By Charles Sosnik
News that Google and YouTube agreed to pay $170 million for violating children’s privacy barely registers anymore. A few years ago, such an announcement would have sparked public outrage and serious consequences. Today, however, large settlements from dominant tech companies feel like routine business expenses rather than meaningful accountability.
A couple of months earlier, Facebook reached a record $5 billion settlement with the Federal Trade Commission over privacy violations. Facebook did not admit wrongdoing. When fines reach those sizes, they stop resonating with the average person: $170 million for collecting children’s data sounds like a lot—until you compare it to the scale of the wrongdoing. $5 billion against a company as massive as Facebook can be framed as a penalty that’s painful on paper but not transformative in practice.
People continue to use these services. Kids still watch YouTube. Adults still rely on Facebook to stay connected. These platforms are deeply woven into daily life, and for many users there is no viable alternative. The market dominance of Google, YouTube, Facebook and similar companies creates a reality where consumer withdrawal is impractical, and fines do little to change behavior or deter future misconduct.
Analysts and regulators pointed out that the $170 million settlement—split between the Federal Trade Commission and the New York State Attorney General—amounts to little more than a slap on the wrist for the companies involved. The state will receive roughly $34 million, with the remainder going to the FTC. From a regulatory perspective it looks like a win, but from a justice perspective it leaves a lot unanswered.
The core issue is straightforward and troubling: YouTube collected personal data from children on kids’ channels without parental consent, in violation of the Children’s Online Privacy Protection Act (COPPA). According to the FTC, Google and YouTube used cookies and other tracking mechanisms to build profiles on young users and then used that data to sell targeted advertising. YouTube even marketed its reach among children directly to toy makers and brands, telling companies like Mattel that it was a leading destination for kids aged 6–11 and telling Hasbro that YouTube was the “#1 website regularly visited by kids.”
This isn’t a one-off mistake. The conduct occurred repeatedly and at scale, exposing a vast number of children to data collection practices their parents never authorized. Personal information gathered from children can be harmful, and it persists indefinitely. The consequences can follow those children throughout their lives.
Despite the scale and repeated nature of these violations, no individual executives or employees faced criminal charges or prison time. The penalties were paid by the corporate entities, not by the people who made the decisions. Yet corporate misconduct is the result of choices made by individuals within those companies. If a person in a small firm committed similar fraud on the same scale, criminal prosecution and prison time would be likely.
The public relations response from YouTube—most notably from then-CEO Susan Wojcicki—was predictable: statements emphasizing a commitment to protecting kids and their privacy. But those statements ring hollow when contrasted with the documented violations. Messaging and damage control can blunt public outrage, and when the companies remain central to everyday life, many users move on.
So what should change? For privacy laws to have real deterrent power, enforcement must be meaningful. Reclassifying large-scale, intentional violations of children’s privacy as criminal acts—including personal accountability for decision-makers—would raise the stakes and change incentives. If corporate violations carry only civil penalties that can be absorbed by a multinational’s balance sheet, they will not reliably deter future misconduct.
If regulators and lawmakers are unwilling to enforce privacy protections in practice, then the rules themselves deserve reconsideration. Either statutes must be backed by stronger enforcement mechanisms and meaningful penalties, or they should be reformed to reflect realistic regulatory capability. Meanwhile, rhetoric from company leaders should be met with scrutiny rather than acceptance.
The public deserves more than repeated settlements and public statements. Meaningful accountability requires putting personal responsibility at the center of enforcement so that companies and their leaders face consequences proportionate to the harm caused.
About the Author
Charles Sosnik is an education journalist and editor, and serves as editor in chief at the Learning Counsel.