Game-Changing Class Action Lawsuit Against YouTube Sets New Precedent for Children’s Data Rights
Author: Aebha Curtis, Policy Analyst, TrustElevate
In a landmark instance of data protection legal action, a class action lawsuit has been filed against YouTube for the alleged mishandling and selling of children’s data, seeking damages of £2.5 billion. The case’s representative claimant argues that YouTube has routinely breached the EU’s General Data Protection Regulation and the UK’s Data Protection Act through unlawful targeting of addictive content and the collection and sale of children’s data without parental consent.
The claimant, Duncan McCann, is a researcher of the digital economy and father of three. McCann has said, of the case and of the platform in question:
“My kids love YouTube, and I want them to be able to use it. But YouTube needs to comply with the law. It isn’t ‘free’ – our kids are paying for it with their attention and private data. Like many parents, I am conscious of what’s happening with my kids’ data online, but even so it’s just impossible to combat Google’s lure and influence, which comes from its surveillance power. There’s a massive power imbalance between us and them, and it needs to be fixed.”
The case is being brought on behalf of 5 million children under the age of 13, a figure which was arrived at due to Ofcom’s finding that 50% of children in England and Wales aged 3-4 years old and 90% of children aged 12 years old use YouTube’s main service. Those who believe their children are eligible to be represented among the class should register here.
If the action is successful, according to the YouTube data claim site, “each affected child and parent will be entitled to claim their portion of the compensation. The exact amount of money to which each affected child and parent is entitled will be determined by the court but could be in the region of £100 - £500.”
Though YouTube is expected to argue that their platform YouTube Kids - launched in 2015 - is the designated platform for children and family-friendly content, the main platform still hosts masses of content aimed at young children and uses their data and viewing patterns to inappropriately target children with that which is most likely to drive further viewership: that can be both shocking and potentially harmful to their wellbeing. The misuse of children’s data drives their exposure to risk online. In a recent case, for example, a toddler was traumatized after watching disturbing images in a Peppa Pig YouTube Video. The findings of an investigation conducted by the Huffington Post further indicate that YouTube’s algorithms are driving users to extreme content as predators compile playlists of children in compromising situations.
Technical solutions do exist: for example, TrustElevate is an identity RegTech service that enables companies handling under 16s’ data to do so in compliance with a raft of regulations including GDPR, PSD2 and e-Privacy Regulation. TrustElevate verifies under-16s' ages and, for under-13s, verify an assertion of parental responsibility for a child so a parent can give grant, deny and revoke consent to data processing, purchasing and access.
With the Age Appropriate Design Code having come into force on 2 September 2020 (with a 12 month transition period), it has been established that it is simply not enough for digital platforms to claim that children are not their target audience and therefore shirk their duty of care for children as vulnerable data subjects. Rather, all platforms whose services are likely being used by children must leverage certain protective mechanisms to ensure that children’s data is not misused or used to target them inappropriately.
Among those mechanisms, as stated by the representative law firm, required but not currently in place are “practical age requirements” and “adequate attempt[s] to limit usage by youngsters”.
The claim, in making YouTube liable to its users, will set a never-before-seen precedent regarding the relationship between platforms and their users as well as reinforcing the principle of users’ data rights by holding platforms accountable for any subversion of such rights.
About TrustElevate
TrustElevate is a B2B2C identity RegTech service that enables companies handling under 16s’ data to do so in compliance with a raft of regulations including GDPR, DPA 2018, PSD2 and e-Privacy Regulation. TrustElevate verifies under-16s' ages, and for under-13s, we verify parental responsibility so a parent can give consent to data processing, purchasing and access.
For more information contact info@trustelevate.com
