According to new research from Adalytics, brands using Google ad-serving software on YouTube may, without their knowledge, be placing ads in content made explicitly for children, The New York Times reported Thursday.
If children click on the ads, they can be directed to sites where their browser is then tagged with tracking software from Google, Meta, Microsoft and other companies.
Those tags make it possible for Big Tech firms to then track a child’s data across the internet, violating the Children’s Online Privacy Protection Act, or COPPA, which stipulates companies must obtain parental consent prior to collecting user data from children younger than 13 for ad-targeting purposes, according to the Times.
In 2019, YouTube’s CEO explicitly promised YouTube would change its policies and stop placing personalized ads on content specifically “made for kids.”
The company made that commitment after YouTube and Google paid a record $170 million settlement after the Federal Trade Commission (FTC) and the New York attorney general accused the company of knowingly and illegally violating COPPA by harvesting children’s personal information through targeted ads.
On the same day the Times article was published, COPPA author Sen. Edward J. Markey (D-Mass.) and Sen. Marsha Blackburn (R-Tenn.) wrote to the FTC, pushing the agency to investigate YouTube and Google for this “egregious” COPPA violation.
“YouTube and Google cannot continue treating young people’s data as an unprotected commodity from which to profit with abandon,” the senators wrote. “Not only must the FTC act, but Congress must also pass legislation to protect young people’s privacy online and finally ban targeted advertising to kids and teens.”
‘A conveyor belt scooping up’ children’s data
According to the Adalytics report, Google’s Performance Max (Pmax) ad targeting software algorithm is placing personalized ads for adult brands on “made for kids” YouTube channels.
Advertisers report they cannot audit the issue themselves because Pmax doesn’t tell them exactly where their ads are placed.
Brands use personalized ads to target viewers by using data gathered from tracking individuals across the internet, collecting information about their behavior and characteristics.
When users — in this case, children — click on a personalized ad, they are clicking on the brand’s website, which harvests and shares their metadata with dozens of data brokers based on that click.
Metadata give advertisers contextual data about individual users to help them profile an audience and deliver highly targeted, personalized ads. Metadata typically include geographical data derived from IP addresses, GPS locators, and Wi-Fi networks; browsing history; age, gender, and income level; search queries, including keywords; device information; and data about which ads the user clicked on and/or purchased from.
Adalytics found YouTube is serving personalized ads from Fortune 500 companies and major media agencies, including Mars, Procter & Gamble, Ford, Colgate-Palmolive, Samsung and others on YouTube channels explicitly labeled “made for kids.”
Altogether, Adalytics identified more than 300 brand ads for adult products — credit cards, solar panels, and accounting software, for example — on nearly 100 YouTube videos “made for kids.”
The ads were shown to a user who was not logged in, so YouTube was not providing age-specific data that would have excluded the viewer from both the ads and the subsequent data collection.
The report also found children’s YouTube channels containing ads with violent content, including explosions, sniper rifles and car accidents.
In some cases, the brands’ adult-focused ad campaigns received their greatest number of clicks from “made for kids” YouTube channels such as “ChuChu TV Nursery Rhymes & Kids Songs,” “CoComelon Songs For Kids + More Nursery Rhymes & Kids Songs” or “Kids Diana Show.”
As a result, dozens of major ad tech and data broker companies are receiving data from viewers of channels made for children who clicked on those ads. That includes several companies — such as Amazon’s Alexa, Facebook, Microsoft Xbox and OpenX — that already paid penalties for COPPA violations, the report said.
The Times noted it is legal and common to run ads targeting adults, who may be watching media with their children, on children’s content and there is no evidence that Google and YouTube violated their 2019 FTC agreement.
That agreement stated that Google and YouTube would:
“Develop, implement, and maintain a system that permits channel owners to identify their child-directed content on the YouTube platform so that YouTube can ensure it is complying with COPPA. … [and] provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.”
A Google spokesman called the report’s findings “deeply flawed and misleading.” According to the Times, Google also challenged a previous Adalytics report on the company’s ad practices, first revealed in June by The Wall Street Journal.
According to the Times:
“[Google] also noted that running violent ads on children’s videos violated company policy and that YouTube had ‘changed the classification’ of the violent ads cited by Adalytics to prevent them from running on kids’ content ‘moving forward.’
“Google said that it did not run personalized ads on children’s videos and that its ad practices fully complied with COPPA. When ads appear on children’s videos, the company said, they are based on webpage content, not targeted to user profiles. Google said that it did not notify advertisers or tracking services whether a viewer coming from YouTube had watched a children’s video — only that the user had watched YouTube and clicked on the ad.”
Ad industry executives interviewed by the Times said they found it difficult to stop their clients’ ads from appearing on children’s videos. After explicitly requesting their ads be excluded from those channels, they would routinely find them appearing on other children’s channels.
“It’s a constant game of Whac-a-Mole,” one advertising executive said.
Third parties, such as advertising networks, also are subject to COPPA where they have actual knowledge they are collecting personal information directly from users of child-directed websites and online services, according to the 2019 FTC agreement.
In its own investigation, the Times also found persistent Google cookies, including advertising cookies, on children’s videos.
Google said it used such cookies on children’s videos only for business purposes permitted under COPPA.
Microsoft told the Times it was investigating the situation. Amazon said it prohibited advertisers from collecting children’s data. Meta declined to comment.
Children’s privacy experts, such as Jeff Chester, executive director of the Center for Digital Democracy, a nonprofit focused on digital privacy, told the Times they were concerned by the report’s findings.
“They have created a conveyor belt that is scooping up the data of children,” he said.