Streaming services courting the youngest viewers must handle privacy carefully

Making TV shows and movies for kids is big business.

How big are we talking? Half of all Paramount+ subscribers watch Nickelodeon content. At one point, half of US households with kids under 10 subscribed to Disney+. Kids’ shows like Cocomelon are regularly among the top 10 series on Netflix.

Catering to young viewers can help streaming services boost subscriptions and stave off cancellations. But it comes with a catch. When kids are watching on streaming platforms, companies are legally required to limit data collection and restrict behavioral advertising and retargeting on their platforms.

“If you have kids on your platform, and you know you do, you need to treat their data as more sensitive and have enhanced protections around their personal information,” explained Cobun Zweifel-Keegan, managing director of the International Association of Privacy Professionals, Washington, DC.

Those legal guardrails may get even stricter just as streamers build out ad-supported tiers that will provide advertisers the ability to target preferred audiences.

For the kids

It all comes down to the Children’s Online Privacy Protection Act, or COPPA, signed into law in 1998 and updated in 2013. The law requires any website or online service to collect verifiable consent from a parent or guardian before collecting any personal information (including personally identifiable data) from kids under 13, and it limits the way companies can handle and use that data. Companies found in violation of COPPA risk fines and other enforcement action from the Federal Trade Commission.

While COPPA doesn’t ban targeted advertising to kids outright, it can be hard to collect this consent at scale. That means that, “in practice, COPPA prohibits behavioral advertising, retargeting, or user profiling on most websites and apps that are directed to children,” according to the Interactive Advertising Bureau.

Many streaming platforms watched on connected TVs operate without tracking tools  like cookies. They may still use other identifiers, including IP addresses or geolocation information as well as first-party data, and COPPA’s broad rules governing children’s privacy cover those, too.

“If there’s an internet component, and data is moving and profiles can be created, then everybody has to comply with the same set of regulations,” said Denise Tayloe,  co-founder and CEO of Privo, a company that helps businesses comply with the online privacy regulations governing minors.

According to the law, businesses must collect verified parental consent as soon as they have “actual knowledge” that they have kids using their platform.

It’s not enough for companies to say kids under 13 are not allowed on their platforms and then claim ignorance when kids sign up anyway, Tayloe said. If companies collect signals that children are watching—including through the kinds of programming that a user is seeking out—and an adult has not provided consent to collect that data, “you’re in delete mode,” Tayloe said. It’s also not enough if the service is accessed through a shared device or platform, including one “predominantly used by an adult,” per the IAB’s guidelines.

Claiming ignorance can become more difficult when companies invest in kid content and market their services as family-friendly, Zweifel-Keegan said.

“If you’re specifically building a dedicated thing for kids, it’s likely that you know that you have kids on your platform,” he said.

Penalties can be steep. Google paid a $170 million fine in 2019 as part of a settlement with the FTC and New York’s attorney general over allegations that YouTube illegally collected personal information from children without properly providing notice or obtaining parental consent in violation of COPPA; TikTok predecessor Musical.ly shelled out $5.7 million.

Wall it off

Some streamers have opted to build separate ecosystems designed for young viewers, including Tubi, which debuted Tubi Kids in 2020, and YouTube, which has built out YouTube Kids. (Access to both requires parents or guardians to grant access.)

Other streaming platforms, including Disney+ and HBO Max, offer the option for adult profiles to create additional profiles specifically for kids, which contain parental controls and content restrictions. (Representatives for Disney+, HBO Max, Paramount+, and Tubi declined to share additional information about how they manage kids’ privacy on their platforms.)

“They create the vanilla version of the service that either has different kinds of ads or reduced ads, and handles data in a different way, handles collection and processing of personal information differently than the rest of the service,” Zweifel-Keegan explained.

Those “vanilla versions” can come with ad and targeting limitations. Disney+’s forthcoming ad-supported tier won’t run ads in children’s profiles at launch, Disney chief financial officer Christine McCarthy said this month.

Those walled-off kids’ sections aren’t foolproof when it comes to COPPA enforcement. Kids, of course, can lie, and overly strict age gates could potentially disincentive older children and adults from using them if it blocks those accounts from accessing content parents or guardians deem appropriate, Tayloe told Marketing Brew.

“They have a parent set up this child account, and it’s so dumb and so boring and so restrictive that it doesn’t last very long,” she said.

That becomes even harder as kids get older. Many general-interest shows are beloved by preteens and adults alike, creating a gray area for platforms and enforcers who may have a hard time identifying what kind of viewer is watching—and how that data should be treated. Who’s to say it’s a child and not an adult woman watching Avatar: The Last Airbender on Paramount+?

Getting older

Last month, the Senate Commerce Committee voted to advance an updated version of COPPA (referred to as COPPA 2.0) as well as the Kids Online Safety Act (referred to as KOSA).

As it is written, COPPA 2.0 would extend existing protections to kids up to 16 years of age and would ban targeted advertising to children under 13 regardless of parental consent. KOSA, meanwhile, would require platforms to implement strict privacy settings for young users. Meanwhile, some in the House and Senate are also pushing for a bipartisan federal privacy bill, known as the American Data Privacy and Protection Act, which, as currently written, would create a Youth Privacy and Marketing Division dedicated to overseeing concerns related to children’s privacy.

“Just complying with the law may not be enough, because the direction that we’re heading is toward more enhanced restrictions on what [platforms]should be doing with children’s data,” Zweifel-Keegan said.