Google must face claims it violated children’s privacy by tracking them for ad purposes, a federal appellate court has confirmed.

In a decision issued Thursday, a three-judge panel of the 9th Circuit Court of Appeals reiterated its prior ruling that the federal Children’s Online Privacy Protection Act doesn’t prevent individuals from suing over alleged children’s privacy violations.

The Children’s Online Privacy Protection Act prohibits website operators and apps from collecting tracking data from children under 13, without parental consent. That statute, which doesn’t allow for lawsuits by consumers, explicitly overrides inconsistent state laws.

The appeals court said in December, and confirmed on Thursday, that the Children’s Online Privacy Act doesn’t preclude lawsuits based on state laws that are consistent with the substantive federal requirements — only state laws that are substantively inconsistent.

The new ruling comes in a battle dating to 2019, when California resident Nicole Hubbard sued YouTube and channel operators — including Hasbro, the Cartoon Network, Mattel, and DreamWorks — on behalf of her child. She alleged in a class-action complaint that her 5-year-old child watched YouTube channels that are aimed at young children — including Ryan ToysReview, Hasbro’s “My Little Pony Official,” and CookieSwirlC.

Her lawsuit, later joined by other parents, came roughly two months after Google agreed to pay $170 million to settle allegations by the Federal Trade Commission and New York Attorney General that YouTube violated the federal children’s privacy law by collecting data from viewers younger than 13.

The families claimed in a class-action complaint that the companies violated various laws in California and other states by collecting tracking data from children. For instance, the complaint claimed that the alleged tracking amounted to “intrusion upon seclusion” — a privacy claim that can be brought in California, and that involves “highly offensive” conduct.

U.S. District Court Judge Beth Labson Freeman in the Northern District of California threw out the lawsuit, ruling that the state-law claims were overridden by the federal Children’s Online Privacy Protection Act.

Lawyers for the families appealed, arguing to the 9th Circuit that the claims in the complaint were “parallel” to the federal law, and therefore not precluded. 

Google countered that the “core of each claim” was the alleged violation of the federal law. (Hasbro, Mattel and the other channel operators added in separate papers that the complaints didn’t allege that the channel operators actually collected data from children.)

A panel of the 9th Circuit rejected Google’s argument late last year. The company then asked the appellate court to reconsider, arguing that the panel “ignored” the wording of the federal law, as well as “its structure and purpose.”

The appellate judges asked the Federal Trade Commission to weigh in on whether the Children’s Privacy Protection Act overrides the families’ claims.

In May, the FTC argued in a friend-of-the-court brief that the families should be able to pursue their claims.

“Congress did not intend to wholly foreclose state protection of children’s online privacy,” the FTC wrote.

The decision issued Thursday referenced the FTC’s filing, noting that the agency agreed the state-law privacy claims were not precluded.