• by Wendy Davis  @wendyndavis, December 4, 2018

New York Attorney General Barbara Underwood has fined Verizon's Oath $4.95 million over allegedly intentional violations of the federal Children's Online Privacy Protection Act, which prohibits advertisers and other online companies from collecting personal data from children -- including the type of cookie-based data that can be used for ad targeting.

“COPPA is meant to protect young children from being tracked and targeted by advertisers online," Underwood stated. "AOL flagrantly violated the law -- and children's privacy."

Underwood alleges that AOL -- which Verizon purchased last year and now operates as part of the subsidiary Oath -- conducted "billions" of auctions for ad space on sites directed at children younger than 13. 

COPPA prohibits operators of online sites from collecting personal information from children ages 12 and younger without their parents' consent. Since 2013, the FTC has interpreted that law to prohibit Web companies from using behavioral targeting techniques on sites and apps directed to young children.

The agency specifically prohibits online companies from collecting the type of data used by ad networks to create behavioral profiles -- including persistent cookies and mobile device identifiers -- from children younger than 13, without their parents' permission. 

The Attorney General alleges that AOL's Display Marketplace -- an ad exchange for display ads -- was incapable, until recently, of conducting an auction with other exchanges that would comply with COPPA rules.

Despite this limitation, AOL allegedly conducted “billions” of auctions for display inventory it knew was subject to COPPA rules -- either through the companies' disclosures, or from its own reviews.

At least three AOL clients -- Playwire Media, Neutrino Media, and Sweety High – told AOL their sites were subject to COPPA, New York alleges.

Despite this representation, an AOL account manager “intentionally configured” Playwire's account in a way that violated COPPA in order to increase ad revenue, according to documents filed by the Attorney General.

That manager allegedly said in an email “widely distributed across AOL's display ad exchange teams” that she had enabled display platforms that didn't comply with the law. She allegedly described the strategy as a “tactic I have used ... to see some lift.”

The manager also allegedly misrepresented to Playwire that the display ad platforms could be used in a way that complied with the law. “As a result of these misstatements, Playwire used AOL’s display ad exchange to place more than a billion advertisements on COPPA-covered inventory,” the AG's documents read.

In addition to the $5 million fine, AOL agreed to institute a COPPA compliance program, undergo audits by outside professionals, and to destroy any personal information collected from children in its possession.

The case marks an unusual prosecution of an ad network, according to Jeremy Goldman, a partner with the law firm Frankfurt Kurnit Klein & Selz. In general, ad networks are only liable for COPPA violations if they know they are collecting data from children.

The Attorney General Bureau of Internet and Technology's decision to prosecute an ad network appears to mark the “culmination of an effort by the bureau to push liability up the chain from publishers to ad networks,” Goldman says. “It's like going after the drug dealers, rather than going after the users.”

He adds that the prosecution “solidifies the New York Attorney General's role as a chief COPPA enforcer.

Two years ago, former Attorney General Eric Schneiderman accused Viacom, Mattel, Hasbro and Jumpstart of allowing third-party tracking companies to collect data about visitors to sites aimed at children younger than 13. Those allegations resulted Viacom agreeing to pay $500,00, Mattel agreeing to pay $250,000 and Jumpstart agreeing to pay $85,000. Hasbro, which participated in a "safe harbor" program approved by the Federal Trade Commission, wasn't fined.

Justin Brookman, director of privacy and technology policy for Consumers Union and formerly with both the FTC and the New York Attorney General's office, notes that advocates have pushed the FTC to more aggressively target COPPA violators.

This April, a coalition of watchdogs urged the FTC to prosecute YouTube for allegedly collecting personal information from children younger than 13. At around the same time, researchers reported that thousands of free children's apps for Android may be violating COPPA.

“I imagine this New York suit will also increase pressure on the FTC to do more on the issue,” Brookman says.