YouTube Ads May Have Led to Online Tracking of Children, Research Says(nytimes.com)
nytimes.com
YouTube Ads May Have Led to Online Tracking of Children, Research Says
https://www.nytimes.com/2023/08/17/technology/youtube-google-children-privacy.html
75 comments
The NSA already has all of Google's data... Surely they could be a whistle blower if they wanted to.
But why would they?
That applies to anyone. Not just 'companies'
See: Piracy, Speeding, Lesser: Fraud, Theft
See: Piracy, Speeding, Lesser: Fraud, Theft
I haven't found that to be true. Plenty of people have the capability of shoplifting without getting caught, but very few people do it. Anyone could go on amazon and buy lockpicking tools to steal from their family friends and neighbors when they know they'll be away, but most people wont. Lots of people working with disabled or other vulnerable people could rape them and get away with it, but they usually don't do that either. Sociopaths aside, most people aren't all that comfortable hurting others and that discomfort grows with the severity of the harm. I think that a large part of what makes things different for corporations comes down to diffusion of responsibility and a lack of meaningful consequences.
There's only a chance that a company will be caught at all, and when they are it often ends up still being profitable for them in the end. This makes crimes more attractive to companies than for most people who tend to suffer severe consequences for even minor infractions of the law. If I owe money to someone and I poison them to try and get out of paying what I owe I'd probably go to prison if I were caught. If a company knowingly poisons an entire city's water supply to avoid paying for properly cleaning up their waste products, and they spend years carefully conspiring to hide that fact from the people they're killing, they can get a fine smaller than what it would have cost them to clean up their mess responsibly in the first place.
It's much easier to hurt people or to choose inaction when acting as part of a group and when you've been told to do something by someone perceived to be an authority or someone with a higher level of responsibility. There is also an aspect of self-preservation here too because again, individuals face disproportionately severe consequences. Being a whistleblower, or even just refusing to do what your boss tells you can be extremely costly. It can be career ending. It can mean not being able to support your family, being forced to live on the streets, or being unable to pay for medications you need to survive. Companies can be caught over and over again committing acts which cause real harm to hundreds or even thousands of people at a time, but still continue to operate more or less as usual.
Perhaps the underlying impulse is sometimes similar (many individuals are opportunistic when it comes to small offenses) but the differences in scale, incentives, and the burden of guilt make the behavior of individuals and corporations very different.
There's only a chance that a company will be caught at all, and when they are it often ends up still being profitable for them in the end. This makes crimes more attractive to companies than for most people who tend to suffer severe consequences for even minor infractions of the law. If I owe money to someone and I poison them to try and get out of paying what I owe I'd probably go to prison if I were caught. If a company knowingly poisons an entire city's water supply to avoid paying for properly cleaning up their waste products, and they spend years carefully conspiring to hide that fact from the people they're killing, they can get a fine smaller than what it would have cost them to clean up their mess responsibly in the first place.
It's much easier to hurt people or to choose inaction when acting as part of a group and when you've been told to do something by someone perceived to be an authority or someone with a higher level of responsibility. There is also an aspect of self-preservation here too because again, individuals face disproportionately severe consequences. Being a whistleblower, or even just refusing to do what your boss tells you can be extremely costly. It can be career ending. It can mean not being able to support your family, being forced to live on the streets, or being unable to pay for medications you need to survive. Companies can be caught over and over again committing acts which cause real harm to hundreds or even thousands of people at a time, but still continue to operate more or less as usual.
Perhaps the underlying impulse is sometimes similar (many individuals are opportunistic when it comes to small offenses) but the differences in scale, incentives, and the burden of guilt make the behavior of individuals and corporations very different.
A common sense observation downvoted on HN because it's critical of Big Tech? Say it isn't so.
It doesn't seem so.
Comment was originally nearly dead. (Only mostly dead though). The butthurt brigade is out in force on this post.
Because clicking a yt ad might land someone on a website with tracking cookies on it?
You could say the same thing about Google search or any website with outgoing links for that matter.
You could say the same thing about Google search or any website with outgoing links for that matter.
Yep. We need to find a way to get rid of tracking entirely.
But children who can't type on a keyboard can navigate YouTube with clicks. If you've never seen a 3-4yo child use YouTube it's a revealing experience.
What does that have to do with anything? The article isn't suggesting YouTube tracked children it's suggesting an advertiser's website did.
*As with children’s television, it is legal, and commonplace, to run ads, including for adult consumer products like cars or credit cards, on children’s videos. There is no evidence that Google and YouTube violated their 2019 agreement with the F.T.C.*
*As with children’s television, it is legal, and commonplace, to run ads, including for adult consumer products like cars or credit cards, on children’s videos. There is no evidence that Google and YouTube violated their 2019 agreement with the F.T.C.*
If your child put a dollar in a soda vending machine at school and the vending machine then took their picture, that would be a similar situation. Arguing that it's not the school's fault your child had their picture taken is silly: the school put the vending machine there. The child didn't know the repercussions and can't make an informed choice.
So if YouTube puts a big ad in an app exclusively for kids then how is it not their problem if clicking that ad then tracks the child? Who cares what website does the tracking if YouTube deliberately sends the child from an app meant for children to a website that tracks them.
So if YouTube puts a big ad in an app exclusively for kids then how is it not their problem if clicking that ad then tracks the child? Who cares what website does the tracking if YouTube deliberately sends the child from an app meant for children to a website that tracks them.
Bullshit. At 3, my kid could navigate to any content he wanted to, typically Spider-Man, Daniel Tiger or some train video in 5-7 clicks.
The path would always be clear, but the steps would vary. Click 3 would be one of those gross people who pimp out their kids to making toy opening videos, etc.
I would not see the same mix of suggestions when I’d use my account on that device. The journey of recommend content is the key.
I could accept that Google didn’t engineer that experience with the intention of targeting my kid. But I don’t find it plausible that they didn’t understand why that pattern monetized so well - YouTube is too good at printing cash. If they didn’t know, they chose not to ask.
Correction/Edit: I didn’t realize that google was fined for this behavior in 2019. Presumably it has changed.
The path would always be clear, but the steps would vary. Click 3 would be one of those gross people who pimp out their kids to making toy opening videos, etc.
I would not see the same mix of suggestions when I’d use my account on that device. The journey of recommend content is the key.
I could accept that Google didn’t engineer that experience with the intention of targeting my kid. But I don’t find it plausible that they didn’t understand why that pattern monetized so well - YouTube is too good at printing cash. If they didn’t know, they chose not to ask.
Correction/Edit: I didn’t realize that google was fined for this behavior in 2019. Presumably it has changed.
Advertising on children's videos ensures that children are probably the ones clicking those ads- thus YouTube ads lead to tracking children.
As stated advertising on children's videos is legal and commonplace, so singling out yt is a little weird. The whole situation is a bit of a paradox to be honest.
The YouTube Kids app does not have any clickable ads[0], so I think the best solution is to bring this same setup to the main app & the website on videos that are marked "For Kids." You can advertise the latest Happy Meal, a new Disney movie, or the latest video game, without letting the user accidentally click a link and begin being tracked.
I do agree that singling out YouTube is strange, but it definitely got people to click.
[0] https://support.google.com/youtubekids/answer/6130541?hl=en
I do agree that singling out YouTube is strange, but it definitely got people to click.
[0] https://support.google.com/youtubekids/answer/6130541?hl=en
You’ve taken the leap that kids watching YouTube == YouTube kids.
That app was, at least when my kid was in that market, a hobbled app with its own significant problems.
YouTube’s issue here are all about how they funnel kids to profitable content.
That app was, at least when my kid was in that market, a hobbled app with its own significant problems.
YouTube’s issue here are all about how they funnel kids to profitable content.
>so singling out yt is a little weird
What do you mean "singling out"? They're the biggest advertising company in the world.
What do you mean "singling out"? They're the biggest advertising company in the world.
Focusing research on one company (which happen to be the biggest video service in the world) is normal. It would tough to ask researchers to never publish until they've gone though every other service provider first.
Almost ten years ago I watched my boss's daughter open YouTube and search for Elmo. She didn't know how to spell Elmo (she didn't know how to spell anything) or which keys were which letters. She had memorized which keys on the iPad keyboard to press. And if she goofed one, Google helpfully corrected it.
Why do "normal" people care about tracking suddenly when it concerns children?
Further more, why did this ever have to be written of as some sort of revelation?
Of course advertisers, not just on Youtube, but pretty much everywhere track children's interests as well as adults. Someone said recently, "the antichrist has already arrived, and he works, in a suit and tie, in advertising" which while hyperbolic is surprisingly fitting. Mass tracking (which is a form of surveillance) for the uses of taking advantage of weaknesses in a human being (impulse control, gotchas, perceived "need", etc.) to reap monetary rewards at the expense of the individual, whether adult or adolescent, whether intelligent, or mentally handicapped... which may result in a percieved or otherwise degredation of QoL. It is immoral, not just unethical.
Most "tracking" scripts aren't age gated, most advertisers don't care, every day I grow to hate them and their institutions more and more. I would say that at this point, not having adblockers, and blocking tracking scripts is a form of enabling these parasites. Which, i believe (with strong conviction) that there is an argument to say that enabling such behavior without contest is unethical at the very least bordering on immoral.
Of course advertisers, not just on Youtube, but pretty much everywhere track children's interests as well as adults. Someone said recently, "the antichrist has already arrived, and he works, in a suit and tie, in advertising" which while hyperbolic is surprisingly fitting. Mass tracking (which is a form of surveillance) for the uses of taking advantage of weaknesses in a human being (impulse control, gotchas, perceived "need", etc.) to reap monetary rewards at the expense of the individual, whether adult or adolescent, whether intelligent, or mentally handicapped... which may result in a percieved or otherwise degredation of QoL. It is immoral, not just unethical.
Most "tracking" scripts aren't age gated, most advertisers don't care, every day I grow to hate them and their institutions more and more. I would say that at this point, not having adblockers, and blocking tracking scripts is a form of enabling these parasites. Which, i believe (with strong conviction) that there is an argument to say that enabling such behavior without contest is unethical at the very least bordering on immoral.
Because normal people want to protect children from being exploited. Adults on the other hand are more or less catch as catch can.
And in the USA at least tracking children under 13 is illegal.
And in the USA at least tracking children under 13 is illegal.
But why, what argument can you make in favor of protecting children that doesn't hold up for adults (why wouldn't it)?
Because children can not give informed consent. It is that simple.
What percentage of internet users give informed consent to be tracked?
It’s common nomenclature that a website costs money to run and maintain. If you’re not paying a premium to use the website then you are going to receive ads to offset the price. This much is well known to the public. It’s implied consent,
The real concern is determining how much or if you are being tracked through these ads. People are more aware that ads do track them but not what or how much. A larger concern is the malaise people may give when they hear this information; to put simply they don’t care. The frog is aware that the pot is getting hotter and they’re willingly asking for the man to go higher.
The real concern is determining how much or if you are being tracked through these ads. People are more aware that ads do track them but not what or how much. A larger concern is the malaise people may give when they hear this information; to put simply they don’t care. The frog is aware that the pot is getting hotter and they’re willingly asking for the man to go higher.
[deleted]
In this case, it's because Google agreed to try to limit tracking children in a government settlement.
Surveillance industry: We're shocked! Shocked to find out that child surveillance is going on around here. (Your dossiers, sir)
Seriously, the US desperately needs a port of the GDPR that applies to people of all ages. As long as there are escape hatches for claiming plausible deniability, companies will abuse them.
Seriously, the US desperately needs a port of the GDPR that applies to people of all ages. As long as there are escape hatches for claiming plausible deniability, companies will abuse them.
Right on. Just because a company provides a lot of apparent value doesn't mean they should be exempt from these kinds of regulations.
"May have". As if the FAANG company most deeply embedded in advertising, which is synonymous with identification and tracking, isn't just putting on a show of contrition to get the Bad Publicity Machine off of its back. I'll put away my cynicism when the world shows me it isn't warranted. By, you know, not tracking everything with the single-mindedness of a rabid bloodhound in an effort to seeeerve aaaaadz every second of every day to every person on the face of the planet.
Can you cite what in the article gave you the impression this had anything to do with YouTube and not the advertisers themselves? Because from what can tell, YouTube is relevant here only from a clickbait headline standpoint. The real issue, I guess, is that the websites themselves had tracking which was tied to the YouTube ad. I don't see what this has to do with alphabet.
While I'm enough of an asshole to maliciously comply and copy-paste most of the article, I can't be bothered to do that. So here's two paragraphs.
[Google] added that it did not have the ability to control data collection on a brand’s website after a YouTube viewer clicked on an ad. Such data-gathering, Google said, could happen when clicking on an ad on any website.
Even so, ad industry veterans said they had found it difficult to prevent their clients’ YouTube ads from appearing on children’s videos, according to recent Times interviews with 10 senior employees at ad agencies and related companies. And they argued that YouTube’s ad placement had put prominent consumer brands at risk of compromising children’s privacy.
The argument was already put forth that Alphabet can't control what's on the advertisers' sites. But for a company that loves hoovering up data they seem to have picked an interesting blind spot that their algorithms "can't" fine-tune for. And they of course always have the choice to not run ads for websites that deposit a deluge of trackers, but that would mean revenue down, big sad.
And your rebuttal is.... a downvote. How erudite.
[Google] added that it did not have the ability to control data collection on a brand’s website after a YouTube viewer clicked on an ad. Such data-gathering, Google said, could happen when clicking on an ad on any website.
Even so, ad industry veterans said they had found it difficult to prevent their clients’ YouTube ads from appearing on children’s videos, according to recent Times interviews with 10 senior employees at ad agencies and related companies. And they argued that YouTube’s ad placement had put prominent consumer brands at risk of compromising children’s privacy.
The argument was already put forth that Alphabet can't control what's on the advertisers' sites. But for a company that loves hoovering up data they seem to have picked an interesting blind spot that their algorithms "can't" fine-tune for. And they of course always have the choice to not run ads for websites that deposit a deluge of trackers, but that would mean revenue down, big sad.
And your rebuttal is.... a downvote. How erudite.
> And your rebuttal is.... a downvote. How erudite.
No need to be presumptuous. Hackernews doesn't allow parents to downvote replies.
No need to be presumptuous. Hackernews doesn't allow parents to downvote replies.
>YouTube is relevant here only from a clickbait headline standpoint.
Huh? Why would you think it's not in Google's best interest -- from an ethical, business and perhaps legal standpoint-- to police what its advertisers do?
Huh? Why would you think it's not in Google's best interest -- from an ethical, business and perhaps legal standpoint-- to police what its advertisers do?
This isn't about what's in their best interest. Google has no way of knowing what analytics are being collected on websites they do not control.
Surprising, given they’re able to know more or less everything else about those sites. If their scraper can track Core Web Vitals why can’t it track Core Privacy Vitals? A cynic would suggest it’s because Google considers itself better off not knowing.
Oh so google DOESN'T have a surveillance apparatus embedded in nearly every website that exists that by design sends them as much data as possible even on third party sites?
Or did you forget about Analytics.
Or did you forget about Analytics.
Why would it be okay to track adults and not children? Adults don't get any privacy?
Federal law says you get the right to not be tracked until 13.
Adults are capable of consenting to it.
How many adults truly understand the data being collected, with whom it is going to be shared with and how will it be used? I doubt even the people writing the tracking code themselves actually know what will happen with the collected data.
I figured this reply would be coming.
Ages of consent (no matter the context) are basically ballpark guesses. It’s not like every 20 year and 364 day old lacks the mental capacity to responsibly drink alcohol and every 21 year old does. As a society we’ve settled on these ages as being reasonable averages. It is what it is and absent any realistic alternative (cognitive tests before a browser launch is permitted?) it’ll stay that way.
Ages of consent (no matter the context) are basically ballpark guesses. It’s not like every 20 year and 364 day old lacks the mental capacity to responsibly drink alcohol and every 21 year old does. As a society we’ve settled on these ages as being reasonable averages. It is what it is and absent any realistic alternative (cognitive tests before a browser launch is permitted?) it’ll stay that way.
I don't think that's a fully accurate analogy though when applied to this context. I think the argument here is that most people don't have even the most basic understanding of what exactly it is they're agreeing to in the first place. It's like if the ABV of every alcoholic drink was written in hieroglphics as the solution to a quadratic equation. And some nerds would care to learn about how to decipher them but most people would never bother because its far too much hassle.
In society we consider consent/contracts that were entered to without understanding by one party to be null and void in many scenarios. Its a reason for example that most EULAs are dubiously enforcable (ofc it depends on how reasonable the eula clause being litigated is) there have been a good few rulings that release users from having to abide by them because they can't be expected to know their own obligations for every one of myriad services they use daily.
In society we consider consent/contracts that were entered to without understanding by one party to be null and void in many scenarios. Its a reason for example that most EULAs are dubiously enforcable (ofc it depends on how reasonable the eula clause being litigated is) there have been a good few rulings that release users from having to abide by them because they can't be expected to know their own obligations for every one of myriad services they use daily.
The alternative is to not allow tracking at all.
We have a full legal system based on parents or guardians being able to provide consent for their kids. How is this different?
I never provided consent for my kids - but here they are being tracked.
Did you have a more specific point to make here?
Did you have a more specific point to make here?
In the US, COPPA requires that tracking kids or even storing most PII of them be accompanied with parental consent. YouTube got hit with the biggest fine to date for doing this, partially because kids were watching kids' YouTube videos but on their parents' google account, and thus were being tracked and getting ads targeted towards them[0].
However, this research seems to be about children clicking ads, and then being tracked by that third party (or maybe even google ads/doubleclick on the page).
0: https://www.ftc.gov/news-events/news/press-releases/2019/09/...
However, this research seems to be about children clicking ads, and then being tracked by that third party (or maybe even google ads/doubleclick on the page).
0: https://www.ftc.gov/news-events/news/press-releases/2019/09/...
oh good, where do I opt out?
Examples of the garbage YouTube gives my kids:
- huggy wuggy (horror)
- kissy missy (horror)
- poppy playtime (horror)
- commercial drivers license advertising (they click on truck pictures)
- accident lawyer advertising (again pictures of trucks)
- videos of kids playing with toys with no identifiable words being spoken (laughter machine and fizz bang noises)
How could youtube avoid this without verifying everyone's age?
Google puts together a probable age based on the profile they collect about you.
They 100% know they are advertising to some children, even if just by mistakenly mislabeling children as older in rare cases. That's impossible to prevent through probabilistic means, so by implementing such systems they have accepted such an outcome.
They 100% know they are advertising to some children, even if just by mistakenly mislabeling children as older in rare cases. That's impossible to prevent through probabilistic means, so by implementing such systems they have accepted such an outcome.
There is no need to explicitly tell them your age.
That's the problem.
They know based on usage patterns. They know what age groups watch which videos. They use it to target children.
But because they didn't explicitly collect it, they can skirt the law.
The intent of the law is being ignored for profit.
That's the problem.
They know based on usage patterns. They know what age groups watch which videos. They use it to target children.
But because they didn't explicitly collect it, they can skirt the law.
The intent of the law is being ignored for profit.
What is the intent of this law? And why is that a good intent?
Tech has solved more difficult problems. Maybe they should do that instead of relying on the same old “yes I was born in 1900” age verifications that are prevalent today.
[deleted]
"Google said it used such cookies on children's videos only for business purposes permitted under COPPA, such as fraud detection or measuring how many times a viewer sees an ad. Google said the cookie contents "were encrypted and not readable by third parties."
"Under COPPA, the presence of cookies is permissible for internal operations including fraud detection," said Paul Lekas, head of global public policy at the SIIA, a software industry group whose members include Google and BMO, "so long as cookies and other persistent identifiers are not used to contact an individual, amass a profile or engage in behavioral advertising.""
How would we verify how Google uses cookies. When Google gets sued for privacy violations or is subject to regulatory action, it usually settles or pays a fine. Admitting no wrongdoing and yet by implication suggesting exactly that. By settling, it may avoid discovery that could perhaps show, for example, how cookies are actually being used.
In 2019, Google allegedly was violating COPPA and paid a fine.
https://www.ftc.gov/news-events/news/press-releases/2019/09/...
If Google was not violating COPPA, they have could disproved the allegations. But instead they signed a consent decree.
This would not be the first time we have seen Big Tech violate privacy-related a consent decree.
"Under COPPA, the presence of cookies is permissible for internal operations including fraud detection," said Paul Lekas, head of global public policy at the SIIA, a software industry group whose members include Google and BMO, "so long as cookies and other persistent identifiers are not used to contact an individual, amass a profile or engage in behavioral advertising.""
How would we verify how Google uses cookies. When Google gets sued for privacy violations or is subject to regulatory action, it usually settles or pays a fine. Admitting no wrongdoing and yet by implication suggesting exactly that. By settling, it may avoid discovery that could perhaps show, for example, how cookies are actually being used.
In 2019, Google allegedly was violating COPPA and paid a fine.
https://www.ftc.gov/news-events/news/press-releases/2019/09/...
If Google was not violating COPPA, they have could disproved the allegations. But instead they signed a consent decree.
This would not be the first time we have seen Big Tech violate privacy-related a consent decree.
If they support personalized recommendations at all for children's accounts or on youtube kids, then they are clearly in violation of the law.
Going to youtubekids.com, it makes parents (the age check is a 1st grade arithmetic question) agree to this, so they're clearly in violation of the law according to your Paul Lekas quote:
We also use this information to offer users personalized content. We associate an identifier that's unique to the app with the videos your child has watched and terms they've searched for to recommend content likely to be of interest to them, subject to the controls described below.
We use unique identifiers to provide contextual advertising, including ad frequency capping. The app does not allow interest-based advertising or remarketing.
YouTube Kids does not allow your child to share personal information with third parties or make it publicly available.
But then later, they make it clear that they also don't allow your child to avoid sharing personal information with third parties:
For external processing
We may provide individual user information to our affiliates or other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures.
They then incorporate additional ToS documents by reference. It's already clear they're violating COPPA according to SIIA, so I'm not going to bother continue reading:
You can find additional information about the app in the YouTube Kids Privacy Notice and the Parental Guide. Our Disclosure for Children explains our data processing practices to your child, which we encourage you to review with them.
Dated: August 7, 2019
Going to youtubekids.com, it makes parents (the age check is a 1st grade arithmetic question) agree to this, so they're clearly in violation of the law according to your Paul Lekas quote:
We also use this information to offer users personalized content. We associate an identifier that's unique to the app with the videos your child has watched and terms they've searched for to recommend content likely to be of interest to them, subject to the controls described below.
We use unique identifiers to provide contextual advertising, including ad frequency capping. The app does not allow interest-based advertising or remarketing.
YouTube Kids does not allow your child to share personal information with third parties or make it publicly available.
But then later, they make it clear that they also don't allow your child to avoid sharing personal information with third parties:
For external processing
We may provide individual user information to our affiliates or other trusted businesses or persons to process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures.
They then incorporate additional ToS documents by reference. It's already clear they're violating COPPA according to SIIA, so I'm not going to bother continue reading:
You can find additional information about the app in the YouTube Kids Privacy Notice and the Parental Guide. Our Disclosure for Children explains our data processing practices to your child, which we encourage you to review with them.
Dated: August 7, 2019
> If they support personalized recommendations at all for children's accounts or on youtube kids, then they are clearly in violation of the law.
That was not my understanding of COPPA, how is this violating it if it is used for the service and the parent gives consent?
That was not my understanding of COPPA, how is this violating it if it is used for the service and the parent gives consent?
YouTube videos are full of ads and product placement, which are disallowed according to the Google-funded lobbyist in the comment I replied to.
[deleted]
Good to see the NYT[1] reporting on this important issue.
[1] https://news.ycombinator.com/item?id=37170384
[1] https://news.ycombinator.com/item?id=37170384
The feds should offer huge payouts to employees of companies to come forward with the truth.
[deleted]
Water may have led to wetness, research says.
There's no way that Google isn't collecting massive amounts of children's data. The fact that we force children to sign up for Google accounts and use chromebooks in schools sickens me.
I see zero reason to trust Google when they say they aren't using the data they collect to make inferences about our children. It would take a whistleblower (and one with extraordinary access within Google's org) for us to have clear picture of all the ways that data is kept and abused. I'm not sure what the solution to that is though. Random unannounced independent audits? Since they're likely there already, maybe we can have the government officials who work in the Google equivalent of Room 614A (https://en.wikipedia.org/wiki/Room_641A) keep an eye on them?