The acronym “ESG” is shorthand for environmental, social, and governance concerns.  In recent years, companies have used “ESG” to refer to initiatives involving climate change, responding to racial injustice, and supporting workers’ rights.  The “S” in ESG can be a bit nebulous, however, as “social” may refer to any number of issues affecting a corporation, its stakeholders, and the community at large. For example, children’s privacy has always been a hot button social issue, but it has only gained traction during the COVID-19 pandemic as children have transitioned to remote learning and socializing online more than ever before. And a derivative lawsuit suggests that companies may want to ensure they are responding to child privacy concerns as part of their regular ESG practices and policies.

In re: Alphabet involved the alleged violation of a major law protecting children’s privacy: the aptly-named Children’s Privacy Protection Act (“COPPA”). Specifically, shareholders sued the directors of Alphabet—the parent company of YouTube and Google—for their alleged knowledge and conscious disregard of the company’s COPPA violations.

Alphabet’s directors had historically taken the position that YouTube was a “general audience” website, which would exempt it from COPPA’s data collection requirements for websites “directed at children.”  The FTC opened (and notified Alphabet of) a non-public investigation into YouTube’s compliance with COPPA in 2016. Over the years that followed, Alphabet’s directors maintained that YouTube is a general audience platform not required by COPPA to identify which user-channels are child-directed. Ultimately, Alphabet settled with the FTC and the New York Attorney General in 2019 for a $170 million civil penalty—the largest ever collected by the FTC. Alphabet did not, however, admit guilt in connection with the settlement.  Subsequently, shareholders of Alphabet brought a derivative action in the Northern District of California, claiming alleged COPPA violations demonstrated the Board had failed to oversee the company (known as a Caremark claim).

Because the plaintiffs did not make a shareholder demand before bringing suit, the court began its analysis with the two-prong Rales test for demand futility. Under Rales, plaintiffs must show reasonable doubt that a majority of the board could be (i) disinterested or (ii) independent in considering a shareholder demand. The court’s decision focused on the interestedness prong. While defendants and the court agreed that the directors were “acutely aware” of the FTC investigation, the court distinguished an awareness of accusations from an awareness of actual violations of law.  As such, the plaintiffs were unable to establish interestedness because they could not show that the directors would face a substantial likelihood of liability for their involvement in the alleged corporate wrongdoing. The court noted the Board’s position with respect to YouTube’s status as a “general audience” website and the resulting inapplicability of COPPA, as well as the FTC’s previous statements in accordance with the Board’s view. In light of those facts, the court explained that “even the most charitable reading points to something [not] sinister: an earnestly fought legal dispute.” As a result, the case was dismissed in its entirety.

The takeaway is two-fold. First, when taking contested legal positions, directors must remember their fiduciary duty of oversight and the attendant risk of Caremark claims. Accordingly, they should ensure their positions are legally sound and are not causing their company to continue to violate applicable law.  Second, even though the court dismissed the lawsuit, the social concerns implicated by Alphabet’s alleged COPPA violations likely heightened both media and shareholder attention to the facts underpinning the complaint. As such, companies that participate in areas affecting children’s online presence may want to strengthen any existing internal controls and corporate governance regarding legal and regulatory compliance.