Collecting children's data for marketing purposes isn't completely restricted in the U.S., but the fiscal risks of doing so have increased significantly after Google settled with the FTC and New York Attorney General's Office for $170 million over YouTube's COPPA Rule violations.

In response, YouTube declared it will no longer show personalized ads on videos made for children. Starting in roughly four months, YouTube said it will treat data from anyone watching children's content on YouTube as coming from a child, meaning it will limit data collection on child-targeting videos to what is needed to "support the operation of the service."

The settlement, the stiffest fine in COPPA's history, may be another sign of the FTC becoming more assertive in protecting children's data. The settlement arrives six years after the FTC updated its COPPA Rule requiring parental consent when collecting underage children's data for behavioral advertisements and deeming third parties liable if they have "actual knowledge" that it's collecting personal information from users of a child-directed site or service.  

"This is the first FTC settlement that dealt with behavioral advertisements against a platform that just hosts third-party content," said Lindsey Tonsager, a Covington & Burling partner.

And with a $170 million judgment, its price tag sticks out as the largest penalty under COPPA. Still, lawyers note the settlement doesn't change COPPA's data collection requirements.

"If you continue with behavioral advertising, you would have to serve the parents with notice and seek their affirmative consent before engaging in behavioral advertisements," said Phyllis Marcus, a Hunton Andrews Kurth partner and former FTC division of advertising practices chief of staff.  

Although Google's settlement doesn't represent a sea change in what companies are allowed to do with children's data, Tonsager said the order sent a "warning message" to third-party partners. In FTC chairman Joseph Simons' separate statement, he noted the settlement included a first impression application of COPPA where a third-party platform that has actual knowledge it's collecting personal information from users of a child-directed site is liable under COPPA.

Marcus said third parties may adjust what type of information they obtain to avoid that liability. "They may look at what information they are collecting on kid-related properties and maybe tighten up some of the criteria," she said.

Along with extending COPPA liability to third parties, the FTC chairman also noted the complaint alleges channels on a general audience platform are websites or online services under COPPA, another first impression application of the law.

Aside from the recent settlement, the FTC is also stressing enforcing children's data privacy by reminding state attorneys offices that they too have the power to bring child data privacy litigation. Tonsager noted FTC Commissioner Rebecca Kelly Slaughter's statement "really encouraged state attorneys to continue bringing COPPA suits as the state attorney alone when the FTC couldn't get relief."