A federal judge approved an order requiring Walt Disney Co. to pay $10 million to settle allegations the company allowed personal data to be collected from children who viewed kid-directed videos on YouTube without notifying parents or obtaining their consent as required, according to court papers.
A complaint filed in September by the U.S. Department of Justice alleged Disney Worldwide Services and Disney Entertainment Operations violated the Children’s Online Privacy Protection Rule by failing to properly label some videos it uploaded to YouTube as “made for kids.”
The federal court complaint filed in Los Angeles alleged that by mislabeling the videos, Disney allowed for the collection, through YouTube, of personal data from children under 13 who viewed child-directed videos and use of that data for targeted advertising to children.
Under the settlement order finalized by the judge last week, Burbank-based Disney is required to:
— Pay a $10 million civil penalty for violating the rule;
— comply with the rule, including by notifying parents before collecting personal information from children under 13 and obtaining verifiable parental consent for collection and use of that data; and
— establish and implement a program to review whether videos posted to YouTube should be designated as made for children — unless YouTube implements technologies that can determine the age, age range or age category of all YouTube users or no longer allows content creators to label videos as such.
The last provision anticipates the growing use of age-assurance technologies to protect kids online, according to the Federal Trade Commission.
FTC Chairman Andrew Ferguson said COPPA was enacted by Congress to ensure that parents, not companies, make decisions about the collection and use of their children’s personal information online.
“Our order penalizes Disney’s abuse of parents’ trust, and, through a mandated video-review program, makes room for the future of protecting kids online — age-assurance technology,” Ferguson said in a statement when the case was filed.
The COPPA rule requires websites, apps and other online services that are directed to children under 13 to notify parents about what personal information they collect and obtain verifiable parental consent before collecting such information.