The Verizon subsidiary that owns AOL and Yahoo has inked a settlement with New York attorney general Barbara Underwood for violating the Children’s Online Privacy Protection Act (COPPA). Oath has agreed to pay US$4.95 million—the largest-ever COPPA enforcement fine in the US—for conducting billions of auctions for targeted ads on children’s websites. This violation allowed AOL to collect, use and disclose the personal information of users, enabling advertisers to track and serve targeted ads to children.

In addition to the heavy penalty, the company has also agreed to adopt comprehensive reforms to protect children from improper tracking, such as establishing and maintaining a comprehensive COPPA-compliance program, designating an executive or officer to oversee it, providing annual COPPA training for relevant personnel, identifying risks that could result in a violation of COPPA, and retaining an objective, third-party professional to assess the company’s privacy controls.

Oath will also destroy all personal information collected from children in its possession, custody or control.

In 2016, Viacom, Hasbro, Mattel and JumpStart Games reached a US$835,000 settlement with New York attorney general Eric Schneiderman over information tracking on children’s websites. And this past January, Hong Kong-based electronic toy maker VTech agreed to pay the US Federal Trade Commission US$650,000 after it suffered a data breach that exposed the personal information of five million customers (more than half were kids).