Google Is Fined $170 Million for Violating Children’s Privacy on YouTube

Googleagreed on Wednesday to pay a record $170 million fine and make changes to protect children’s privacy on YouTube, as regulators said the video site had knowingly and illegally harvested personal information from children and used it to profit by targeting them with ads.

Critics denounced the agreement, dismissing the fine as paltry and the required changes as inadequate for protecting children’s privacy.

The penalty and changes were part of a settlement with the Federal Trade Commission and New York’s attorney general, which had accused YouTube of violating the federal Children’s Online Privacy Protection Act, or COPPA.

Regulators said that YouTube, which is owned by Google, had illegally gathered children’s data — including identification codes used to track web browsing over time — without their parents’ consent.

The site also marketed itself to advertisers as a top destination for young children, even as it told some advertising firms that they did not have to comply with the children’s privacy law because YouTube did not have viewers under 13. YouTube then made millions of dollars by using the information harvested from children to target them with ads, regulators said.

To settle the charges, YouTube agreed to the $170 million penalty, with $136 million going to the trade commission and $34 million to New York State. It is the largest civil penalty ever obtained by the commission in a children’s privacy case, dwarfing the previous record fine of $5.7 million against the owner of the social video-sharing app TikTok this year.

Under the settlement, which the F.T.C. approved in a 3-to-2 vote, YouTube also agreed to create a system that asks video channel owners to identify the children’s content they post so that targeted ads are not placed in such videos. YouTube must also obtain consent from parents before collecting or sharing personal details like a child’s name or photos, regulators said.

The move is the latest enforcement action taken by regulators in the United States against technology companies for violating users’ privacy, indicating the Trump administration’s willingness to aggressively pursue the powerful corporations. It follows a $5 billion privacy settlement between the trade commission and Facebook in July over how the company collected and handled user data.

But critics of the settlement, including Senator Edward J. Markey, Democrat of Massachusetts, described the $170 million penalty as a slap on the wrist for one of the world’s richest companies.

“The F.T.C. let Google off the hook with a drop-in-the-bucket fine and a set of new requirements that fall well short of what is needed to turn YouTube into a safe and healthy place for kids,” Mr. Markey said in a statement.

Children’s advocates who lodged their own privacy complaint against YouTube with the F.T.C. last year said that Google had simply agreed to abide by a children’s privacy law it was already obligated to comply with. COPPA prohibits operators of online services from collecting personal data, like home addresses, from children under 13 without a parent’s verifiable permission.

“Merely requiring Google to follow the law, that’s a meaningless sanction,” said Jeffrey Chester, the executive director of the Center for Digital Democracy, a nonprofit group whose efforts in the 1990s helped lead to the passage of the children’s privacy law. “It’s the equivalent of a cop pulling somebody over for speeding at 110 miles an hour, and they get off with a warning.”

The agreement split the trade commission along partisan lines, with the agency’s three Republican commissioners voting to approve it and the two Democratic commissioners dissenting.

In a statement, two of the Republican commissioners, Joseph J. Simons, the agency’s chairman, and Christine S. Wilson, said that the settlement “achieves a significant victory for the millions of parents whose children watch child-directed content on YouTube.” They said it was the first time a platform would have to ask its content producers to identify themselves as creators of children’s material.

The agreement, they added, “sends a strong message to children’s content providers and to platforms about their obligation to comply with the COPPA rule.”

Although the settlement prohibits YouTube and Google from using or sharing children’s data they have already obtained, Rohit Chopra, a Democratic commissioner, said that it did not hold company executives personally accountable for illegal mining of children’s data. The other Democratic commissioner, Rebecca Kelly Slaughter, said that the agreement did not go far enough by requiring YouTube itself to proactively identify children’s videos on its platform.

“No individual accountability, insufficient remedies to address the company’s financial incentives and a fine that still allows the company to profit from its lawbreaking,” Mr. Chopra wrote in his dissent. “The terms of the settlement were not even significant enough to make Google issue a warning to its investors.”

COPPA, the strongest federal consumer privacy statute in the United States, gives the trade commission the authority to level fines of up to $42,530 for each violation.

Noah Phillips, a Republican member of the commission, argued that Congress should give the agency more guidance about how to levy fines.

In a blog post on Wednesday about the settlement, YouTube’s chief executive, Susan Wojcicki, said that “nothing is more important than protecting kids and their privacy.” She added, “From its earliest days, YouTube has been a site for people over 13, but with a boom in family content and the rise of shared devices, the likelihood of children watching without supervision has increased.”

YouTube said that not only had it agreed to stop placing targeted ads on children’s videos, it would also stop gathering personal data about anyone who watched such videos, even if the company believed that the viewer was an adult. The company also said it would eliminate features on children’s videos, like comments and notifications, that involved the use of personal data.

In addition to relying on reports from video creators, Ms. Wojcicki said that YouTube planned to use artificial intelligence to try to identify content that targeted young audiences, like videos featuring children’s toys, games or characters.

Under the settlement, YouTube must adopt the changes by early next year.

The privacy case against YouTube began in 2016 after the New York attorney general’s office, which has been active in enforcing the federal children’s privacy law in the state, notified the trade commission about apparent violations of the law on the site.

“Google and YouTube knowingly and illegally monitored, tracked and served targeted ads to young children just to keep advertising dollars rolling in,” Letitia James, New York’s attorney general, said in a statement on Wednesday. “These companies put children at risk and abused their power.”

Google has been forced to deal with privacy violations repeatedly in recent years. The company is subject to a 20-year federal consent order signed in 2011 for deceptive data-mining related to Buzz, a now-defunct social network. The order required Google to establish a comprehensive privacy program and prohibited it from misrepresenting how it handles personal data.

In 2012, Google agreed to pay $22.5 million to settle trade commission charges that it had violated the 2011 order by deceiving users of Apple’s Safari browser about its data-mining practices.

The company is also the subject of a lawsuit brought by Hector Balderas, New Mexico’s attorney general, over accusations that it violated children’s privacy. The suit says the company failed to ensure that children’s apps available through its Google Play store complied with the children’s privacy law. Google has asked that the case be dismissed.

The settlement on Wednesday is likely to have implications beyond YouTube. The changes required under the agreement could limit how much video makers earn on the platform because while they still make money on some kinds of ads on children’s videos, they no longer be able to profit from ads targeted at children.

To offset some of the expected losses, YouTube said it would funnel $100 million to creators of children’s content over the next three years. It said it would also heavily promote YouTube Kids, its child-focused app, to shift parents away from using the main YouTube app when allowing their children to watch videos.

The crackdown on creators of children’s content could make it financially difficult to produce such videos, said Maureen Ohlhausen, a former acting chairwoman of the trade commission.

“There is a lot of free content available for children,” she said. “You want to be sure that you don’t kill the goose that lays the golden egg.”