A group of children, represented by their guardians ad litem (i.e., persons that are appointed by the court so children can have their legal interests represented), brought a class action lawsuit against Google, as the owner of YouTube, due to Google’s data collection and marketing practices towards children.
By way of background, several popular toy and cartoon brands maintain YouTube “channels,” where the brands post content and run advertisements that are designed to appeal to young audiences. Google provides customized advertising to users based on information about each specific user. Tracking tools monitor user’s search history, video viewing history, personal contacts, browsing history, location information, and other information about users’ habits and preferences. Together, these pieces of information create a detailed “profile” of each user, which Google can use to provide customized advertising. Google’s targeted ad technology also uses “persistent identifiers,” created in part by tracking IP addresses, so that users and their detailed profiles can be recognized over multiple websites and online services.
A group of minor children brought suit against Google for using these persistent identifiers to collect data and secretly track their online behavior without their consent. All of the children’s claims were state law claims including invasion of privacy, unfair business practices, and consumer protection violations. At the same time, the children also alleged that the claims involved conduct that would violate the Children’s Online Privacy Protection Act (COPPA). COPPA does not authorize a private right to sue, but it allows the Federal Trade Commission (FTC) and state attorneys general to bring civil actions against companies.
Under COPPA, companies that operate websites and online services marketed towards children must provide certain disclosures about their data collection activities and must safeguard the confidentiality, security, and integrity of children’s personal online information. For example, COPPA has a requirement that child-directed online services give notice and obtain “verifiable parental consent” before collecting persistent identifiers,
Here, the children allege that the data collection practices violated COPPA. The children also allege that Google falsely represented that COPPA’s requirement did not apply to YouTube, reasoning that it was a platform for adults, even though Google knew that children use YouTube.
COPPA has a preemption clause. Preemption is a legal doctrine that provides that when state laws interfere with or are contrary to federal laws, the claims must be brought under federal law instead.
The trial court dismissed the children’s complaint, ruling that the claims had to be brought under COPPA rather than state law due to the preemption clause in COPPA. The children appealed.
The Court of Appeals considered the language in COPPA’s preemption clause, and found it to mean that if there are contradictory state law requirements or requirements that stand as obstacles to federal objectives, then there is a conflict between the state laws and COPPA, and COPPA must preempt the state law causes of actions. Here, the Court of Appeals determined that the state laws were not inconsistent with the purposes of COPPA. Rather, the conduct established fully stand-alone causes of action under state law, and more specific conduct that could violate COPPA. The Court of Appeals reversed the trial court’s ruling.
Jones v. Google, LLC (9th Cir. 2023) 73 F.4th 636.
Note: COPPA does not apply to nonprofits. However, private schools may have duties to comply with COPPA if information is collected by third party operators working with schools providing services to students.