YouTube's had a rough year with kids. Not only has the Google subsidiary drawn concerns about content featuring children and content provided to children, but now the company has also settled allegations that it violated a key children's privacy law.

The Federal Trade Commission announced today that Google would pay fines totaling $170 million to settle allegations that YouTube violated the Children's Online Privacy Protection Act, or COPPA. Most of the money, $136 million, will go to settle with the FTC, and the remaining $34 million will settle a similar complaint with the New York Attorney General's office.

COPPA imposes certain restrictions on the collection and use of personal data associated with children ages 12 and under. Under the law, websites, apps, and digital platforms that collect data from young users are required to post a privacy policy and have parents consent to it, to give parents the option to opt out of having their children's information shared with third parties, to let parents review their children's data, and to follow sound data storage and retention policies.

YouTube does not require a user to register in order to view videos, the complaint (PDF) points out. As such, most videos are not age-gated. Anyone can view them, and millions of children under age 13 do. YouTube even boasted to toy companies Mattel and Hasbro that "YouTube was unanimously voted as the favorite website for kids 2-12" and "93% of tweens visit YouTube to watch videos," the complaint says.

But while the company was boasting of its popularity with children in public, in private it promised that COPPA was not a concern, the FTC alleges. One Google employee wrote in an email obtained by the FTC that, "we don’t have users that are below 13 on YouTube and platform/site is general audience, so there is no channel/content that is child-directed and no COPPA compliance is needed."

The company also does not treat channels or content explicitly aimed at children differently from other content for the purposes of advertising, the complaint says—that includes earning revenue from behavioral advertising, which relies on data collected from users.

“YouTube touted its popularity with children to prospective corporate clients,” FTC Chairman Joe Simons said. “Yet when it came to complying with COPPA, the company refused to acknowledge that portions of its platform were clearly directed to kids. There’s no excuse for YouTube’s violations of the law.”

Pocket change

The $136 million penalty is the largest fine the FTC has ever imposed for a COPPA violation, the commission said. But while the sum may be record-setting for the FTC, it pales in comparison to the $5 billion Facebook recently had to pay to settle allegations of privacy violations. Meanwhile, YouTube parent company Alphabet Inc. reported revenue of $38.9 billion for its most recent financial quarter.

The FTC voted 3-2 to adopt the penalty, with Democratic commissioners Rohit Chopra and Rebecca Kelly Slaughter dissenting.

"Google knew it was targeting children," Chopra writes in his dissent (PDF). "When Google pays a fine and still profits from misconduct, this is not a penalty."

Slaughter in her dissent (PDF) observed that YouTube, thanks to its size, is "likely the online service that today hosts the most violations of COPPA."

The settlement doesn't require the company to do nearly enough to prevent more issues in the future, Slaughter added. "When it comes to fencing-in relief," which would keep content explicitly directed at children penned off so it could be handled separately, "the current order looks like a fence but one with only three sides. The missing fourth side is a mechanism to ensure that content creators are telling the truth when they designate their content as not child-directed. And such a mechanism is surely within YouTube’s mighty technological capacity."

Prominent Democratic lawmakers also objected to the settlement as insufficient.

The FTC "stands for 'Forgetting Teens and Children," Sen. Ed Markey (D-MA) said in a statement. "The FTC let Google off the hook with a drop-in-the-bucket fine and a set of new requirements that fall well short of what is needed to turn YouTube into a safe and healthy place for kids. Google’s violations of COPPA are brazen, widespread, and specifically designed to increase profits."

"A financial settlement is no substitute for strict reforms that will stop Google and other tech companies from invading our privacy—particularly when children are concerned," said Sen. Richard Blumenthal (D-CT).

Blumenthal is a member of the Antitrust subcommittee of the Senate Judiciary Committee, which later this month will be holding a hearing to probe competition issues in the technology sector.