YouTube YouTube Playa Vista. (Photo: Jason Doiy/ALM)

Google and YouTube have agreed to pay $170 million to the Federal Trade Commission and New York state in the largest-ever settlement in an enforcement matter brought under a federal law intended to prevent companies from collecting personal data from young users without the consent of their parents.

The companies were accused of unlawfully tracking the behavior of users below 13 years old and serving them targeted advertisements based on that information, the New York Attorney General's Office said.

"These companies put children at risk and abused their power, which is why we are imposing major reforms to their practices and making them pay one of the largest settlements for a privacy matter in U.S. history," said New York Attorney General Letitia James.

Of the $170 million Google and YouTube agreed to pay as part of the settlement, $136 million will go to the FTC. The remainder will be paid to New York state.

The FTC said in a news release on the settlement that the amount paid to them is by far the largest ever obtained by the federal agency under the Children's Online Privacy Protection Act since it was approved by Congress two decades ago. YouTube earned millions of dollars by using the data to serve targeted ads to viewers of child-directed channels, the FTC said.

"YouTube touted its popularity with children to prospective corporate clients," FTC Chairman Joe Simons said. "Yet when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were clearly directed to kids. There's no excuse for YouTube's violations of the law."

The commission was split on approving the settlement, with three commissioners in favor and two against.

Commissioner Rohit Chopra, for example, wrote in a statement dissenting from the settlement that the amount to be paid by Google and YouTube was too low. He argued that the FTC should have made a higher opening bid for monetary relief to highlight the depth of the matter.

"Financial penalties need to be meaningful or they will not deter misconduct," Chopra wrote.

He also suggested that Congress approve additional digital privacy legislation to give state attorneys general, like James, more power to seek penalties in future instances. In this case, because of how COPPA was written, that wasn't an option, Chopra wrote.

"In COPPA, state attorneys general can only seek forfeiture of ill-gotten gains and refunds to victims, but not financial penalties beyond that. In this matter, the New York attorney general was unable to pursue civil penalties, since the FTC has exclusive authority to do so," Chopra wrote. "This should change."

Aside from the financial penalties, YouTube, which is owned by Google, agreed to implement reforms to avoid future violations of COPPA, according to the New York Attorney General's Office.

YouTube agreed to develop, implement and maintain a system for users to choose whether their videos are directed to children. They will now notify users that content directed toward children on the website may be subject to the COPPA rule, and that the burden is on contributors to designate that content as child-directed.

The company will also obtain verifiable parental consent before collecting, using or disclosing the personal information of children, as is required under COPPA. Employees who work with users will also receive annual compliance training with the law.

FTC Commissioner Rebecca Kelly Slaughter, the other dissenting vote, wrote in a statement that the agreed-upon reforms by YouTube didn't go far enough. She argued that the company should have been required to develop a safety net mechanism to turn off behavioral advertising for content that was directed for children, but hadn't been designated as such.

"True, a technological backstop is not explicitly mandated by COPPA's text, but such a requirement would, I believe, be appropriate and necessary fencing-in relief," Slaughter wrote.

YouTube said in a blog post, which it said served as its statement for the press, that it intends on treating data from anyone watching children's content on the site as coming from a child, regardless of the user's actual age. They'll also stop serving personalized ads on that content, entirely, the company said.

"This means that we will limit data collection and use on videos made for kids only to what is needed to support the operation of the service," YouTube said in the blog post.