Oath, the owner of AOL and Yahoo, has agreed to pay about $5 million to settle charges from the New York attorney general that the media company’s online advertising business was violating a federal children’s privacy law.
AOL, through its ad exchange, helped place targeted display ads on hundreds of websites that it knew were directed to children under 13, such as Roblox.com and Sweetyhigh.com, according to a settlement that the attorney general’s office plans to announce on Tuesday. The attorney general’s office said that the ads were placed by using personal data, like cookies and geolocation information, in violation of the Children’s Online Privacy Protection Act of 1998, which is known as Coppa.
The penalty that the Verizon-owned Oath agreed to pay is the largest a company has paid for a case tied to Coppa. A spokesman for Oath, which did not admit or deny the attorney general’s findings, said, “We are pleased to see this matter resolved and remain wholly committed to protecting children’s privacy online.”
“Coppa is meant to protect young children from being tracked and targeted by advertisers online,” said Barbara D. Underwood, New York’s attorney general. “AOL flagrantly violated the law — and children’s privacy — and will now pay the largest-ever penalty under Coppa.”
The settlement is the latest evidence of the scrutiny internet giants are facing over how they collect and use data from children for online advertising. Google was criticized this year by New Mexico’s attorney general for how it may collect children’s location data, while other privacy advocates have pressed for more transparency about how children may be tracked and targeted for ads on YouTube, which is owned by Google.
In an age when online privacy has become a significant public concern, Coppa is one of the few federal regulations in place. It requires companies to obtain explicit, verifiable permission from parents before collecting, using or disclosing personal information from children under 13 or targeting them with ads tied to their online behavior. Personal information includes cookies that track a user across websites and geolocation data, which is then used to send specific ads to specific people. Advertisers are typically willing to pay more for ads tailored to individuals and their online behavior rather than placing ads on specific websites in the hopes that they might be seen by people interested in their products.
Ad exchanges, which connect websites and potential advertisers through real-time bidding processes as pages load, must comply with Coppa when they know they are working with children’s sites.
Technically, AOL’s policies prohibited the use of its display ad exchange to auction ad space on children’s sites, but the company did business there anyway, according to the settlement documents, which examined AOL’s practices between October 2015 and February 2017. Its auctions of ad space on those sites regularly collected personal information from users, like they would on any website, then shared that with bidders, resulting in targeted advertisements.
An account manager for AOL in New York repeatedly told one client, called Playwire Media, that the company’s ad exchange could be used to sell ad space while complying with Coppa, which wasn’t the case, according to the settlement documents. Based on the statements, Playwire, which represented sites like Roblox.com, Neopets.com and Tweentribune.com, used the exchange to place more than a billion ads on space that was supposed to be covered by Coppa.
AOL, through Advertising.com, also bought space on websites from other ad exchanges that had been flagged as Coppa-covered. However, according to the settlement, the company treated this ad space the same as it would any normal ad space, meaning that it allowed ad targeting. The company has since introduced technology that recognizes when space is deemed to be covered by Coppa and adjusts its practices accordingly, according to the settlement.
Oath, as part of the settlement, said it would create a Coppa compliance program, which will be overseen by a specific executive or officer, and provide annual training on Coppa compliance to account managers and other employees that work with ads on children’s sites. It will also destroy personal information that it has collected from children.
Separately, a Wall Street Journal article on Oath’s advertising business said on Sunday that the unit has failed to meet ambitious revenue targets through digital ad sales on Yahoo and AOL properties.