Disney will pay $10 million to settle Federal Trade Commission allegations that the company allowed personal data to be collected from children who viewed kid-directed videos on YouTube without notifying parents or obtaining their consent as required by the Children’s Online Privacy Protection Rule (COPPA Rule).
The proposed order would transform how the entertainment behemoth designates videos on YouTube as “Made for Kids,” while encouraging adoption of age assurance technologies on YouTube.
A complaint, filed by the Department of Justice upon notification and referral from the FTC, alleged that Disney Worldwide Services, Inc. and Disney Entertainment Operations LLC (Disney) violated the COPPA Rule by failing to properly label some videos that it uploaded to YouTube as “Made for Kids.” The complaint says the mislabeling allowed Disney, through YouTube, to collect personal data from children under 13 viewing child-directed videos and use that data for targeted advertising to children. Disney receives a portion of the revenues that YouTube generates from advertising placed with Disney videos and revenues from advertising that Disney sells directly. The mislabeling also exposed children to age-inappropriate YouTube features like autoplay to videos not “Made for Kids.”
“This case underscores the FTC’s commitment to enforcing COPPA, which was enacted by Congress to ensure that parents, not companies like Disney, make decisions about the collection and use of their children’s personal information online,” said FTC Chairman Andrew N. Ferguson. “Our order penalizes Disney’s abuse of parents’ trust, and, through a mandated video-review program, makes room for the future of protecting kids online—age assurance technology.”
The COPPA Rule requires websites, apps and other online services that are directed to children under 13 to notify parents about what personal information they collect and obtain verifiable parental consent before collecting such information.
Following a 2019 settlement with the FTC over allegations it violated COPPA, YouTube began requiring content creators, including Disney, to indicate if the videos they upload to YouTube are “Made for Kids” (MFK) or “Not Made for Kids” (NMFK) in order to comply with COPPA. The designation ensures that some features on videos that are classified as MFK are disabled. For example, YouTube does not collect personal information or serve personalized ads to viewers watching videos marked as MFK and does not allow for comments to be posted to those videos, according to the Disney complaint.
To comply with YouTube’s policy, content creators can mark each individual video or mark a particular channel as MFK or NMFK. If a channel is MFK or NMFK, every video uploaded to that channel is marked the same way by default. YouTube, however, has warned content creators that they are responsible for ensuring that all the videos they post are accurately classified, according to the complaint.
According to the complaint, Disney chose to mark all of its videos uploaded to YouTube at the channel level and did not change the default to mark each video individually. The complaint alleged that Disney uploaded many videos directed to children to Disney channels labeled as NMFK, thereby labeling them by default as NMFK.
According to the complaint, even after being told by YouTube in mid-2020 that YouTube had changed designations on more than 300 Disney videos from NMFK to MFK, Disney did not change its policy of designating videos at the channel level and continued to fail to properly designate individual videos as MFK. These videos included child-directed subject matter, visual content, and music from The Incredibles, Coco, Toy Story, Frozen, and Mickey Mouse.
Under the proposed settlement, Disney will be required to:
- Pay a $10 million civil penalty for allegedly violating the COPPA Rule;
- Comply with the COPPA Rule, including by notifying parents before collecting personal information from children under 13 and obtaining verifiable parental consent for collection and use of that data; and
- Establish and implement a program to review whether videos posted to YouTube should be designated as MFK—unless YouTube implements age assurance technologies that can determine the age, age range, or age category of all YouTube users or no longer allows content creators to label videos as MFK. This forward-looking provision reflects and anticipates the growing use of age assurance technologies to protect kids online.
The Commission voted 3-0 to refer the complaint and proposed order to the Department of Justice. Chairman Ferguson joined by Commissioners Melissa Holyoak and Mark R. Meador released a statement. The DOJ filed the complaint and stipulated order in the U.S. District Court for the Central District of California, Western Division.
NOTE: The Commission authorizes the filing of a complaint when it has “reason to believe” that the named defendant is violating or is about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated orders have the force of law when approved and signed by the District Court judge.
The lead FTC attorneys on this matter are Jacqueline Ford and Genevieve Bonan from the FTC’s Bureau of Consumer Protection.