by Benjamin Stein

A Massachusetts parent filed a purported class-action suit against Google this month over its privacy practices on YouTube. This suit is the latest in a series of as yet unsuccessful attempts by the plaintiffs bar to effectively carve out a private right of action under the federal Children’s Online Privacy Protection Act (COPPA) by using conduct that purportedly violates COPPA as the basis for a state-law claim.

COPPA notably lacks a private right of action; it vests enforcement authority solely in the Federal Trade Commission (FTC) and state Attorneys General. While government enforcers have been active on COPPA issues in recent years (see here, here, and here, for example), that has not dissuaded some plaintiffs from attempting to find a way to bring their own COPPA actions.

In this most recent case (Ridenti v. Google, LLC, No. 1:20-cv-10517 (D. Mass. Mar. 13, 2020)), the allegations are largely repetitive of those laid out by the FTC in its own COPPA settlement with YouTube last year (discussed in detail here) — with the added claim that plaintiff’s children watched YouTube videos and that YouTube failed to secure plaintiff’s consent to the resulting collection of their personal information.

After foreswearing any direct attempt to recover under COPPA, plaintiff argues that acts considered by the FTC to be unfair or deceptive (which includes COPPA violations) are likewise violative of Massachusetts’ own unfair-practices law, Mass. Gen. Laws Ch. 93A, and that YouTube’s purported COPPA violations thus form the basis for an actionable state-law claim.

Last year, Google defeated a similar claim brought in South Carolina. Google and a number of other defendants are currently in the early stages of another suit in California attempting to springboard state-law claims off of purported COPPA violations.

While none of these attempts to create a de facto private right of action under COPPA have yet been successful, the trend is regardless concerning. If any plaintiff is ultimately successful in this tack, the risk associated with potentially running afoul of COPPA could change dramatically and immediately.

If you operate an online service that knows itself to have users younger than 13 or could be considered “directed to children” in any capacity and you are unsure whether you’re COPPA compliant, it is always a good time to investigate and confirm.