Privacy & Information Security Law Blog

On December 4, 2018, the New York Attorney General (“NY AG”) announced that Oath Inc., which was known as AOL Inc. (“AOL”) until June 2017 and is a subsidiary of Verizon Communications Inc., agreed to pay New York a $4.95 million civil penalty following allegations that it had violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting and disclosing children’s personal information in conducting online auctions for advertising placement. This is the largest-ever COPPA penalty.

The NY AG alleged that AOL used its display ad exchange to conduct billions of ad space auction websites that AOL knew to be directed to children under the age of 13 and subject to COPPA. AOL is said to have gained this knowledge from clients who flagged child-directed properties to AOL, and from its own internal reviews. In all, AOL is alleged to have conducted 2 billion auctions of display ad space from these websites.

The settlement requires AOL to (1) establish and maintain a comprehensive COPPA compliance program; (2) retain an objective, third-party professional to assess the privacy controls that the company has implemented; (3) implement and maintain functionality that enables website operators that sell ad inventory through AOL systems to indicate each website or portion of a website that is subject to COPPA; and (4) destroy all personal information collected from children. In a statement, Oath indicated that it is “wholly committed to protecting children’s privacy online” and agreed to make comprehensive reforms of its business practices to ensure that children are protected from improper targeted advertising online.