On December 4, 2018, New York Attorney General Barbara D. Underwood announced a $4.95 million settlement with Oath, Inc. (f/k/a AOL Inc.), a wholly-owned subsidiary of Verizon Communications, Inc., for alleged violations of the Children’s Online Privacy Protection Act (“COPPA”) as a result of its involvement with online behavioral advertising auctions. This settlement represents the largest penalty ever in a COPPA enforcement matter in U.S. history.

Through its investigation, the New York Attorney General’s Office discovered that AOL collected, used, and disclosed personal information of website users under the age of 13 without parental consent in violation of COPPA. Specifically, the company was charged with having “conducted billions of auctions for ad space on hundreds of websites the company knew were directed to children under the age of 13.” The New York Attorney General found that AOL operated several ad exchanges and permitted clients to use its display ad exchange to sell ad space on COPPA-covered websites, despite the fact that the exchange was not capable of conducting a COPPA-compliant auction that involved third-party bidders. AOL was charged with having knowledge that these websites were subject to COPPA because evidence demonstrated that: (i) several AOL clients had provided AOL with notice that their websites were subject to COPPA and (ii) AOL had conducted a review of the content and privacy policies of client websites and had designated certain websites as being child-directed. Additionally, the New York Attorney General charged AOL with having placed ads through other exchanges in violation of COPPA.   Specifically, whenever AOL participated and won an auction for ad space on a COPPA-covered website, AOL ignored any information it received from an ad exchange indicating that the ad space was subject to COPPA and collected information about the website users to serve a targeted advertisement to the users.

In addition to the record penalty, Oath has agreed to establish and maintain a comprehensive COPPA compliance program that includes, among other things, monitoring by a third party professional. Oath has also agreed to implement and maintain functionality that enables website operators that sell ads through its ad exchanges to indicate each website, or portion of a website, that is subject to COPPA. Oath will then maintain this information in a database and disclose to each third-party bidder that the pertinent ad space is subject to COPPA. Lastly, Oath has agreed to destroy all personal information that it collected from children through these auctions.

The New York Attorney General’s press release regarding the settlement is available here.

Our take:

As evidenced by this record settlement and the recent letter to the FTC written by Senators Edward J. Markey (D-Mass) and Richard Blumenthal (D-Conn), there has been an increased interest in COPPA enforcement at the state level. With the new year just around the corner, website operators, app developers, online service providers, and advertising companies should consider making a comprehensive COPPA assessment their New Year’s resolution. This settlement demonstrates that the costs of noncompliance can be crippling.