Articles
Yelp recently reached a settlement agreement with the Federal Trade Commission regarding a bug in our mobile registration process that allowed certain users to register with any birth date when it was supposed to disallow registrations from individuals under 13 (birthdates on Yelp are optional in the first place, so users are always free to register without one).
via .
FTC v. Yelp! for coppaNOW
Northern District of California (Federal)
3:14-CV-4163
Cover sheet:
Complaint-gov.uscourts.cand.280726.1.0
Complaint:
CoverSheet-gov.uscourts.cand.280726.1.1
Stipulation:
FTC & Yelp Stipulations
Today in the Northern District of California, a lawsuit was filed against Yelp! along with a stipulation for a settlement. Because of the timing of the action (filed and settled the same day) it is apparent that this was worked out in advance and the FTC is filing in order to have a judge approve the deal.
FTC & Yelp Stipulations
In part:
A. Judgment in the amount of Four Hundred Fifty Thousand Dollars ($450,000) is entered in
favor of Plaintiff against Defendant as a civil penalty.
B. Defendant is ordered to pay to Plaintiff, by making payment to the Treasurer of the
United States, Four Hundred Fifty Thousand Dollars ($450,000). Such payment must be made
within seven (7) days of entry of this Order by electronic fund transfer in accordance with
instructions previously provided by a representative of Plaintiff.
C. Defendant relinquishes dominion and all legal and equitable right, title, and interest in all
assets transferred pursuant to this Order and may not seek the return of any assets.
D. The facts alleged in the Complaint will be taken as true, without further proof, in any
subsequent civil litigation by or on behalf of the Commission, including in a proceeding to
enforce its rights to any payment or monetary judgment pursuant to this Order.
E. Defendant acknowledges that its Taxpayer Identification Numbers, which Defendant
must submit to the Commission, may be used for collecting and reporting on any delinquent
amount arising out of this Order, in accordance with 31 U.S.C. § 7701.
There has been talk with a lot of re-tweets about an impending COPPA crackdown by the FTC. A lot of the “news” around this crackdown warns of $16K fines for COPPA violations per download. I do not know if there’s a crackdown coming but I do know we aren’t too far off to the 2nd anniversary of the last COPPA action. At this rate we might not hit any enforcment actions for two years. That’s not much of a crackdown but it’s always possible that some day there might be.
I don’t know what the future holds for COPPA enforcement but I do believe that no one knows outside the FTC. As far as the $16K figure, I have contacted the same FTC official that is quoted in the original article (but not quoted saying there’s a crackdown coming or to expect $16K fines) and this is what he said:
The Commission had announced, in denying the request to move the effective date, that we’d give an additional month or two for smaller developers to come into compliance.
Our civil penalty authority takes into account a number of factors, not just the number of violations.
The first line is in response to the grace period that the FTC gave after the debut of the revised COPPA Rule. A month or two means September 2013 at the latest and there have been exactly zero enforcement actions made public since then. The second line is vague but basically says they look a lot more than just the number of violations which is enforced by one of the COPPA FAQs.
Section B of the Complying With COPPA FAQ says the following:
(B)2. What are the penalties for violating the Rule?
A court can hold operators who violate the Rule liable for civil penalties of up to $16,000 per violation. The amount of civil penalties a court assesses may turn on a number of factors, including the egregiousness of the violations, whether the operator has previously violated the Rule, the number of children involved, the amount and type of personal information collected, how the information was used, whether it was shared with third parties, and the size of the company. Information about the FTC’s COPPA enforcement actions, including the amounts of civil penalties obtained, can be found by clicking on the Case Highlights link in the FTC’s Business Center.
Looking back on past enforcements we see that for the most part the fines per child have been pretty low. Even with settlements greater than a million dollars, the per child fine isn’t that much. It all adds up but these figures are not counting individual infractions such as multiple logins or downloads.
The following chart outlines published fines and the reach in number of children reported. This allows us to extrapolate an average fine per child. For the sake of absurdity, I’ve included a column of how much the fines could have been if the total fine was taxed at $16K for each. This would have brought the Treasury department more than $56 billion dollars if enforced by the max that the FTC Act allows.
I have not included cases where the fine was revealed but not the reach and older cases typically did not care about reach or at least did not disclose the formula that was used. You can read about all the cases made public on the FTC website by clicking on the Case Highlights listed in the above FAQ answer.
See the chart here (scroll down).
The FTC staff has posted revisions to three Frequently Asked Questions (“FAQs”) related to obtaining verifiable parental consent under its COPPA Rule. For a comparison of the old and new FAQs, click here.
Although the changes (which include a new FAQ H.16) may appear substantial, they mostly reaffirm the FTC’s longstanding position that the agency’s list of approved verifiable parental consent mechanisms is not exhaustive and that companies can implement different methods as long as they meet the statutory standard of amounting to a “reasonable effort (taking into consideration available technology) . . . to ensure that a parent of a child receives notice of the operator’s personal information collection, use, and disclosure practices, and authorizes the collection, use, and disclosure, as applicable, of personal information and the subsequent use of that information before that information is collected from that child.” 15 U.S.C. § 6501(9).
Specifically, the revisions:
via FTC Staff Updates Children’s Online Privacy Protection Act (COPPA) FAQs on Verifiable Parental Consent Methods | The National Law Review.
I’ve done a lot of research and monitoring of YouTube over the past few months and have discovered some peculiar things. Since YouTube is part of the universal Google account system this article will drift back in forth. It’s not 100% Google and not 100% YouTube. This article explains how to report a child for having an unauthorized YouTube channel and when it’s good to do so and when it’s better to just move along.
First, you may be surprised to know that the umbrella Google policies that reign over YouTube do not mention an age requirement. This includes their terms of service () and privacy policy (). There is no mention of children at all and the only place you’ll find “13” is the year part of the date on the policy revisions.
Google is perfectly OK in doing this because they use a neutral age-gate under COPPA. To be neutral they can’t come right out and say why they are asking. That would actually be a problem under the rules. Sites like Twitter don’t use an age gate and therefore it is easier for them to disclose the rule which is actually the law.
Instead of telling you at sign-up what the policy is, YouTube provides the following information on a parental resource page:
How old does my child have to be to use YouTube?
In order to create a YouTube account, we require users to confirm that they are at least 13 yrs old. Users who enter any age younger than 13 will be prohibited from creating YouTube accounts. In addition, if a user’s video gets flagged and, upon review, we determine that the user has inaccurately stated their age during the account creation process, we will suspend their account.
Source:
Unfortunately this policy is not linked from the TOS or privacy pages and is very hard to find. The easiest way to find it is actually to use Google Search otherwise you’re likely to get lost in their help system trying to find the answer. I’ve complained about this before because in my articles. If a parent were to review the documents presented to them when creating an account for their child they wouldn’t be wrong to think the age policy isn’t presented at signup.
But things get even quirkier Though Google forbids access to children under 13 there is no official way to turn someone in. Often you will hear kids threatened to be flagged for being too young but there’s no documented way to do that. Google does say that if a video is flagged and they determine the user lied then the account will be suspended (but not always terminated). This still leaves two issues. First, you can’t turn a kid in for age violation on non YouTube properties because the video flag system isn’t there. But you can’t turn them in through the video flag mechanism either because there isn’t a direct mechanism for age violations.
The problem with YouTube and COPPA is the Actual Knowledge standard. This dictates that a general audience site like YouTube isn’t held responsible for kids they don’t invite unless they have actual knowledge that they are under 13. About the only way to obtain actual knowledge on a particular video is for the child to state their age but you can’t report it unless you can report on an additional offense.
So no matter how much a child looks like they are 8 YouTube will not usually remove an account unless the video has both actual knowledge disclosure and another reportable violation. In other words two violations are needed.
These are the reportable issues for videos to be flagged:
- Sexual content
Flagged videos and users are reviewed by YouTube staff 24 hours a day, seven days a week to determine whether they violate Community Guideline. Accounts are penalized for Community Guidelines violations and serious or repeated violations can lead to account termination. If you would like to report a channel, please
As you can see “age” is not a listed issue. If you report child abuse or flag the channel instead of the video but if there is no appropriate sub-category you risk being ignored at best or deleted for abusing the reporting system.
In my opinion age isn’t here because YouTube doesn’t want it to be here. They are avoiding deploying resources to support actual knowledge. Don’t ask don’t tell internet style.
One caveat though is fetish videos. YouTube does not allow this for kids of any age even if older than 13. Usually when a kid makes a fetish video they have no idea it is for the gratification of an adult or any idea what a fetish is. iCarly opened a lot of kids up to this through dares which usually feature feet or even uvulas. Search on YouTube for “iCarly foot dares” but this isn’t SFW. If you see a kid make a fetish video (hogtie is also a popular dare) flag it under Sexual Content and then sub flag it under involving minors. Put in the comments that it is fetish and not explicit so they don’t launch a nuclear response.
The video I reported under the terms of the last paragraph was of an 8 year old boy doing a request for who he thought was a teen girl. The title even mentioned “iCarly”. YouTube deleted the video within 5 minutes of the report which is very commendable. However, I also asked them to look at other videos on the channel to evaluate the account but they didn’t remove it even though he admits age he did so in a different video than the one I flagged. The fetish video is gone but the account remains and now the kid is setting up Skype “interviews” with strangers.
The title of this article though is how to rat out a child under COPPA on YouTube so there must be a way and there is.There just isn’t official and it probably won’t stick in the long term because the kid will just make a new account. I only flag an account if I feel the kid is doing something so dangerous that could risk real world safety. If they are careful with PII and aren’t making videos for perverts then I’m not going to troll for them. If they give out their address or constantly upload Skype chats with adults then I will pull the trigger to at least get current content removed. Let them start over and maybe they’ll be smarter. I am not fooling myself by thinking an 8 year old is going to take a 5 year break from YouTube.
I very much encourage anyone to follow these steps under the circumstances I describe above. And by all means keep flagging videos that break rules. A removed video earns the kid a strike and after 3 strikes the account is gone.
- The URL that leads to the child self disclosing their age. This can be to a video (make a note of the timestamp), their About page, or a comment on a video. The URL needs to be onsite. YouTube is not under obligation to hunt down info on other sites.
- Send an e-mail to . Understand that they might not like this address being used for this purpose but it has worked. You might want to create a new e-mail account for this purpose in case they become irritated by you using it.
- Make sure to include the channel name.
- I recommend quoting the law a bit in case the support person is new and trained to respond with this:
In order to review legal claims, we must be notified directly by the party in question or their authorized legal representative. If you are authorized to act on the party’s behalf, please respond to this email specifying your relationship to the party in question.”
This alleges that a third party complaint cannot be made but that isn’t the case. I recommend pointing out in advance that the COPPA rules changed in July and that third parties can trigger actual knowledge. Feel free to use this:
This is a notification under the actual knowledge standard of the Children’s Online Privacy Protection Rules issued pursuant to the Children’s Online Privacy Protection Act (“COPPA” or “COPPA statute”), 15 U.S.C. 6501 et seq. as amended July 1, 2013. Furthermore, the FTC has made this statement regarding third party complaints:
‘Whether an operator has actual knowledge they have collected personal information from a child is fact specific, but it is not the case that they can only get that actual knowledge from a parent. There are cases where operators may learn they have collected personal information from children from a school or teacher or other third party.’ Source: FTC Office of Public Affairs 202-326-2480.
When sending e-mail avoid using anything but plain text. Anything with links, HTML or other formatting may trigger a rejection by their e-mail system upon receipt.Everything in this article has been tested several times and the results are consistent. My purpose here is to show what can be done and to point out the quirks in the system. In most cases it isn’t worth it unless something seriously is wrong and there’s no better way. Flagging a video is good to get rid of naughty content quickly so use it when available.
Using the above e-mail should only be done in urgent cases where a child might be giving out too much PII to be a danger to themselves offline. The child is likely to recreate their account so trying to be a vigilante is fruitless and e-mailing a legal department with the above wording is a bit dramatic so use it as a tool and do so wisely.
Special thanks to at for providing great how to articles including YouTube Will Shut Down Accounts If Users Are Under 13 which is based on earlier research leading up to this article.