Google faces £2bn GDPR class action over kids' privacy

Google is facing yet another day in the UK’s High Court over a breach of privacy and data rights with the launch of a new legal case against its YouTube subsidiary for collecting children’s data without parental consent.

Privacy expert Duncan McCann, who is bringing the action, argues that by gathering data on youngsters, Google is in breach of the UK Data Protection Act 2018 and GDPR.

The father of three children aged under 13 told the BBC that the class action is the first in Europe brought against a technology firm on behalf of children. He reckons that, if successful, damages of between £100 and £500 could be payable to those whose data has been breached.

He said he is bringing the case for about 5 million British children, as well as their parents or guardians, and that Google’s total bill could be more than £2bn.

“When the Internet first emerged, we used to be worried about how children used it,” McCann said. “That is still a problem, but now it’s a two-way street. We need to focus on how the Internet is using our children, and ask ourselves if we’re comfortable with them becoming a product for these digital platforms? That’s the future I don’t want.”

The case will focus on children who have watched YouTube since May 2018, when both the DPA and GDPR came into force. Campaign group Foxglove and law firm Hausfeld have said they would support the action.

McCann added: “I think we’re at the stage, where the only way we can move forward and hold these companies accountable is through the legal process.”

A YouTube spokesperson said: “We don’t comment on pending litigation. YouTube is not for children under the age of 13.

“We launched the YouTube Kids app as a dedicated destination for kids and have made further changes that allow us to better protect kids and families on YouTube.”

The video platform has also previously insisted that it does not sell its users’ personal information to advertising companies. However, Google only introduced a ban on brands running targeted ads on YouTube kids’ videos in January this year, as part of a $170m settlement with US authorities over alleged violations of children’s privacy laws.

Although the settlement over potential breaches of the US Online Privacy Protection Act (Coppa) only applied in the States, Google implemented the changes globally and conceded it would have “a significant business impact” due to reduced ad revenue.

Even so, anyone looking for a swift judgment in the UK could be disappointed. The case is not expected to even be heard before next autumn, with a ruling unlikely to be made until 2022 at the earliest.