WIRED: Fines Alone Aren't Enough to Slow Down Big Tech
On Wednesday, the Federal Trade Commission announced a settlement with YouTube for repeated, knowing violations of children’s privacy laws. The fine: $170 million. For YouTube's parent company, Alphabet, that works out to roughly two days’ worth of profit. That’s not a slap on the wrist; it’s a gentle tap. With a feather. In zero gravity.
Over the past year or so, a series of high-profile FTC enforcement actions have left critics of tech’s biggest privacy offenders—Google, Facebook, Equifax—somewhere between frustrated and apoplectic. Time and again, the money extracted from the tech giants amounts to a pittance. The structural remedies that accompany those fines—the part where companies agree to change the offending parts of their behavior—can arguably have greater effect. But blaming the FTC for inadequately bringing Silicon Valley to heel on its own is like blaming a fork for not holding soup. Could it do more? Should it? Just don’t expect real privacy change without strong privacy laws in place.
Kid Gloves
The YouTube case presents a unique locus for those frustrations. The FTC and the New York Attorney General’s Office alleged that the Alphabet subsidiary collected personal information from minors, using persistent identifiers to track them across the internet, without first gaining the consent of their parents. That's a violation of the Children's Online Privacy Protection Act, which carries specific penalties that broader FTC privacy actions don’t. It was, more simply put, an opportunity to come down hard.
The three FTC commissioners who voted in favor of the settlement argue that it did just that. As FTC chairman Joseph Simons noted in a press conference Wednesday, the fine is 30 times larger than the previous record COPPA civil penalty, which social music app Musical.ly—since acquired by TikTok—paid out in February. In fact, the YouTube fine is 10 times larger than all 31 prior COPPA enforcements combined. “A penalty of this magnitude sends a strong signal about the importance of children’s privacy,” Simons said.
Or does it? Consider that COPPA specifies a maximum penalty of $42,530 per violation, which can be meted out on a per child or per day basis. "Often the problem with privacy issues is that the FTC's authority is limited, but here the FTC's authority under COPPA is ample," says Sally Hubbard, director of strategic enforcement at the nonprofit Open Markets Institute.
In a dissenting statement, FCC commissioner Rohit Chopra calculates Google’s actual liability—based on ill-gotten gains—to be in the billions of dollars. “The terms of the settlement were not even significant enough to make Google issue a warning to its investors,” Chopra writes. For some perspective, here’s Alphabet’s net income last year versus the record-setting fine.