule generated nearly 175,000 comments. Politicians, privacy advocates, industry and trade associations, YouTubers (and their army of fans), online businesses, and others participated in the process.

A. Content Directed Towards Children

The FTC requested comments on the definitions provided in the rule.[95] Specifically, the request for comment sought feedback as to whether the rule considers the correct factors, whether the factors need to be clarified, and whether the definition should be amended to account for websites that have mixed audiences.[96]

Google, YouTube’s parent company, responded to the request for comment to articulate its position on this precise question.[97] Google believes that the distinction between general audience content and child-directed content is easiest to determine at the extreme ends of the spectrum where content is designed to appeal exclusively to a child audience or general audience website.[98] The distinction becomes much more difficult to parse out for mixed audience channels.[99] This is a problem articulated by YouTubers as well.[100] Gaming-related content is one of the most popular content categories on YouTube.[101] Some gaming content features characters that are likely to appeal to children,[102] yet the general tone and language of the video may be entirely inappropriate for an audience under the age of thirteen.[103] Thus, on its face, the content of the video may indicate that the video is intended to target children as a primary or secondary audience. Viewed in context, however, a reasonable observer would probably conclude that the creator had no intention of targeting children, but rather a general audience.[104] The factors provided in the rule make it difficult for content creators to determine whether they are making videos that could be construed as directed towards children for purposes of COPPA compliance; some creators have resorted to shedding their signature costumes in order to avoid the made for children designation.[105]

Drawing on lessons from the FTC’s enforcement action against Yelp,[106] presumably one method a website could use to avoid compliance with COPPA is to refrain from asking for age at all or not to allow children under the age of thirteen to create an account.[107] The COPPA rule attempts to account for the willful disregard of a user’s age by requiring that any website that is directed towards children comply with the personal information minimization procedures and verifiable parental consent requirements.[108]

While there is some common sense to the request for clarity, some advocates have argued that Google’s position on this point is disingenuous at best.[109] Google is in the business of personalized marketing,[110] and its algorithms are able to accurately predict a user’s attributes such as age, education level, home ownership status, and other interests.[111] Advertising networks boast that they can drill down target audiences to such specificity as to target people who have visited hospitals or medical care facilities.[112] “In other words, these companies possess information that can and should be used to affirmatively identify websites or online services that are child-directed in practice . . . .”[113] The irony of this proposition is that in order for companies to accurately predict the age of a user without implementing an age-gate system, they would be required to engage in passive tracking of children—in violation of current COPPA rules.

B. Rebuttable Presumption that Children Are the Users of Child-Directed Websites

One possible solution to the audience identification conundrum is to allow website operators to rebut the presumption that users of child-directed content are children. Google advocated for this policy change arguing that third-party platforms that host child-directed content should be able to “treat their adult users as adults, with the appropriate safeguards . . . .”[114] This option was on the table during the 2013 COPPA revisions, but ultimately, the commission chose to maintain the policy that users of child-directed content were to be treated as children.[115] Under a rebuttable presumption model, adult users logged in to profiles on general audience platforms that engage with child-directed content would be treated normally.[116] Users engaging with child-directed content that were not signed into a profile would be treated as children.[117] Google’s rationale for the implementation of the rebuttable presumption policy is that the statute itself only prohibits collection of data and personal information from children; adults were never intended to be covered by the statute.[118] Thus, a rebuttable presumption model more accurately accomplishes the law’s intended purpose. Google’s proposed mechanism for rebutting the presumption is to use a similar approach to verifiable parental consent.[119]

Google’s proposal, while practical, has some obvious flaws. First, the rebuttable presumption standard assumes that anyone signed in as an adult is an adult. YouTube does not allow users to register for accounts if they are under the age of thirteen,[120] thus, many children use their parent’s general audience YouTube account.[121] The proposal does not account for the data that will be collected from children using their parents’ YouTube accounts.

YouTube is responsible for the content that is hosted on its application, but parental supervision will always be the last line of defense against privacy violations and inappropriate content being directed towards children. However, many parents have assisted their children in subverting the privacy protections currently available to children.[122]

Second, verifiable parental consent has not been implemented effectively, in part because of the lack of guidance from the rule. Some ambiguity in the wording of the rule is probably necessary in order to allow for flexibility in approaches to implementation. However, it is surprising that Google would want to introduce more vagueness into the rule when one of the principal complaints levied against COPPA is the lack of clarity.[123]

Future implementation of the COPPA rule will need to engage in some give-and-take to both sides of the argument. The FTC should certainly not grant Google a wish list of proposed COPPA reforms, but rather should engage in a balancing of interests on both sides of the argument. There is undoubtedly a need to protect children online, but COPPA has largely targeted the wrong parties with ineffective methods.

C. Enable Children’s Content Creators to Monetize Their Content by Incentivizing the Safe Harbor Framework

Content creators, websites, and application developers need to have an economic incentive to create child-friendly content. On YouTube, channel owners who enable personalized advertising have an opportunity to earn more from advertisements displayed on their videos than those with contextual advertisements.[124] Further, mobile application developers depend on analytics from application usage to drive monetary earnings.[125] One possible solution to ease the tension between privacy and monetization that the FTC should explore is expanding COPPA’s existing safe harbor framework.

Even though safe harbors purport to offer at least the same level of privacy protection as currently guaranteed by COPPA, there is evidence to indicate that safe harbors may not be any more effective in implementing the required privacy standards.[126] One element of the impending COPPA rule change the FTC should consider is strengthening the standards required for safe harbors, and to require the safe harbor certifying organizations to list publicly the companies, applications, websites, and services that are members. This would ensure that the general public can take advantage of the FTC’s reporting mechanism against safe harbor operators in addition to developers and operators.

YouTube could make its platform safer by implementing its own safe harbor program. YouTube has already indicated that it will implement more stringent standards for creators if they wish to publish child-directed content; however, it will do so with the aid of machine learning and algorithmic safety measures.[127] YouTube’s algorithm and machine learning capabilities are vulnerable to exploitation by bad actors and content creators creating parodies of otherwise appropriate children’s content.[128] The YouTube algorithm is designed to keep users on the site for as long as possible; thus, the site is vulnerable to delivering the user the next video in the chain and is not designed to ensure that video is appropriate for the user that is watching.[129] YouTube hired thousands of human moderators to police content on the platform, yet there may still be additional steps that need to be taken to ensure a safe platform for children.[130]

The safe harbor business model would translate well to YouTube’s existing business model and would likely result in greater content and privacy protections for children. YouTube, as the safe harbor, would be responsible for providing policies and procedures to the FTC for approval.[131] Further, under the rule, YouTube would be required to regularly report on compliance and identify any potential violations of safe harbor procedures. YouTube already has a network of existing channel owners and content creators that are subject to their guidance and content-control policies.[132] The next step in creating a safer environment for children on YouTube would require creators to designate content and channels as being child-directed. YouTube should curate a specific feed of child-approved content that is moderated and reviewed by humans rather than artificial intelligence. Finally, YouTube will need to find a way to market this application widely to parents. This will probably require YouTube to make the platform available on the web as well as in a mobile application. One of the reasons parents purportedly did not use YouTube Kids as frequently as general audience YouTube is because the convenience factor of the standard YouTube application outweighed privacy and safety priorities.[133] The FTC should consider requiring YouTube to publicly disclose the exploitation of the recommended videos algorithm as a possible mechanism of incentivizing parents to use the kid-friendly version of the application.

IV. Conclusion

While the scope of this paper was limited to the COPPA rule’s application to YouTube, the problems outlined are pervasive across the internet. Platforms like Twitch[134] share similarities with YouTube: content created by third parties,[135] behavioral advertising powered by consumer data collection,[136] and content likely to appeal to a child audience.[137] Any change to the COPPA rule is bound to have broad implications for YouTube, Twitch, and other emerging forms of entertainment. Ambiguities in the rule have done little to ensure effective compliance and have more than likely subverted the intent of the rule by encouraging willful ignorance of child users to avoid the loss of earnings. The law is in need of improvement; it should be written to accommodate for future shifts in technology as the universe of applications and websites expands. Further, the FTC should consider revising the scheduled updates to every five years, instead of ten, as it currently stands. Rolling back privacy protections for children, as they navigate an increasingly more dangerous internet, is a dangerous path forward. The solution is to find a common-sense approach to providing more stringent privacy protections.

Stuart Cobb

  1. Press Release, Fed. Trade Comm’n, $170 Million FTC-NY YouTube Settlement Offers COPPA Compliance Tips for Platforms and Providers (Sept. 4, 2019), https://www.ftc.gov/news-events/blogs/business-blog/2019/09/170-million-ftc-ny-youtube-settlement-offers-coppa [https://perma.cc/AZW4-WENQ].

  2. Press Release, Fed. Trade Comm’n, FTC Extends Deadline for Comments on COPPA Rule Until December 9 (Oct. 17, 2019), https://www.ftc.gov/news-events/press-releases/2019/10/ftc-extends-deadline-comments-coppa-rule-until-december-9 [https://perma.cc/M5RF-J9HU].

  3. See Fed. Trade Comm’n, Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s Online Privacy Protection Rule, Regulations.gov (July 24, 2019), https://www.regulations.gov/document/FTC-2019-0054-0001 [https://perma.cc/7PH2-6JJ7].

  4. 144 Cong. Rec. 23926 (1998) (statement of Sen. Bryan).

  5. 15 U.S.C. § 6502(b)(1)(A).

  6. Press Release, Fed. Trade Comm’n, New Rule Will Protect Privacy of Children Online (Oct. 20, 1999), https://www.ftc.gov/news-events/press-releases/1999/10/new-rule-will-protect-privacy-children-online [https://perma.cc/89B3-P3KE].

  7. Compare Eric C. Newburger, U.S. Census Bureau, Home Computers and Internet Use in the United States: August 2000, at 2 (2001), https://www.census.gov/prod/2001pubs/p23-207.pdf [https://perma.cc/CT3N-8L6H] (citing Census Bureau data indicating 19% of children aged three to seventeen used the internet at home in 1998), with Computer and Internet Access in the United States: 2012, U.S. Census Bureau (Aug. 24, 2016), https://www.census.gov/data/tables/2012/demo/computer-internet/computer-use-2012.html [https://perma.cc/76XK-VPPQ] (indicating 62% of children accessed the internet at home in 2012).

  8. While TV still dominates “screen time” of both teens and tweens, “mobile devices now account for 41 percent of all screen time among tweens and 46 percent among teens.” Common Sense Media, The Common Sense Census: Media Use by Tweens and Teens 16 (2015), https://www.commonsensemedia.org/sites/default/files/uploads/research/census_researchreport.pdf [https://perma.cc/X75C-TUEX]. Teens spend over half of their time on computers and mobile devices playing games, browsing the internet, using social media, video chatting, texting, and creating content. Id.

  9. Press Release, Fed. Trade Comm’n, FTC Strengthens Kids’ Privacy, Gives Parents Greater Control Over Their Information by Amending Childrens Online Privacy Protection Rule (Dec. 19, 2012), https://www.ftc.gov/news-events/press-releases/2012/12/ftc-strengthens-kids-privacy-gives-parents-greater-control-over [https://perma.cc/T6R4-N5PQ].

  10. Id.

  11. See generally Retrospective Review of FTC Rules and Guides, Fed. Trade Comm’n, https://www.ftc.gov/enforcement/rules/retrospective-review-ftc-rules-guides [https://perma.cc/SLT2-9P7X] (last visited Feb. 6, 2021).

  12. Lesley Fair, New Block on the Kids? FTC Announces COPPA Review and Workshop, Fed. Trade Comm’n: Bus. Blog (July 17, 2019, 3:29 PM), https://www.ftc.gov/news-events/blogs/business-blog/2019/07/new-block-kids-ftc-announces-coppa-review-workshop [https://perma.cc/BE4E-WG52].

  13. Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s Online Privacy Protection Rule, 84 Fed. Reg. 35842, 35843 (proposed July 25, 2019) (to be codified at 16 C.F.R. pt. 312).

  14. 16 C.F.R. § 312.2 (2020).

  15. “Collection” is defined as gathering personal information by any means, including passive tracking using cookies. Id.

  16. “Personal information” is defined in the rule and includes names, physical or electronic addresses, and geolocation information. Id. The rule was amended in 2013 to cover “persistent identifiers”—indicia that it can be used to identify “a user over time and across different Web sites or online services.” Id.

  17. The rule provides that the FTC will consider various factors to determine if a site is directed towards children, including:

    [I]ts subject matter, visual or audio content, age of models, [presence of child celebrities or celebrities who appeal to children], language or other characteristics of the website or online service, as well as whether advertising promoting or appearing on the website or online service is directed to children. The Commission will also con-sider competent and reliable empirical evidence regarding audience composition; [and] evidence regarding the intended audience[.]

    Id.; see also infra Section III.A for further discussion.

  18. Id. § 312.3.

  19. Verifiable parental consent (VPC) may be obtained via methods outlined in the rule. Id. § 312.5(b). The FTC has also approved additional methods of obtaining VPC. See Verifiable Parental Consent and the Children’s Online Privacy Rule, Fed. Trade Comm’n, https://www.ftc.gov/tips-advice/business-center/privacy-and-security/verifiable-parental-consent-childrens-online-privacy-rule [https://perma.cc/LSJ5-6BNQ] (last visited Feb. 6, 2021).

  20. 16 C.F.R. § 312.8; see also id. § 312.2 (indicating release of personal information includes for the purpose of delivering personalized or “contextual advertising”).

  21. See Complying with COPPA: Frequently Asked Questions, Fed. Trade Comm’n [hereinafter COPPA FAQs], https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions#General Audience [https://perma.cc/4SBZ-R4RK] (July 2020).

  22. See 16 C.F.R. §* *312.2 (providing the list of factors in the rule); COPPA FAQs, supra note 21 (“If your service targets children as one of its audiences – even if children are not the primary audience – then your service is ‘directed to children.’” (emphasis added)).

  23. 16 C.F.R. § 312.3.

  24. In the rule’s most current statement of basis and purpose, the Commission responded to comments requesting the requirement to treat all users of child-directed websites to be replaced with a rebuttable presumption that a user of a child-directed website was actually a child. Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3972, 3983–84 (Jan. 17, 2013) (to be codified at 16 C.F.R. pt. 312). The Commission responded that “sites or services whose primary target audience is children must continue to presume all users are children and to provide COPPA protections accordingly.” Id.

  25. See generally Kristin Cohen, YouTube Channel Owners: Is Your Content Directed to Children?, Fed. Trade Comm’n: Bus. Blog (Nov. 22, 2019, 12:56 PM), https://www.ftc.gov/news-events/blogs/business-blog/2019/11/youtube-channel-owners-your-content-directed-children [https://perma.cc/L3FS-7G2X] (noting that content that is not directed towards children is not subject to the COPPA rule, even though children may view it).

  26. Id.

  27. Id. (emphasis added).

  28. 16 C.F.R. § 312.3.

  29. See COPPA FAQs, supra note 21 (noting that a website that has a large number of users under the age of thirteen is a child-directed website).

  30. The FTC notes that mixed-audience website operators should consider the factors when making choices about content. Id.

  31. 16 C.F.R. § 312.3.

  32. Age gates are screening procedures used to identify a child that may be using the website. See COPPA FAQs, supra note 21. Child-directed websites are not required to screen for children. Id.

  33. Id.

  34. 16 C.F.R. § 312.9.

  35. 15 U.S.C. § 45. Civil penalties have been adjusted for inflation to $42,530. Press Release, Fed. Trade Comm’n, FTC Publishes Inflation-Adjusted Civil Penalty Amounts (Mar. 1, 2019), https://www.ftc.gov/news-events/press-releases/2019/03/ftc-publishes-inflation-adjusted-civil-penalty-amounts [https://perma.cc/AK3Z-UMV8].

  36. 15 U.S.C. § 6504(a). Similar enforcement mechanisms are available to the states: injunctions, monetary relief, and compliance enforcement. Id.

  37. 16 C.F.R. § 312.11 (2020).

  38. Id. § 312.10(b)(1)–(3).

  39. Id. § 312.10(a).

  40. CARU is owned and administered by the Better Business Bureau (BBB) as part of a larger initiative to self-regulate advertising in all forms of media. See Better Bus. Bureau Nat’l Programs, Children’s Advertising Review Unit, Better Bus. Bureau, https://bbbprograms.org/programs/caru [https://perma.cc/AJH5-6UMN] (last visited Feb. 6, 2021).

  41. The ESRB is the primary authority that rates video games in mobile, online, and console formats. See Program Services, Ent. Software Rating Bd., https://www.esrb.org/privacy/ [https://perma.cc/EU8L-A7TD] (last visited Feb. 6, 2021).

  42. See generally COPPA Safe Harbor Program, Fed. Trade Comm’n, https://www.ftc.gov/safe-harbor-program [https://perma.cc/FH89-LHBR] (last visited Feb. 6, 2021).

  43. See Ent. Software Rating Bd., supra note 41; see also, e.g., COPPA Safe Harbor Program, PRIVO, https://www.privo.com/coppa-safe-harbor-program [https://perma.cc/F2CZ-M5WN] (last visited Feb. 6, 2021).

  44. What Is YouTube?, Goodwill Cmty. Found., https://edu.gcfglobal.org/en/youtube/what-is-youtube/1/ [https://perma.cc/5LTV-MLNA] (last visited Feb. 7, 2021).

  45. See Top Websites Ranking, SimilarWeb, https://www.similarweb.com/top-websites/united-states [https://perma.cc/HR2G-AQ4J] (Dec. 1, 2020) (ranking methodology can be found here: https://www.similarweb.com/corp/ourdata/ [https://perma.cc/59EJ-A7CR]); The Top 500 Sites on the Web, Alexa, https://www.alexa.com/topsites [https://perma.cc/GW24-U2M2] (last visited Jan. 8, 2020) (ranking methodology can be found here: https://support.alexa.com/hc/en-us/articles/200449744-How-are-Alexa-s-traffic-rankings-determined [https://perma.cc/85L9-73Z5]).

  46. Complaint for Permanent Injunction, Civ. Penalties, and Other Equitable Relief at 7, Fed. Trade Comm’n v. Google, LLC, No. 1:19-cv-2642, 2019 WL 4195860 (D.D.C. Sept. 4, 2019) [hereinafter Complaint for Permanent Injunction].

  47. Id. at 6.

  48. Id.

  49. Create a Google Account for Your Child, Google, https://support.google.com/families/answer/7103338?hl=en [https://perma.cc/8RKU-HT88] (last visited Feb. 7, 2021).

  50. Id.

  51. Advertiser-Friendly Content Guidelines, YouTube Help, https://support.google.com/youtube/answer/6162278?hl=en&ref_topic=9153642 [https://perma.cc/TF9H-AACF] (last visited Feb. 7, 2021).

  52. Advertisers pay approximately $0.18 per view, but YouTube retains forty-five percent of an individual’s ad revenue. Holly Hunt, How Much Do YouTubers Make (and How You Can Make It, Too), G2 (Dec. 4, 2019), https://learn.g2.com/how-much-do-youtubers-make [https://perma.cc/3VN4-KKQH].

  53. 15 U.S.C. § 6501(10)(A); see also Cohen, supra note 25.

  54. Cohen, supra note 25.

  55. Id.

  56. Smith analogized the Commission’s enforcement strategy toward YouTube to “shooting fish in a barrel and YouTube is the barrel and the content creators are the fish.” Andrew Smith, Dir., Bureau of Consumer Prot., Fed. Trade Comm’n, FTC Press Conference on Settlement with Google / YouTube (Sept. 4, 2019), https://www.ftc.gov/news-events/audio-video/video/ftc-press-conference-settlement-google-youtube [https://perma.cc/HPQ7-UKHC].

  57. Patrick Van Kessel et al., Pew Rsch. Ctr., A Week in the Life of Popular YouTube Channels 18–19 (2019), https://www.pewresearch.org/internet/2019/07/25/popular-youtube-channels-produced-a-vast-amount-of-content-much-of-it-in-languages-other-than-english/ [https://perma.cc/7W73-5FED].

  58. Aaron Smith et al., Pew Rsch. Ctr., Many Turn to YouTube for Children’s Content, News, How-To Lessons 7 (2018), https://www.pewresearch.org/internet/2018/11/07/many-turn-to-youtube-for-childrens-content-news-how-to-lessons/ [https://perma.cc/NY2S-F6AD].

  59. Complaint for Permanent Injunction, supra note 46, at Exhibits A, C (attached exhibits A and C contain Google/YouTube’s marketing materials that are quoted above).

  60. See Van Kessel et al., supra note 57, at 6 (cataloging median views per video on YouTube by topical category); Smith et al., supra note 58, at 2–5 (finding that over one-third of all adults in the United States use YouTube to learn new skills and one in five users stay abreast of current events through YouTube).

  61. A Safer Online Experience for Kids, YouTube, https://www.youtube.com/kids/safer-experience/ [https://perma.cc/SA9U-4ZW7] (last visited Feb. 7, 2021) (explaining that YouTube Kids features curated videos appropriate for children and does not allow behavioral advertising or commenting on videos).

  62. Common Sense Media/SurveyMonkey YouTube Poll Topline, Common Sense Media, https://www.commonsensemedia.org/sites/default/files/uploads/pdfs/commonsense-surveymonkey-youtube-topline.pdf [https://perma.cc/5TRY-B8LW] (last visited Feb. 7, 2021).

  63. Id.

  64. $170 Million FTC-NY YouTube Settlement, supra note 1.

  65. Complaint for Permanent Injunction, supra note 46, at 8–9.

  66. 16 C.F.R. § 312.3 (2020).

  67. Complaint for Permanent Injunction, supra note 46, at 14–15.

  68. Id. at 14.

  69. Jenny S. Radesky et al., Common Sense Media, Young Kids and YouTube: How Ads, Toys, and Games Dominate Viewing 15 (2020), https://d2e111jq13me73.cloudfront.net/sites/default/files/uploads/research/2020_youngkidsyoutube-report_final-release_forweb.pdf [https://perma.cc/NV8Y-ZE5C].

  70. Verified Stockholder Derivative Complaint at ¶ 1, Wessels v. Page, No. 5:19-cv-06880, 2019 WL 5420582 (N.D. Cal. Oct. 22, 2019).

  71. See Video Swells to 25% of US Digital Ad Spending, eMarketer (Oct. 9, 2018), https://www.emarketer.com/content/video-swells-to-25-of-us-digital-ad-spending [https://perma.cc/X54E-QFMW] (reporting that YouTube’s total ad revenue in 2018 amounted to $3.36 billion).

  72. Daniel J. Solove & Woodrow Hartzog, The FTC and the New Common Law of Privacy, 114 Colum. L. Rev. 583, 607–08 (2014) (arguing that while consent orders are not legally binding precedent, they function as precedent in part because businesses rely on the principles set down in the orders to guide their future activity).

  73. Id. at 605 (citing United States v. Danube Carpet Mills, Inc., 737 F.2d 988, 993 (11th Cir. 1984) (holding “injury to the public” as an essential element the government must prove to levy civil penalties)).

  74. Id. at 614–19 (outlining the FTC’s use of the following tools in its data protection and privacy enforcement regime: consumer notification and remediation, orders to delete data, requirement to change privacy policies, requirements to implement more stringent data protection programs, independent assessment, “compliance reports,” and notification to the agency when compliance circumstances change).

  75. Stipulated Order for Permanent Injunction and Civil Penalty Judgment at 10–12, Fed. Trade Comm’n v. Google, LLC, No. 1:19-cv-2642 (D.D.C. Sept. 10, 2019), https://www.ftc.gov/system/files/documents/cases/172_3083_youtube_coppa_consent_order_signed.pdf [https://perma.cc/K8G6-DCMJ] (enjoining YouTube from continuing to collect personal information from children without VPC, requiring the company to “develop, implement, and maintain a system for Channel Owners to designate whether their Content on the YouTube Service is directed to Children,” and prohibiting YouTube and content creators from using the personal information they had already collected).

  76. Changes implemented will include requiring channel owners to designate whether their content is directed towards children, removing personalized advertisements on this content, and eliminating features like commenting. YouTube also indicated they would “use machine learning to find videos that clearly target young audiences.” Susan Wojcicki, An Update on Kids and Data Protection on YouTube, YouTube: Off. Blog (Sept. 4, 2019), https://blog.youtube/news-and-events/an-update-on-kids?visit_id=637489509963735032-2588776809&hl=en&rd=1 [https://perma.cc/KT8V-S3BH].

  77. YouTube Help: Set Your Channel or Video’s Audience, Google [hereinafter YouTube Audience Settings], https://support.google.com/youtube/answer/9527654 [https://perma.cc/C5RA-JGLQ] (last visited Jan. 9, 2020).

  78. Id.

  79. Id.

  80. Id.

  81. Id.; see also Wojcicki, supra note 76 (stating that machine learning will be utilized to identify “videos that clearly target young audiences, for example those that have an emphasis on kids characters, themes, toys, or games”).

  82. YouTube Audience Settings, supra note 77. See generally Cohen, supra note 25.

  83. YouTube Audience Settings, supra note 77.

  84. Id.

  85. YouTube will allow creators to change a made for kids designation to a “not made for kids” audience setting; however, YouTube also notes that if they “detect[] error or abuse,” the designation will be changed and the creator will have to appeal to submit feedback to change it back. Id.

  86. During an unofficial experiment, creators disabled personalized advertising on their videos for a short time to simulate the conditions of a made-for-kids video. The experiment showed that the impact of disabling personalized ads was anywhere between a 60% and 90% loss in revenue. Jonathan Katz & Victoria Fener, Is a YouTube COPPAcalypse Coming? FTC Rules Could Start Demonetizing Creators in 2020, TubeFilter (Nov. 5, 2019), https://www.tubefilter.com/2019/11/05/youtube-coppa-adpocalypse-ftc-rules-demonetizing-child-directed/ [https://perma.cc/D6CL-WGQR].

  87. See Van Kessel et al., supra note 57; Smith et al., supra note 58.

  88. Wojcicki, supra note 76.

  89. YouTube Audience Settings, supra note 77.

  90. Id.

  91. Press Release, Campaign for a Com.-Free Childhood, Advocates Who Filed the Privacy Complaint Against Google/YouTube Laud Improvements, but Say FTC Settlement Falls Far Short (Sept. 4, 2019), https://commercialfreechildhood.org/advocates-who-filed-the-privacy-complaint-against-google-youtube-laud-improvements-but-say-ftc-settlement-falls-far-short/ [https://perma.cc/7VHF-72X3].

  92. Some content creators whose genre focuses on video games expressed concern that the mixed-use nature of their channels was in danger by the requirement to designate as either child-directed or general audience. See Julia Alexander, YouTubers Say Kids’ Content Changes Could Ruin Careers, Verge (Sept. 5, 2019), https://www.theverge.com/2019/9/5/20849752/youtube-creators-ftc-fine-settlement-family-friendly-content-gaming-minecraft-roblox [https://perma.cc/P3KL-YF3J].

  93. See Request for Public Comment on the Federal Trade Commission’s Implementation of the Children’s Online Privacy Protection Rule, 84 Fed. Reg. 35842, 35843–44 (proposed July 25, 2019) (to be codified at 16 C.F.R. pt. 312) (requesting public comment regarding the efficacy of the factors that determine whether a website is child-directed as outlined in 16 C.F.R. § 312.2 and whether any changes should address sites “that do not include traditionally child-oriented activities, but that have large numbers of child users”).

  94. Opinion, Don’t Weaken Privacy Protections for Children, N.Y. Times (Oct. 10, 2019), https://www.nytimes.com/2019/10/10/opinion/coppa-children-online-privacy.html [https://perma.cc/2FMP-NRMT].

  95. See Request for Public Comment on the FTC’s Implementation of the Children’s Online Privacy Protection Rule, 84 Fed. Reg. at 35843–44.

  96. Id. at 35843.

  97. Google, Response to Request for Comments on the Federal Trade Commission’s Implementation of the Children’s Online Privacy Protection Rule (Dec. 9, 2019, 3:45 PM) [hereinafter Google’s COPPA Comment], https://www.regulations.gov/document?D=FTC-2019-0054-21661 [https://perma.cc/MFK4-JVSA].

  98. At one end of the spectrum, there is content that is clearly intended for adults like finance, politics, and home improvement projects. At the other end, early childhood educational videos teaching reading and math skills are clearly directed towards children. Id. at 14; see also Cohen, supra note 25 (identifying the types of content that qualifies as directed to a general audience).

  99. “[I]t is difficult to ascertain the line between a service that targets children as one audience, but not the primary audience, and general audience sites that do not target children as any audience but may have children users on their site.” Google’s COPPA Comment, supra note 97.

  100. See, e.g., Dollightful, Help Save Our Channels, YouTube (Nov. 15, 2019), https://www.youtube.com/watch?v=Y0HGa4qQhUk [https://perma.cc/3B9X-X2RH]; The Game Theorists, Game Theory: Will Your Favorite Channel Survive 2020? (COPPA), YouTube (Nov. 22, 2019), https://www.youtube.com/watch?v=pd604xskDmU [https://perma.cc/N7RK-PRMF].

  101. Ekaterina Petrova & Netta Gross, 4 Reasons People Watch Gaming Content on YouTube, Think with Google (June 2017), https://www.thinkwithgoogle.com/consumer-insights/statistics-youtube-gaming-content/ [https://perma.cc/L3HZ-MW4D].

  102. One study indicates that forty-five percent of parents of children aged three to twelve reported that their children play Minecraft. Jane Mavoa et al., Children and Minecraft: A Survey of Children’s Digital Play, 20 New Media & Soc’y 3283, 3289 (2018).

  103. One example is a channel that features gameplay from the popular game Minecraft. The video contains gameplay from Minecraft overlaid with commentary from the channel owner. The commentator uses several swear words and discusses topics that most parents would probably deem inappropriate for their children aged thirteen and under. WILDCAT, The Most Inappropriate Minecraft Series on YouTube. . . Ep 1, YouTube (June 22, 2019), https://www.youtube.com/watch?v=fC-U64_yS9I [https://perma.cc/GBG2-MU8Z].

  104. Google’s position on this matter is that the Commission needs to take a balanced approach when considering the factors that indicate a website or service is child-directed. Further, it argues that for a platform like YouTube, which hosts content created by third parties, the balance of content and context is especially important given that “platforms generally have access only to the content itself, and are not privy to information regarding content creators’ actual or intended audience.” See Google’s COPPA Comment, supra note 97, at 15–16.

  105. In one example, the channel hosts wear unicorn one-piece pajama outfits and provide commentary on a variety of topics, many of which contain humor directed towards adults. Video titles from this channel include “I got pregnant from swimming in a pool[,]” “People who met their online ‘Friend,’” and “The hardest questions asked at Google interviews.” In an effort to comply with COPPA, the hosts stopped wearing the unicorn pajamas so as not to be misconstrued as being directed towards children. An important note here is that the actual content of the videos has not changed other than the hosts’ appearance. See ReactiCorns, How YouTube Killed Our Unicorn Onesies. . . *SERIOUS*, YouTube (Dec. 26, 2019), https://www.youtube.com/watch?v=pEdnbvpTzvs [https://perma.cc/DE8V-XWGR]; ReactiCorns, Video Uploads, YouTube, https://www.youtube.com/channel/UCsxMvzm3AumF6SHsQBva-AA/videos [https://perma.cc/M994-QDYM] (last visited Jan. 10, 2020).

  106. Yelp was penalized $450,000 by the FTC for using an age verification system in a mobile application that allowed users under the age of thirteen to register accounts. Yelp used a third party to implement the age-verification system and was operating under the belief that no users were able to create accounts if they were under the age of thirteen. Because Yelp was collecting personal information from mobile application users, and at least some of them were under the age of thirteen, the FTC found Yelp had actual knowledge that a child was using its website. See United States v. Yelp Inc., No. 3:14-cv-4163, 2014 WL 4721673 (N.D. Cal. Sept. 16, 2014).

  107. YouTube employees responded to an advertiser’s question regarding COPPA compliance using this same logic: “we don’t have users that are below 13 on YouTube . . . so there is no channel/content that is child-directed and no COPPA compliance is needed.” See Complaint for Permanent Injunction, supra note 46, at 8–9.

  108. 16 C.F.R. § 312.3 (2020).

  109. See Hector Balderas et al., Att’y Gen. of N.M., Comment Letter on COPPA Rule Review (Dec. 9, 2019) [hereinafter New Mexico Attorney General’s COPPA Comment], https://www.regulations.gov/document?D=FTC-2019-0054-21675 [https://perma.cc/52F7-3UKX].

  110. About Demographic Targeting, Google Support, https://support.google.com/google-ads/answer/2580383?hl=en [https://perma.cc/AMZ7-BTU2] (last visited Dec. 30, 2020).

  111. See generally Michael Carl Tschantz et al., The Accuracy of the Demographic Inferences Shown on Google’s Ad Settings, Workshop on Priv. Elec. Soc’y (Oct. 15, 2018), https://www1.icsi.berkeley.edu/~mct/pubs/wpes18.pdf [https://perma.cc/5NAC-KVXH].

  112. See, e.g., Hospital, Clinic and Medical Center Visitors, InMobi, https://intelligence.inmobi.com/audience/f15cbffb-f6e6-483c-bd62-f5f7edf51f08 [https://perma.cc/S569-22CQ] (last visited Jan. 19, 2021).

  113. New Mexico Attorney General’s COPPA Comment, supra note 109, at 6.

  114. Google’s COPPA Comment, supra note 97, at 7.

  115. See generally Children’s Online Privacy Protection Rule, 78 Fed. Reg. 3972, 3983–84 (Jan. 17, 2013).

  116. Users in this category would be able to use the full functionality of YouTube (i.e., commenting, personalized advertisements, etc.). Google’s COPPA Comment, supra note 97, at 7–9.

  117. Id. at 7.

  118. 16 C.F.R. § 312.3 (2020) (emphasis added). “It is unlawful for an operator of a website or online service . . . to collect personal information from a child . . . .” 15 U.S.C. § 6502(a)(1).

  119. “Rather than prescribe the use of a specific technology, we encourage the Commission to adopt a standard similar to what currently exists for verifiable parental content, allowing for a diversity of ‘reasonably calculated’ methods that provide reasonable assurance that the person engaging with the content is an adult.” Google’s COPPA Comment, supra note 97, at 10.

  120. Terms of Service, YouTube, https://www.youtube.com/static?template=terms [https://perma.cc/KB86-JV24] (last visited Jan. 15, 2021).

  121. Colin Dixon, YouTube Used by More Children than YouTube Kids, NScreenMedia (Nov. 24, 2020), http://www.nscreenmedia.com/more-kids-youtube-versus-youtube-kids/ [https://perma.cc/T56D-RSDU].

  122. danah boyd et al., Why Parents Help Their Children Lie to Facebook About Age: Unintended Consequences of the 'Children’s Online Privacy Protection Act,’ First Monday (Oct. 31, 2011), https://journals.uic.edu/ojs/index.php/fm/article/view/3850/3075 [https://perma.cc/DM4Q-T4UE] (reporting findings that many parents did not understand the purpose of age requirements was intended to protect their children’s privacy; rather, they believed that their children were mature enough to use the site).

  123. See Google’s COPPA Comment, supra note 97, at 12–14 (asking the FTC for further guidance on the directed towards children factors).

  124. YouTube “enable[s] behavioral advertising by default on monetized channels . . . . The checkbox that allows the channel owner to opt out of behavioral advertising contains text stating that doing so ‘may significantly reduce [the] channel’s revenue.’ When a channel owner opts out of behavioral advertisements . . . [YouTube] serve[s] contextual advertising on the channel, which generates less revenue for the channel owner and [YouTube].” Complaint for Permanent Injunction, supra note 46, at 7.

  125. According to a poll conducted by the App Association, 100% of developers cited loss of analytics as a barrier to developing mobile applications for children. “Without analytics, [companies] are completely in the dark, not making any money, and no chance to make things better.” Morgan Reed, President, The App Ass’n, Presentation at The FTC’s The Future of the COPPA Rule Workshop, Developers and COPPA: Their Real-World Experience (Oct. 7, 2019), https://www.ftc.gov/system/files/documents/public_events/1535372/slides-coppa-workshop-10-7-19.pdf [https://perma.cc/3WM7-HNVB].

  126. Researchers analyzed 5,855 child-directed applications governed by COPPA available for free in the Google Play store. The researchers used a bot to test the functionality of the applications and monitored the data the applications accessed, and the packets being sent from the application. The focus of the study was to monitor data being accessed by applications and the parties with whom the applications shared that data. Of the applications tested, 237 applications were confirmed to be members of safe harbor programs. The study found that over 65% of the applications belonging to safe harbors were sending sensitive data to third parties, while 73% of the general marketplace applications were observed transmitting this data. See Irwin Reyes et al., “Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale, Proc. on Priv. Enhancing Tech., June 6, 2018, at 66, 69, 74–75.

  127. Wojcicki, supra note 76.

  128. The YouTube Kids platform’s filter was exploited by child-inappropriate content containing knock-off nursery rhymes, parody cartoons, and gross-out videos posing as child-friendly while exposing children to disturbing imagery. Sapna Maheshwari, On YouTube Kids, Startling Videos Slip Past Filters, N.Y. Times (Nov. 4, 2017), https://www.nytimes.com/2017/11/04/business/media/youtube-kids-paw-patrol.html?_r=0 [https://perma.cc/WPC7-TBQN]. Less than two years later, a YouTuber uncovered a “wormhole” of “soft-core” child pornography aided by YouTube’s “recommended” and “up next tabs,” which are driven by algorithms and machine learning. MattsWhatItIs, Youtube Is Facilitating the Sexual Exploitation of Children, and It’s Being Monetized (2019), YouTube (Feb. 17, 2019), https://www.youtube.com/watch?v=O13G5A5w5P0&vl=en [https://perma.cc/8VRK-XQJA]. The common denominator between both the “wormhole” videos and the parodies featuring popular children’s characters is that both sets of videos were monetized with advertising. K.G. Orphanides, On YouTube, a Network of Paedophiles Is Hiding in Plain Sight, Wired (Feb. 20, 2019), https://www.wired.co.uk/article/youtube-pedophile-videos-advertising [https://perma.cc/6L22-FGWF]; James Bridle, Something Is Wrong on the Internet, Medium (Nov. 6, 2017), https://medium.com/@jamesbridle/something-is-wrong-on-the-internet-c39c471271d2 [https://perma.cc/L2ZM-GE2T] (discussing the popularity of cartoon character parody videos: “On-demand video is catnip to both parents and to children, and thus to content creators and advertisers. Small children are mesmerised by these videos, whether it’s familiar characters and songs, or simply bright colours and soothing sounds.”).

  129. Craig Timber, YouTube Says It Bans Preteens from Its Site. But It’s Still Delivering Troubling Content to Young Children, Wash. Post (Mar. 14, 2019, 2:38 PM), https://www.washingtonpost.com/technology/2019/03/14/youtube-says-it-bans-preteens-its-site-its-still-delivering-troubling-content-young-children/ [https://perma.cc/5XU9-B6WX].

  130. Susan Wojcicki, Expanding Our Work Against Abuse of Our Platform, YouTube Off. Blog (Dec. 4, 2017), https://youtube.googleblog.com/2017/12/expanding-our-work-against-abuse-of-our.html [https://perma.cc/RZ68-7PC9].

  131. 16 C.F.R. § 312.11(c)–(d) (2020).

  132. Child Safety on YouTube, Google Support, https://support.google.com/youtube/answer/2801999?hl=en [https://perma.cc/L8SM-6XPG] (last visited Jan. 17, 2021).

  133. Dixon, supra note 121.

  134. Twitch is an online live-streaming broadcast platform popular among video game streamers. Joseph Yaden, What is Twitch?, DigitalTrends (Nov. 27, 2020), https://www.digitaltrends.com/gaming/what-is-twitch/ [https://perma.cc/FC7H-9AV3].

  135. Id.

  136. Third Party Websites and Applications Privacy Impact Assessment – Twitch Advertising, U.S. Dep’t Health & Hum. Servs. (Sept. 16, 2016), https://www.hhs.gov/pia/third-party-websites-and-applications-pia-twitch-advertising.html [https://perma.cc/EH3P-GMQ9].

  137. See Frannie Ucciferri, Parents’ Ultimate Guide to Twitch, Common Sense Media, https://www.commonsensemedia.org/blog/parents-ultimate-guide-to-twitch [https://perma.cc/3WFV-EUK2] (last visited Jan. 16, 2021).