A Federal Trade Commission (FTC) case against Disney is being settled with a $10 million penalty and required changes to how the company labels its YouTube videos that are aimed at underage users. The company was accused of violating federal children’s privacy rules preventing the collection of personal data of internet users under the age of 13, and the outcome builds on the terms of a prior 2019 FTC settlement involving Google that set new requirements for parental consent on YouTube.
Disney FTC settlement involved improper labeling of videos as “made for kids”
The case involves Disney’s numerous YouTube channels, some of which are marked at the channel level as hosting “Not Made for Kids” (NMFK) content. The channel’s default setting of this type is applied to all videos uploaded to that channel, and stays that way unless manually changed for each video. Disney was accused of not making that change to videos clearly aimed at underage users that should have been labeled as “Made for Kids” (MFK), subjecting them to much more restrictive data collection practices meant to protect children’s privacy.
The whole thing traces back to a 2019 FTC settlement reached with Google, requiring YouTube to implement the MFK/NMFK labeling system. YouTube was found to not have adequate systems in place to prevent the collection of personal data from viewers under the age of 13, a violation of the federal Children’s Online Privacy Protection Act (COPPA) Rule. Google also paid $136 million to the FTC and $34 million to the state of New York as part of that FTC settlement.
The mislabeling by Disney presented not only a children’s privacy issue in terms of data collection, but also may have exposed underage users to inappropriate content that should have been kept from them by the labeling system. The COPPA Rule requires parents or guardians to provide permission before children aged 13 or younger can access services that collect personal information, and these services must provide information about exactly what information they collect and how it is used.
On YouTube, a video labeled as MFK will automatically not collect personal information from viewers and its comments section will be disabled. Personalized ads are also not displayed with this category of video. YouTube’s prior FTC settlement allows it to make content creators and uploaders responsible for choosing the correct setting for their videos, opening them up to potential personal liability if they get it wrong. However, it can also opt to change the designation on its own when something is flagged and reviewed by its moderation staff. The FTC complaint notes that YouTube independently identified some 300 Disney videos that were inappropriately labeled and changed them to “MFK” in mid-2020, and notified the company of the potential issue. Disney did not change its practice of default channel-level labeling of uploaded videos despite the warning about potential children’s privacy violations.
Children’s privacy settlement includes implementation of new mandatory video review program
In addition to the $10 million penalty, the FTC settlement mandates that Disney implement an internal review program to ensure that MFK labeling is taking place where required. Disney would no longer be subject to this requirement should YouTube implement its own platform-level age assurance policies, however, something that the company has already begun trialing in certain regions. In the United States the platform has recently implemented an AI-powered system that disregards the user’s stated age and comes up with its own estimate based on assorted signals, such as their account and viewing history. This system can automatically age-restrict accounts of suspected underage users and require them to submit a government ID, credit card or selfie to have their accounts unlocked.
The specific videos that were supposed to be marked as MFK but instead ended up violating children’s privacy include those from very kid-focused franchises such as Mickey Mouse, Frozen and Toy Story. Though there is now more clarity on children’s privacy issues on the platform since the 2019 FTC settlement, prior to that YouTube was essentially the Wild West in terms of COPPA violations. The platform sent very mixed messages to its larger corporate brands in the children’s entertainment space, telling some (according to the original FTC complaint) that the platform did not have users under the age of 13 while boasting to others that it reached more 6-11 year olds than television.
YouTube’s new age assurance tech may well also not take Disney and other companies off the hook in terms of guaranteeing children’s privacy, as early reviews of it from platform users are not good. There are predictable concerns about false flagging of adults as minors, but there are even deeper privacy concerns about the system actively surveilling the entirety of a user’s watch and search history and then potentially pairing that with government identification.
