⚠️ A PDF version of this report can be found by clicking this URL. ⚠️

DISCLAIMER: This research is based on empirical digital forensics using publicly available tools, citations of various public documentation, and data provided by media buyers who employed demographic and behavioral advertising campaigns on Google’s ad buying platforms. This research is not a legal document, it is not intended to provide legal advice, and the report does not make any allegations or claims that any laws were violated. In certain cases, this research examines the presence of various client-side identifiers or variables that are documented publicly to be for the purpose of "advertising". This report makes no claims or assertions as to whether those identifiers or variables are actually used for any other purposes.

Executive Summary

Key points

1. YouTube’s CEO said in 2019 that the platform would “limit data collection and use on videos made for kids only to what is needed to support the operation of the service;” however, YouTube appears to be setting or transmitting “advertising” cookies and identifiers on the devices of viewers who are watching “made for kids” videos as of July 2023.

2. YouTube’s CEO said in 2019 that the platform would stop serving personalized ads on “made for kids” content. However, demographically and behaviorally personalized ad campaigns appear to have ads being served on “made for kids” YouTube channels as of July 2023.

3. YouTube is serving ads from many (‘adult’) Fortune 500 advertisers and major media agencies on YouTube channels that are labeled as “made for kids.” These include major brands such as Mars, Procter & Gamble, Ford, Colgate-Palmolive, Samsung, and many others.

a.) In some (adult) brands’ personalized ad campaigns, the top YouTube channels by clicks or clickthrough rate are popular “made for kids” YouTube channels such as “ChuChu TV Nursery Rhymes & Kids Songs”, “CoComelon Nursery Rhymes & Kids Songs”, or “Kids Diana Show.”

4. The viewers of “made for kids” YouTube videos appear to be clicking on ads, and brands’ websites – such as Michigan State Police, Disney, BMW, Hyundai, and Verizon - are harvesting and sharing meta-data on those viewers with dozens of data brokers upon click through. This raises the possibility that brands have “data poisoned” their first party datasets with data derived from thousands of viewers of “made for kids” videos.

5. Dozens of major ad tech and data broker companies are receiving data from viewers of “made for kids” YouTube videos who clicked on an ad – these include several companies who paid penalties for COPPA related enforcements, such as Amazon, Facebook, Microsoft, and OpenX. Foreign-owned companies such as TikTok are also receiving meta-data from viewers of “made for kids” content from advertisers’ websites.

a.) Some companies appear to be scraping or exfiltrating Google generated user identifiers from viewers of “made for kids” videos who had clicked an ad, which could hypothetically prevent Google from being able to fully respond to “right to know” or “right to delete” requests under privacy laws such as the GDPR or CCPA. It is unclear if Google is aware of this situation, or if it is a form of “data leak.”

6. Google’s Performance Max (“Pmax”) ad targeting algorithm appears to be placing adult brands’ ads on “made for kids” YouTube channels; advertisers report they cannot audit this issue because Pmax does not provide them with granular placement reports.

7. Premium, high-cost YouTube Select (formerly known as “Google Preferred”) ads from brands such as Shopify appear to be served on relatively low subscriber count “made for kids” YouTube videos.

8. Google and YouTube itself have been observed serving ads on “made for kids” YouTube videos (for products such as YouTube Premium, YouTube NFL Sunday Ticket, or Chrome Enterprise); if a viewer of these “made for kids” videos clicks on a Google product ad, the Google-controlled websites appear to set or collect unique identifiers on the viewer of the “made for kids” video.

a.) Google’s own Advertising Policies state that advertising on made for kids content may not use “any third party trackers or otherwise attempt to collect personal information without first obtaining parental consent.”

b.) The Terms of Service for YouTube TV NFL Sunday Ticket and YouTube Premium state that both products can only be purchased by adults who are 18 years or older; it is unclear why YouTube is serving ads for products that children cannot purchase on ‘made for kids’ videos. Google’s own Advertising Policies prohibit serving ads on “made for kids” content where “the desired action can’t be completed.”

9. Many advertisers have reported that they do not want their ads served on “made for kids” videos; however, these media buyers report that Google’s software controls make it very difficult if not impossible to completely avoid “made for kids” videos.

a.) Keyword exclusion lists for terms like “kids” or “children” do not appear to prevent brands’ ads from being served adjacent to YouTube videos that explicitly contain the words “kids” or “children” in the title of the YouTube video.

10. Despite YouTube having an internal classification system of which videos and channels the platform has marked as “made for kids”, survey results suggest that the platform does not appear to make available an easy interface that would allow an advertiser to quickly exclude all media that YouTube has labeled as “made for kids” from its ad campaigns.

11. YouTube appears to create an un-disclosed persistent, immutable unique identifier called the “X-Goog-Visitor-ID” which gets transmitted to Google’s servers even when a consumer is watching “made for kids” video content; it is unclear for what purpose Google is collecting this undisclosed identifier.

12. The YouTube iPhone iOS app creates unique click IDs called “wbraid”, which get shared with the advertiser’s website even if the click comes from the viewer of a “made for kids” video on YouTube; although Google alleges this “wbraid” is compliant with Apple’s App Tracking Transparency (ATT) framework, the “wbraid” ID was observed as being harvested by third party data brokers such as TikTok, Facebook, Trade Desk, and Microsoft, which could theoretically use it to perform record linkage or data matching. The YouTube iOS app does not appear to ask for parental consent or for ATT consent before injecting the “wbraid” ID on a user’s device pursuant to an ad click on a “made for kids” video.

Summary

In September 2019, the Federal Trade Commission (FTC) and the People of the State of New York (NY) alleged that YouTube “collected kid’s personal information without parental consent”, in violation of the Children’s Online Privacy Protection Act (COPPA). YouTube’s owner (Google) agreed to pay $170 million to settle the allegations. The FTC alleged:

“channel owners told YouTube and Google that their channels’ content was directed to children, and in other instances YouTube’s own content rating system identified content as directed to children. […] Despite this knowledge of channels directed to children on the YouTube platform, YouTube served targeted advertisements on these channels.”

Google’s settlement with the FTC “prohibits Google and YouTube from violating the COPPA Rule, and requires them to provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.”

YouTube’s CEO at the time published a follow-on statement in September 2019, stating that YouTube:

• “will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user”
• “will limit data collection and use on videos made for kids only to what is needed to support the operation of the service”
•  “will also stop serving personalized ads on this content entirely”

However, despite the FTC settlement and YouTube’s written public statements, this research report finds that, as of July 2023, YouTube has been observed to appear to:

• Set long-lasting cookies specifically for the purposes of ad targeting and tracking on the browsers of consumers watching YouTube videos that are clearly labeled as “for kids”
• Serve behaviorally and demographically targeted ads on YouTube videos that are clearly labeled as “for kids”
• Not provide certain technical indicators to programmatic advertisers that the content is targeted towards kids
• The iPhone YouTube mobile app sets and share a unique ad tracking ID every time a viewer on a “for kids” channel clicks on a YouTube ad
• When a viewer clicks on an ad adjacent to a “for kids” video on the iPhone YouTube app, the YouTube app opens the advertiser’s website in a special in-app “webview” browser, where Google both sets various ad targeting and tracker IDs on the viewer’s iPhone, and the YouTube app allows other data brokers and ad personalization vendors to gather and share unique identifiers on the viewer

For the data collection phase of our research, Adalytics enlisted the help of Antonio Torres from publisher quality intelligence firm DeepSee.io. Observational, open-source ad placement data was manually collected from across web and mobile versions of the YouTube app. During the course of this study, several small and Fortune 500 brands were observed as having had their YouTube ads served on channels meant for kids, in some cases in direct contravention of their ad campaign targeting inputs which disavowed “made for kids” content.

Google itself – despite having knowledge that a consumer was viewing “made for kids” YouTube videos - such as “ChuChu TV Nursery Rhymes for Babies” – was observed serving ads on those ‘made for kids’ videos for Google’s own products & services. If a toddler or baby accidentally clicks on Google product ads, Google’s ad product website proceeds to set ad targeting & personalization cookies on the child’s device, and put the child into a “re-targeting” audience pool for future ad personalization in Google’s own product advertising campaigns.

Screenshot of a YouTube TrueView ad for Google's Chrome Browser on ChuChu TV Nursery Rhymes. Chrome Developer Tools at right indicates a third party request originating from ad.doubleclick.net, Google's ad server.

The Google Chrome Enterprise product page, where a privacy notice at the bottom left hand corner of the page says: “Google uses cookies to deliver its services, to personalize ads”. Developer Tools on the right half of the screenshot shows that the website is setting persistent,

Screenshot from The Markup’s Blacklight tool, showing that Google’s Chrome Enterprise website “uses Google Analytics and seems to use its ”remarketing audiences” feature that enables user tracking for targeted advertising across the internet. This feature allows a website to build custom audiences based on how a user interacts with this particular site and then follow those users across the internet and target them with advertising on other sites using Google Ads and Display & Video 360.”

Furthermore, some media buyers reported that, despite using several pre-cautions, it is very difficult to avoid having their ads served on channels for kids, short of using an inclusion list. Employing various demographic targeting and keyword exclusion strategies does not appear to be effective in helping brands avoid ‘made for kids’ channels on YouTube. These results suggest it is possible that YouTube’s present-day ad targeting and data collection practices may not be in line with the terms of its 2019 settlement with the FTC, various international codes on children’s data privacy, and may even be violating Google’s own stated policies on children directed content.

Lastly, based on the data provided by advertisers who purchased audience targeted ads on YouTube, Google appeared to serve demographically and behaviorally targeted ads on YouTube channels for kids.

This last possibility suggests that Google may have either engaged in the ad-related tracking of viewers on kids’ channels, or alternatively, that Google may have misled its advertiser clients by serving targeted ads to users on which Google has no demographic or behavioral audience data.

This could bring into question the robustness of how “targeted” YouTube’s ad software actually is.

__________________________________________________________________________________________

One media buyer reported:

"Despite leveraging Google's contextual category blocks for "babies & toddlers", "children's literature", and "early childhood education" before setting campaigns live, buying teams I've worked on still have to manually block YouTube channels centered around kids' content. These are campaigns that rely on behavioral and demographic targeting to reach adults who are within a client's core audience for generating revenue. Even though those campaigns are targeted to adults and have kids' adjacent content categories blocked, ads inevitably appear on made for kids content in campaign placement reporting in a frustrating game of whackamole."

One senior advertising executive who read an advanced copy of this report commented:

“The presence of advertising on children's content on YouTube, with no effective ability for advertisers to explicitly and easily opt in or out, creates significant and unacceptable reputational and regulatory risks for advertisers. Furthermore, the exfiltration of American children's data across the advertising data ecosystem, particularly to foreign entities such as China via TikTok, is a significant risk.”

Another senior advertising executive provided with an advance copy of this report commented:

“Google has failed advertisers, again. There is no reasonable excuse for ads running on content intended primarily for kids other than to extort advertisers through a toddler-enabled click farm. The observations around Pmax (Preschooler Max) are damning given the hard sell Google is putting on us to trust their so-called AI black box. We're overdue real transparency and Google needs to be made accountable - refunding us for all ads on this content and explaining themselves to the FTC.”

The Chief Strategy Officer of Ebiquity (Ruben Schreurs) – an advertising auditing firm – said the following upon reviewing an advanced copy of this report:

“Advertisers rely on the efficacy of the tools and systems operated by Google to help them prevent inadvertent misuse of data and/or targeting of children in their advertising campaigns on YouTube; in many categories even bound by regulations with severe penalties and reputational risk in case of non-compliance, such as for advertisers of products in the alcoholic beverages or sugary product categories.

The alleged shortcoming of YouTube in this regard as outlined in the Adalytics study, if true, is concerning. We look forward to Google’s response on the matter and hope any technical issues will swiftly be resolved to ensure children are appropriately protected when engaging with content on YouTube.”

Background

Motivation for this research study

Adalytics recently published a research study (alongside a Wall Street Journal) looking at the placement of Google TrueView skippable in-stream ads. During the course of this study, Adalytics used both open source data as well as ad placement reports provided by major brands and media buyers.

During the course of analyzing those ad campaigns, Adalytics noted that a significant proportion of brands’ TrueView ads were being served on YouTube channels that appeared to be targeted towards young children.

For example, for one (adult targeted) ad campaign, a brand had hundreds of dollars worth of ads budget spent on YouTube channels such as:

·       Blippi - Educational Videos for Kids

·       Fizzy Fun House - Educational Videos for Kids

·       The Singing Walrus - English Songs For Kids

·       Kids Channel - Cartoon Videos for Kids

Screenshot of the YouTube channel “Blippi - Educational Videos for Kids”

Several media buyers reported to Adalytics that they preferred to avoid having their ads served to kids or on environments meant for kids. The brands communicated that they were expressly targeting adult demographic audiences, and had taken various steps to try to avoid having their ads placed on YouTube channels for kids. For example, one media buyer reported that they would continuously add new YouTube channels for kids each week to their ad campaign exclusion block list, to avoid having their ads placed on kids channels. However, in following weeks, the media buyer would observe other, new kids channels in their ad campaign placement reports. The media buyer described this situation of iteratively blocking YouTube kids channels as a game of ‘Whac-A-Mole’.

Given that these media buyers appeared to desire to avoid having their ads served on YouTube channels for kids, and yet, their placement reports showed evidence of ads being served on kids channels – Adalytics decided to investigate further how it was possible this was happening.

What is COPPA?

The Children's Online Privacy Protection Act (COPPA) of 1998 is a United States federal law which applies to the online collection of personal information about children under 13 years of age, including children outside the U.S. if the website is U.S.-based. The law places certain restrictions on what data online platforms can collect on young children, and requires platforms to obtain parental consent in some cases before collecting data on children.

The COPPA Rule requires that “child-directed websites and online services provide notice of their information practices and obtain parental consent prior to collecting personal information from children under 13, including the use of persistent identifiers to track a user’s Internet browsing habits for targeted advertising. In addition, third parties, such as advertising networks, are also subject to COPPA where they have actual knowledge they are collecting personal information directly from users of child-directed websites and online services.”

The Rule applies to “personal information”, whose definition includes, among other things, a “persistent identifier that can be used to recognize a user over time and across different Web sites or online services,” such as a “customer number held in a cookie . . . or unique device identifier.”

The Federal Trade Commission (FTC) has the authority to issue regulations and enforce COPPA.

YouTube and COPPA in 2019

In April 2018, a coalition of 23 groups (including the CCFC, CDD, Public Citizen, and Common Sense Media) filed a complaint with the Federal Trade Commission, alleging that YouTube collected information from users under the age of 13 without parental consent, in violation of the Children's Online Privacy Protection Act (COPPA).

The complaint alleged that: “Google has made substantial profits from the collection and use of personal data from children on YouTube. Its illegal collection has been going on for many years and involves tens of millions of U.S. children”.

Furthermore, the complaint claimed that: “Google’s advertising network services collect and use personal information from all YouTube users, including children, to target advertising. […] YouTube is integrated with Google’s complex of advertising technologies and services, including AdWords, DoubleClick, and Google Preferred. Google boasts that AdWords offers ‘a variety of targeting methods,’ including via YouTube, so that advertisers ’can reach [their] ideal audience based on who they are, what they’re interested in, or what content they’re viewing”. The complaint also mentioned that: “Google profits from YouTube’s kid-targeted programming. For example, Ryan ToysReview brought in $11 million in ad revenue in a single year. Because YouTube takes 45% of all YouTube ad revenues, it earned nearly $5 million for just one of its many targeted channels. It is not surprising, therefore, that YouTube actually encourages the creation of children’s content for YouTube.”

YouTube’s Settlement with the Federal Trade Commission in 2019

In September 2019, Google and YouTube agreed to pay $170 million to settle allegations by the FTC and New York Attorney General that “the YouTube video sharing service illegally collected personal information from children without their parents’ consent.”

In their complaint, the FTC and New York Attorney General alleged that “while YouTube claimed to be a general-audience site, some of YouTube’s individual channels—such as those operated by toy companies—are child-directed and therefore must comply with COPPA […] Despite this knowledge of channels directed to children on the YouTube platform, YouTube served targeted advertisements on these channels.”

The complaint alleged that: YouTube “collect information associated with a viewer’s cookie or mobile advertising identifier in order to track the viewer’s online activities and serve advertising that is specifically tailored to the viewer’s inferred interests.”

The FTC Chairman said: YouTube “collected persistent identifiers from viewers of YouTube “channels” that they knew were directed to children, in order to serve behavioral advertising.”

The settlement “prohibits Google and YouTube from violating the COPPA Rule, and requires them to provide notice about their data collection practices and obtain verifiable parental consent before collecting personal information from children.”

The FTC Chairman said: “The ill-gotten gains from the violative conduct here consist of gains from behavioral advertising on channels that contained child-directed content that Google actually knew were directed to children.”

YouTube’s CEO issues a written statement

On September 4th, 2019,  YouTube’s then CEO issued a written statement titled: “An update on kids and data protection on YouTube”.

The statement included a section titled: “New data practices for children’s content on YouTube”.

This section stated that YouTube:

· “will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user”

· “will limit data collection and use on videos made for kids only to what is needed to support the operation of the service”

· “will also stop serving personalized ads on this content entirely”

Source: YouTube Official Blog

YouTube channels that are “made for kids”

YouTube has internal knowledge of which channels are made for kids.

YouTube’s CEO wrote in 2019, “In order to identify content made for kids, creators will be required to tell us when their content falls in this category, and we’ll also use machine learning to find videos that clearly target young audiences, for example those that have an emphasis on kids characters, themes, toys, or games.”

Source: YouTube Help online documentation

YouTube’s documentation states that: “We use machine learning to help us identify videos that are clearly directed to young audiences. We trust you to set your audience accurately, but we may override your audience setting choice in cases of error or abuse.”

Furthermore, the YouTube Data API returns data from Google’s servers, showing which channels have been either classified as “madeForKids” by YouTube, or where the channel owner themselves has set “selfDeclaredMadeForKids”.

Source: YouTube Data API reference

YouTube’s documentation states that: ”What happens when your content is set as made for kids: We limit data collection and use on made for kids content to comply with the law. This means we need to restrict or disable certain features like comments, notifications, and others. Most importantly, we don’t serve personalized ads on kids content, as required by the Children’s Online Privacy Protection Act (COPPA)”.

Source: YouTube Help online documentation

YouTube does not easily give ad buyers the ability avoid having their ads served on channels that are “made for kids”

As mentioned above, YouTube has internal knowledge of which channels are made for kids.

Yet several media buyers told Adalytics that they struggle to avoid having their ad campaigns served on YouTube channels for kids. Several media buyers told Adalytics that there is currently no one click button or setting that would allow them to avoid having their ads served on all channels that YouTube itself has labeled as “madeForKids”. Rather, marketers resort to other methods, like keyword exclusions or channel blocklists in an attempt to avoid having their ads served on “madeForKids” channels. However, these solutions are imperfect, laborious, and never 100% effective.

Google’s policies on personalized advertising reference legal restrictions on users under 13

Google’s policies specifically reference: “Legal restrictions: Ads must comply with the law.”

Google’s ad policies on personalized advertising specifically include a prohibition against “Collecting personal information from children under 13 or the applicable age in their country, or targeting interest content to children under the age of 13 the applicable age in their country.”

Source: Google ad policies on personalized advertising – Legal restrictions

Google’s advertising policies for ads served on content that is “made for kids”

Google's Advertising Policies has a section titled: "Ads & made for kids content".

These policies state that:

“Advertisers may not run personalized ads on content set as made for kids. In addition, advertising that is intended for children or on content set as made for kids must not be deceptive, unfair or inappropriate for its intended audience, must not make use of any third party trackers or otherwise attempt to collect personal information without first obtaining parental consent, and must otherwise comply with all applicable laws and regulations.”

Source: Google’s Advertising Policies

Furthermore, Google has several "Restricted Ad Categories", which are "categories are restricted for advertising on made for kids content."

The Restricted Ad Categories include: "Age Sensitive Media Content: Media that is sensitive to show to users under the age of 13. This includes movies and TV shows with ratings greater than G and PG."

Source: Google’s Advertising Policies

Lastly, Google's Advertising Policies have a prohibition: "Paid Ads cannot include features or call-to-actions that do not work or where the desired action can’t be completed."

Source: Google’s Advertising Policies

How does Google perform ad targeting?

Google’s ad platforms, including YouTube, can target ads in various ways.

These include:

·      Contextual targeting

·      Demographic targeting

·      Audience targeting

Contextual targeting does not necessarily use or require data about an individual user. “The process that matches ads to relevant sites in the Display Network using your keywords or topics, among other factors. Here's how it works: Google's system analyzes the content of each webpage to determine its central theme, which is then matched to your ad using your keywords or topic selections”. “With demographic targeting in Google Ads, you can reach a specific set of potential customers who are likely to be within a particular age range, gender, parental status, or household income. For instance, if you run a fitness studio exclusively for women, demographic targeting could help you avoid showing your ads to men.”

For audience targeting, also known as personalized advertising or interest-based advertising, ads are served to “people based on who they are, their interests and habits, what they’re actively researching, or how they've interacted with your business.”

Google provides various types of audience targeting, including:

·  Affinity segments: Reach users based on what they're passionate about and their habits and interests.

·  Custom segments: Custom segments help you reach your ideal audience by entering relevant keywords, URLS and apps.

·   Detailed demographics: Reach users based on long-term life facts.

·   Life events: Reach users when they're in the midst of important life milestones.

·   In-market: Reach users based on their recent purchase intent.

·   Your data segments: Reach users that have interacted with your business.

1. Website and app visitors: Reach people who have visited either your website or your apps.
2. Customer Match: Reach your existing customers based on your CRM data.
3. Similar segments: Reach new users with simila interests to your website visitors or existing customers.

Google’s documentation provides several “examples of effective demographic targeting”, such as:

Source: Google Ads documentation on audience targeting

According to Google’s documentation on “How audience targeting works”:

“Audiences are made up of segments, or groups of people with specific interests, intents, and demographic information, as estimated by Google. When adding an audience to a campaign or ad group, you can select from a wide range of segments. For example, these segments could include fans of sport and travel, people shopping for cars, or specific people that have visited your website or app. Google Ads will show ads to people who are likely in the selected categories. Users are allocated into audience categories for targeting on third-party websites and apps based primarily on their activity on third-party websites and apps. Users are allocated into audience categories for targeting on Google’s own products based primarily on their activity on these products.”

Source: Google Ads documentation on audience targeting

How does Google infer interest and demographic labels about prospective audiences?

As mentioned earlier, Google targets audience campaigns based on individual users’ page visit history, Google searches, and other data. “Users are allocated into audience categories for targeting on third-party websites and apps based primarily on their activity on third-party websites and apps. Users are allocated into audience categories for targeting on Google’s own products based primarily on their activity on these products.”

Google determines demographic information based on information from signed in users, as well as estimating “people's demographic information based on their activity from Google properties or the Display Network. For example, when people browse YouTube or sites on the Display Network, Google may store an identifier in their web browser, using a “cookie.” That identifier may be associated with certain demographic categories, based on sites that were visited.”

Source: Google Ads documentation on demographic targeting

Google’s online documentation on “Ad targeting - How Google infers interest and demographic categories”, states: “As users browse Google sites like YouTube and our partner websites, Google stores an advertising cookie in a user's browser to understand the types of content that the user is viewing. This information is used to show ads that might appeal to your users based on their inferred interests and demographics. For example, if a user browses many sports-related websites displaying AdSense ads or watches sports-related videos on YouTube, Google may associate a sports interest with their cookie or Google Account and show the user more sports related ads. Similarly, if the sites that a user visits have a majority of female visitors, we may associate the user’s cookie or Google Account with the "female" demographic category. We may also use demographics from Google Accounts. In some cases, Google may charge a service fee for personalized ads.” 

Source: Google Adsense Help – Ad targeting – How Google infers interest and demographic categories

Google “Unknown” audiences and users

Google’s documentation also mentions an “Unknown” category. “Google Ads can't know or infer the demographics of all people. “Unknown” refers to people whose age, gender, parental status, or household income we haven’t identified.”

Source: Google online documentation on demographic ad targeting

Ads and Google Accounts managed with Family Link for children under 13

Google has created a Family Link app, which allows parents to create or manage Google accounts for young children in their household. Google’s documentation states that “Parents can create a Google Account for their children under 13 using the Family Link app. Ads may be displayed to these users. Advertisers can't target ads to show only to children under 13.” While ads cannot be targeted towards those young kids, Google’s documentation states that media buyers can “exclude your ads from showing to these users” (presumably young children whose accounts were created or managed under the Family Link app).

Source: Google’s online documentation on demographic ad targeting

Furthermore, Google’s online documentation on “Ads and Google Accounts managed with Family Link for children under 13” states that: “Advertisers can't target ads to show only to children under 13 or the applicable age in their country, or serve personalized advertising to children under 13 or the applicable age in their country.  However, as an advertiser, you can request to have your ads excluded from showing to signed-in users under 13”.

Source: Google’s online documentation on Ads and Google Accounts managed with Family Link

Lastly, Google’s online documentation on “Ads & Google Accounts managed with Family Link”, “Google won't serve personalized ads to children under 13 (or the applicable age in your country). Personalized ads are not based on information from your child’s account or internet activity. Instead, ads for children under 13 (or the applicable age in your country) might be based on information like:

·      The content of the site or app your child is looking at

·      Their current search

·      Their general location (such as city or state)”

Source: Google’s online documentation on “Ads & Google Accounts managed with Family Link”

Furthermore, this documentation states that: “Advertisers can't target ads to Google Accounts for children under 13 (or the applicable age in your country). Advertisers also can't serve personalized ads to these accounts, using Google's advertising services. Google doesn’t share personal information about children under 13 (or the applicable age in your country) with advertisers, even if the child clicks on an ad.”

Source: Google’s online documentation on “Ads & Google Accounts managed with Family Link”

Based on the documentation cited above, it appears that (in theory), even if a consumer is a child whose parents have created Family Link Google account on their behalf, demographically or behaviorally targeted ads will not be served to that child. Advertisers can exclude having their ads served from young children for whom Google knows the given user is a child with a Family Links account.

Non-personalized ads

If a consumer is shown a video ad on a YouTube channel for kids, they can click on a round question mark button, which shows why the user is being shown that ad. In all observed cases in this research, if a consumer clicks that button on a YouTube channel for kids, the info modal will say “This ad isn’t personalized, Google doesn’t allow personal info (like gender and past searches) to be used for ads shown to people who might be under 18.”

“Personalized ads are turned off for this account or content, so this ad is not customized based on your data. This ad is based on other factors (for example, the time of day or your general location).”

Screenshot of a “Why this ad?” info modal shown if a user clicks on an ad on YouTube channel for kids

What is “record linkage” or “data linkage”?

Certain parts of this study discuss observations of how various ad tech platforms can connect different datasets that were generated by tracking the activity of viewers of “made for kids” content. As such, it is important to explain the concept of “record linkage”.

According to Wikipedia: “Record linkage (also known as data matching, data linkage, entity resolution, and many other terms) is the task of finding records in a data set that refer to the same entity across different data sources (e.g., data files, books, websites, and databases). Record linkage is necessary when joining different data sets based on entities that may or may not share a common identifier (e.g., database key, URI, National identification number), which may be due to differences in record shape, storage location, or curator style or preference. A data set that has undergone RL-oriented reconciliation may be referred to as being cross-linked.”

If two ad tech companies track the activities of the viewer of a “made for kids” video, the companies can engage in “record linkage” if the two companies have access to a common identifier that “links” the same user across the two different companies’ datasets.

What are Google “Performance Max” campaigns?

According to Google’s documentation, “Performance Max is a new goal-based campaign type that allows performance advertisers to access all of their Google Ads inventory from a single campaign. It's designed to complement your keyword-based Search campaigns to help you find more converting customers across all of Google's channels like YouTube, Display, Search, Discover, Gmail, and Maps.”.

Performance Max “combines Google's AI technologies” and “audiences” and “audience signals”.

“Performance Max uses machine learning models to optimize bids and placements to drive conversions or conversion value for your goals, but you can provide important inputs like audience signals.”

Source: Google’s online documentation on Performance Max campaigns

Source: Google’s online documentation on Performance Max campaigns

Source: Google’s online documentation on Performance Max campaigns

What is “YouTube Select” or “Google Preferred”?

YouTube Select (partially formerly referred to as “Google Preferred”) is a premium YouTube ad product, which is generally more expensive than other YouTube ad products. It can be purchased by brands and media agencies after speaking with a Google account sales representative.

According to Wikipedia, “Google Preferred is a YouTube program that allows advertisers to pay to place their ads on high-performing videos on the site. The program divides YouTube's most popular channels among 18- to 34-year-olds, comprising the most popular 5% of content on the site, into twelve categories. Its purpose is to signal advertisers that they can trust a given channel in the program to produce high-quality content.”

YouTube’s online documentation states that “with YouTube Select, you can be confident that your ad buys are brand-safe.” YouTube Select has a “99% success rate on brand safety in third-party beta tests with IAS and DoubleVerify”.

Research methodology

This section of the report describes the various research methodologies use to assay whether:

1. As of June 2023, is YouTube collecting advertising related data on YouTube channels geared towards young kids?
2. Are demographically and/or behaviorally targeted ads being served on YouTube channels for kids?
3. How do marketers and media buyers feel about having their ads served on YouTube channels for kids?

Identification of YouTube channels for kids

YouTube provides a public API which allows one to check whether a particular YouTube channel is marked as “madeForKids”.

Source: YouTube Data API reference

Data from various media buyers’ video ad campaign placement reports was used to generate a list of 979,409 YouTube channels to check. Each one of these 979,409 YouTube channels had had at least one video ad served on the given channel at some point in time.

Each one of these 979,409 YouTube channels from ad placement reports was then checked using the YouTube Data API to see if a given channel was classified as “status.madeForKids = true” by YouTube.

The YouTube Data API showed that there were 8,269 unique YouTube channels which had the “madeForKids” parameter set to “true”. These 8,269 “madeForKids” channels had:

• 3.5 million unique uploaded videos
• 4.09 trillion total views
• 7.2 billion (non-unique) total subscribers

The channel owners were registered in 126 countries. 3,841 of those channels were registered in countries outside of the United States. For example, 129 of the “madeForKids” channels were registered in Russia, 9 were registered in China, and 3 were registered in Afghanistan.

Analysis of website cookie behavior on YouTube.com using Chrome Developer Tools

After identifying a list of confirmed “madeForKids” YouTube channels, the next step was to visit some of those channels manually on a desktop computer, and to use the Chrome browser’s Developer Tools to assess whether there were any advertising related cookies or unique identifiers set on the user’s browser while visiting “madeForKids” channels.

A sample of ten different “madeForKids” channels which each have at least 1 billion unique video views was randomly selected.

Selection of ten YouTube channels that were labeled as “madeForKids” by the YouTube Data API

For each of these 10 unique “madeForKids” YouTube channels that have over 1 billion views, a brand new, dedicated Chrome browser profile was created. Each brand new Chrome profile had zero previous browsing activity, cookies, localStorage, sessionStorage, or browsing history.

After generating a brand new chrome profile (with a “clean slate” and no history), the browser was directly navigated to one of the 10 “madeForKids” YouTube channels. The chrome developer tools were used to a browser trace known as a HTTP Archive (HAR) file, which shows all data sent into and out of the browser through the Internet. The ‘network’ tab was used to monitor the transmission of cookies from the user’s browser to various external servers, as well as to monitor if the external servers were sending any “Set-Cookie” HTTP response headers. Lastly, the browser developer tool’s “Application” tab was used to monitor various cookies set on the user’s browser.

Identifying which cookies are strictly for “functional” purposes and which cookies are for “advertising” purposes

Many websites require cookies for basic functionality, such as keeping track of a user’s language settings or what types of media files a user’s browser can functionally render. Furthermore, some websites use cookies for “security” purposes, such as to track whether a given computer has made an abnormally high number of data requests in a short period of time.

Lastly, a subset of websites uses certain cookies to assign unique identifiers to a given device which can be used to track a consumer’s browsing behavior and served them audience targeted advertisements.

Source: Google Business Data Responsibility

Google’s public online documentation states:

“Google uses cookies for advertising, including serving and rendering ads, personalizing ads (depending on your settings at myadcenter.google.com and adssettings.google.com/partnerads), limiting the number of times an ad is shown to a user, muting ads you have chosen to stop seeing, and measuring the effectiveness of ads.”

“The ‘NID’ cookie is used to show Google ads in Google services for signed-out users, while the ‘ANID’ and ‘IDE’ cookies are used to show Google ads on non-Google sites […] The ‘IDE’ cookie lasts for 13 months in the European Economic Area (EEA), Switzerland, and the United Kingdom (UK), and 24 months everywhere else. Depending on your ad settings, other Google services like YouTube may also use these and other cookies and technologies, like the ‘VISITOR_INFO1_LIVE’ cookie, for advertising” (emphasis added). Google’s Business Data Responsibility page states there are four purposes for cookies that Googles uses:

1.    Functionality

2.   Security

3.   Analytics

4.   Advertising

The Business Data Responsibility page allows one to download a spreadsheet which shows the name of various cookies, for what purposes they are used, and how long those cookies are stored. A sample of “Advertising” related cookies is shown in the data table below.

Source: Google Business Data Responsibility

Analysis of cookie behavior on the iPhone iOS YouTube mobile app

Analysis of client-side network traffic did not reveal the presence of persistent cookies being set on the YouTube iOS app directly within the app itself (though this excludes the mobile in-app webview).

Detailed analysis of advertiser placement reports from YouTube ad campaigns

Ad campaign placement, audience, and demographic reports

Adalytics recently published a research study (alongside with the Wall Street Journal) looking at the placement of Google TrueView skippable in-stream ads. During this study, Adalytics was given access to ad placement reports provided by major brands and media buyers. These reports show on what website, mobile apps, and YouTube channels various TrueView video ad campaigns were served on.

Adalytics was also provided with access to detailed “audience reporting” which includes information about various audience segments and segment types for each campaign.

Thirdly, Adalytics received access to “demographic reporting”, which include “insights about which demographic segments your ads are reaching”. These reports include information on an ad campaign’s “demographics”, including a categorization of ad delivery based on the exposed audiences’ age, gender, parental status, or household income.

Screenshot of an example of how demographic reporting works from Google’s online documentation

To summarize, Adalytics was provided with three sets of reports:

1. “Placement reports”, which showed on what YouTube channels an ad campaign was served on (including how much money was spent on ads on each channel
2. “Audience reports”, which showed how much ad budget was spent on each audience segment
3. “Demographic reports”, which include insights on the gender, age, and household income demographic segments each ad campaign reached

As per Google’s documentation, Google estimates people’s demographic information based on their activity on the open web and various Google owned properties. Google stories unique cookie identifiers on consumer’s browsers, which may be associated with certain demographic categories based on the sites or channels a given user visited. Thus, it is plausible that the audience and demographic reports given to advertisers are informed based on cookies used to track consumer behavior on various environments.

Analysis of spend across various placements, audiences, and demographics

One of the challenges analysts face with reviewing data provided by Google Ads reporting software tools, is that Google places restrictions on what data fields and dimensions can be combined into a single unified view of the data. For example, it is not possible to pull demographic, audience, and placement data for a YouTube ad campaign into one unified report.

Due to this software limitation, this study relied on detailed comparison of placement, demographic, and audience data reports for various YouTube ad campaigns.

For example, let us say a brand ran an ad campaign targeting various demographic and audience segments for a total cost of $10,000. Analyzing the placement report and cross referencing it with meta-data provided by the YouTube Data API shows that of that $10,000 dollars spent, $1,250 was served on YouTube channels which have been marked as “madeForKids”.

If the entire ad campaign was conducted using purely contextual (rather than demographic or behavioral targeting), then there would likely be little to no concerns about the $1,250 spent on YouTube channels for kids. Secondly, if the ad campaign was configured to allow ads to be served to “Unknown”  demographic audiences, then there would also be a reasonable justification for why ads had been served on YouTube channels for kids.

Screenshot of Google’s online documentation about demographic targeting, highlighting the “Unknown” demographic segments.

In this hypothetical $10,000 campaign, let us assume that the demographic report shows that $500 was spent on ads served to viewers whose age, gender, household income, and parental status are all marked as “Unknown”.

With regards to behavioral or interests based ad targeting, Google’s “audience reports” occasionally include references to some amount of ads being served to “People not in audience segments”. For example, in the screenshot below, one can see that for a given advertiser, a certain proportion of their ad campaign budget was spent on “People not in audiences”, as opposed to known, defined audience segments like people who work in “Government & Public Sector Jobs” or “New Pet” owners.

When comparing YouTube ad campaign placement reports that show $1,250 worth of ads serving on YouTube channels for kids, it is important to “subtract” or exclude any ad budget spend which was served to “People not in audiences”. These are ad impressions for which, given the absence of any behavioral audience data, there could be a reasonable justification for why those ads had been served on YouTube channels for kids. If YouTube is indeed not tracking users on channels for kids, and as YouTube’s CEO wrote in 2019, YouTube “will also stop serving personalized ads on this content entirely”, then ad delivery to “People not in audiences” is logically consistent.

In the hypothetical $10,000 ad campaign, let us assume $475 was reported as spent on “People not in audiences”.

Thus, to summarize, the sequence of analysis for advertisers’ YouTube campaign report is as follows:

1.  Get a detailed YouTube ad campaign placement report, with a breakdown of how much spend was allocated to each individual channel (in the hypothetical example above, a total of $10,000 across all channels)

2.  Cross reference the campaign placement reports with data from the YouTube Data API, to identify which channels in the placement report are marked as “madeForKids”

3. Identify the total amount of ad budget which was spent on YouTube channels that are labeled as “madeForKids” (in the hypothetical example above - $1,250)

4. Use the detailed demographic reports for each ad campaign, to identify how much ad budget was spent on YouTube viewers whose age, gender, household income, and parental status are all marked as “Unknown” ($500 in the hypothetical example)

5. Use the detailed audience reports for each campaign, to identify how much ad budget was spent on YouTube viewers who audience segment is “People not in audiences” ($475 in the hypothetical example above).

6. To be as methodologically conservative as possible, subtract the total cost of “Unknown” demographic spend ($500) and “People not in audiences” ($475) from the total amount of ad spend on YouTube channels for kids ($1,250).

a. $1,250 - $500 - $475 = $275

7.  This final total ($275) is the most conservative, minimum amount of YouTube campaign ad budget (out of the original $10,000), which was served on YouTube channels for kids, where YouTube (allegedly) has demographic and behavioral data on the viewers.

As mentioned before, YouTube’s CEO wrote publicly in 2019 that YouTube “we will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user” and “will also stop serving personalized ads on [YouTube channels for kids] content entirely”. YouTube’s public online documentation states: “we don’t serve personalized ads on kids content, as required by the Children’s Online Privacy Protection Act (COPPA)”.

Source: YouTube Official Blog

If YouTube is treating data from viewers on channels for kids as *always* coming from a child, and if YouTube is not serving personalized ads on channels for kids, it is unclear how it is possible for $275 to have been served – with known demographic and behavioral audience segments – on channels for kids.

Presumably, in this hypothetical, if YouTube is treating all viewers on channels for kids as being kids themselves, and if YouTube is not serving personalized ads on channels for kids, there should be zero ad budget out of $10,000 spent on channels for kids with known demographic and behavioral ad targeting.

Then, this research methodology strove to ascertain, if for any demographically or behaviorally targeted ad campaign, was there evidence of more than $0.00 of ad budget spent on YouTube channels for kids, where the ad targeting leveraged audience or demographic data segments.

One might note that this estimation methodology is the most conservative estimation possible. It assumes that there is zero overlap between users with “unknown” demographics and “people not in audiences”. Furthermore, it assumes that every single ad impression for “people not in audiences” or with “unknown” unknown demographics must have exclusively served on “made for kids channels”.

In reality, it is highly likely that a large amount of “unknown” demographic or “people not in audiences” was spent on other channels besides the “made for kids” channels. Furthermore, it is likely that there is some degree of overlap between the “unknown” demographic ad spend and the “people not in audiences” ad spend.

However, the precise degree of overlap is not ascertainable by anyone besides Google’s own employees, as Google Ads reporting software does not permit a unified view of demographic, audience, and placement data. To derive a truly precise quantity of how much ad spend was served on “made for kids” channels using demographic or audience targeting data, one would need access to Google’s own internal databases. This research report chose to calculate what is likely a conservative under-estimate.

Forensics analysis of ad server behavior on YouTube channels for kids

Google has a software product called Campaign Manager 360, which is Google’s advertiser ad server. Campaign Manager 360 (CM360) can be used for trafficking, reporting, and verification of ad campaigns.

CM360 can be used by advertisers to obtain “enhanced metrics” and “easily track additional data” from ad campaigns that run on YouTube and elsewhere. CM360 integrates with YouTube and allows the automated generation of “click tracking URLs”. “This ensures that conversions driven by clicks from YouTube ads are accurately counted.”

Source: Google Campaign Manager 360 Help

Google’s public online documentation for Campaign manager 360 tags explains various specific codes and parameters that are automatically inserted into the tag when an ad is served, and included various useful meta-data about the ad placement.

These additional CM360 parameters include:

• tag_for_child_directed_treatment=: A key value pair for mobile applications to pass information about if a request may come from a user under the age of 13, under COPPA compliance.
• /: This is the value in the tag_for_child_directed_treatment= key-value pair. A value of 1 indicates that this particular request may come from a user under the age of 13, under COPPA compliance.
• tfua=: The key of the tfua= key-value pair to pass information about if a request may come from a user under the age of 16 (may differ by country), under compliance with the EU’s General Data Protection Regulation (GDPR).
• /: This is the value in the tag_for_underage_of_consent= key-value pair. A value of 1 indicates that this particular request may come from a user under the age of 16 (may differ by country), under compliance with the EU’s General Data Protection Regulation (GDPR).

Source: Google Campaign Manager 360 Help

Another section of Google’s public online documentation, on tracking ad conversions, explains various values that get passed to Campaign Manager 360, including the “tag_for_child_directed_treatment”.

Source: Campaign Manager 360 Help

In the example below, an ad for Lego toys was served on a YouTube video titled: “Dinosaurs Showdown! T-Rex Ranch Dinosaur Videos”, on the YouTube channel “T-Rex Ranch - Dinosaurs For Kids”. This channel has been marked as “madeForKids” in the YouTube Data API. The particular Lego ad was using a Campaign Manager 360 click tracker. In this instance, the value passed to the “tag_for_child_directed_treatment” field was correctly set to “1”, indicating that the particular ad may have been served to a user under the age of 13, under COPPA compliance.

Annotated screenshot of Chrome Developer Tools Network tab on a YouTube video for kids. An ad for Lego toys was served on this channel, and the Campaign Manager 360 click tracker was correctly configured to say that the “tag_for_child_directed_treatment=1”, meaning the ad may have been served to a user under the age of 13.

When manually checking 10 YouTube video channels to see if any advertising related cookies were on a user’s browser, this study also checked if any ads were served with CM360 click trackers, where the “tag_for_child_directed_treatment” parameter was not properly set to “1”.

Surveying media buyers and advertisers about their expectations with regards to YouTube channels for kids

Several dozen advertisers and media buyers were asked several survey questions to gauge their expectations with regards to “made for kids” YouTube channels.

Results

8,269 channels that YouTube labels as “for kids”

Data from various media buyers’ video ad campaign placement reports was used to generate a list of 979,409 YouTube channels to check. Each one of these 979,409 YouTube channels had had at least one video ad served on the given channel at some point in time.

Each one of these 979,409 YouTube channels from ad placement reports was then checked using the YouTube Data API to see if a given channel was classified as “status.madeForKids = true” by YouTube.

The YouTube Data API showed that there were 8,269 unique YouTube channels which had the “madeForKids” parameter set to “true”.

These 8,269 “madeForKids” channels had:

·  3.5 million unique uploaded videos

·  4.09 trillion total views

·  7.2 billion (non-unique) total subscribers

The channel owners were registered in 126 countries. 3,841 of those channels were registered in countries outside of the United States. For example, 129 of the “madeForKids” channels were registered in Russia, 9 were registered in China, and 3 were registered in Afghanistan.

For example, one of the identified “madeForKids” channels was “Gracie’s Corner”, whose channel description says: “Gracie's Corner is a YouTube channel for kids.” This specific YouTube channel had over 50,000 impressions delivered from various adult audience targeted brands that shared placement report data with Adalytics.

Gracie’s Corner, a YouTube channel that is marked as “madeForKids”

It is worth mentioning that some YouTube channels have individual videos that are marked as “made for kids”, but the channel itself is not marked as “madeForKids”. Most media buyers do not get access to individual video ad placements; only channel level ad placement reports. Thus, due to this limitation, it’s not possible to precisely ascertain how much ad spend may have gone to videos that are “madeForKids” on channels which are otherwise labeled as not being “madeForKids.”

For example, the video channel titled: “4evertheDisneySongs” has four publicly accessible videos at the time of writing of this report.

1. Heigh Ho - Snow White and the Seven Dwarfs

a. video marked as “for kids”

2. Whistle While You Work - Snow White and the Seven Dwarfs

a. video marked as “for kids”

3. With a Smile and a Song - Snow White and the Seven Dwarfs

a. video not marked as for kids

4. Wishing Well/One Song - Snow White and the Seven Dwarfs

a. video not marked as for kids

The entire channel “4evertheDisneySongs” is labeled as “madeForKids=False”, meaning YouTube’s systems do not consider the given channel to be made for kids, even though two out of the four videos on the channel are marked as made for kids.

YouTube channel called: “4evertheDisneySongs”

Because detailed ad campaign placement reports generally do not allow media buyers to view which individual videos their ads were served on, it is not possible for most advertisers to know – if they had ads served on “4evertheDisneySongs” – whether their ads were served on the two videos that YouTube considers to be “madeForKids” or on the two videos were the “madeForKids” classification is absent.

Channels that appear to be “for kids”, but YouTube’s own systems are not labeling as “for kids”

One observation that merits discussion iswhether YouTube’s processes for detecting and labeling content as “madeForKids” are completely accurate. As mentioned in YouTube’s online documentation, the company relies on a mixture of content creators’ self-declaration and YouTube’s own machine learning systems to detect and classify content as being “madeForKids”.

However, during the course of this study, it was noted that there were several YouTube channels that explicitly contained “kids” related language but were not labeled as “madeForKids” in the YouTube Data API results.

For example, each of the following three YouTube channels contains the word “for kids” in the YouTube channel title. A visual inspect of the channels contents’ seems to corroborate the notion that the channels do indeed contain children directed content. Yet the YouTube Data API (as of June, 2023) reports that YouTube has labeled each of these four channels as “madeForKids=False”.

• ·“Car Videos for kids” (“madeForKids=False”)
• “Musical Playtime for Kids | Nursery Rhymes” (“madeForKids=False”)
• “DRAWING FOR KIDS” (“madeForKids=False”)

YouTube channel “Musical Playtime for Kids | Nursery Rhymes”

YouTube channel “Car Videos for kids”

Furthermore, there appeared to be channels where every individual publicly accessible video was labeled as “madeForKids”, but the channel itself was still labeled as not being “madeForKids” in aggregate.

For example, as of June 2023, the YouTube channel titled “Nick Jr. 2.o” has two publicly accessible videos. Each of these videos is individually marked as “madeForKids”. However, the “Nick Jr. 2.o” channel itself labeled as “madeForKids=False”, meaning that YouTube’s systems do not consider the channel in its entirety to be “madeForKids”.  

YouTube channel “Nick Jr. 2.o”

As another example, as of June 2023, the YouTube channel titled “King of Godzilla” has three publicly listed videos. Each of these three videos is individually labeled as “madeForKids”. However, the “King of Godzilla” channel itself is labeled as “madeForKids=False”, meaning that YouTube’s systems do not consider the channel in its entirety to be “madeForKids”. 

YouTube channel “King of Godzilla”

Pursuant to the 2019 FTC Settlement with YouTube, the FTC Chairman said:

“we plan to conduct a sweep of YouTube channels following implementation of this order’s provisions to determine whether there are any further violations of COPPA.” It is unclear whether the FTC executed such a follow-on sweep, or what were the results of this sweep. In particular, it is unclear whether the FTC assessed the statistical performance (sensitivity, specificity, Receiver operating characteristic) of YouTube’s “madeForKids” classification systems.

The majority of this research report focused on channels that YouTube’s own Data API labeled as “madeForKids”, which may result in an under estimation of how many personalized ads were served on children direct YouTube content.

Demographically and behaviorally targeted ad campaigns are being served on YouTube channels for kids

Adalytics received detailed ad campaign reports from different brands and agencies which had conducted YouTube ad campaigns. These media buyers represented different industries and business verticals, and conducted different types of ad campaigns with different audience targeting goals.

The analysis focused on ad campaigns that utilized demographic or behavioral interest audience targeting, rather than ad campaigns that focused on contextual or keyword-based ad targeting.

As described in the Background section, Google enables demographic and behavioral user targeting by collecting and analyzing data on individual users. This data is used to either record or infer that a given individual has a specific age, gender, household income, parental status, or has interests in various activities like “golf”, “tennis”, or “travel”.

While the collection of adults’ data to personalize advertising is a common business practice in the advertising industry, the COPPA law generally prohibits gathering data on young children without parental consent.

As mentioned in the Background section, YouTube’s CEO wrote that YouTube will not serve personalized ads on “made for kids” content, and that YouTube will treat data from anyone watching children’s content as “coming from a child”.

This analysis found that various demographically and behaviorally targeted ad campaigns continued to have their ads served on “made for kids” YouTube videos, which may possibly be in contravention of COPPA.

In each of the sets of ad campaigns analyzed above, the amount of money spent in the Placement reports on “made for kids” channels exceeded the amount of money allocated to “People not in audiences” or users whose demographics were “Unknown”. 

Thus, by virtue of inductive reasoning, one can reasonably assert that YouTube has demographic and audience labels on the viewers of “Made for Kids” channels, and is using those labels to personalize ads on those “made for kids” channels.

Listed below are a few observed examples of ad campaigns that used personalized user targeting, and had their ads served on “made for kids” YouTube channels. In each case, the advertisers confirmed they were not intending to target children. Some of the advertisers reported that they considered ads served to children to be a form of “ad waste” that reduce the performance of their ad campaigns.

1. Several remarketing ad campaigns had their ads served on over 180 different “made for kids” YouTube channels. Remarketing is when one tries to “re-engage with potential customers by adding your website and app visitors to remarketing lists".

2. One ad campaign that was targeting users over the age of 18+, who had an “in-market interest” for “consumer electronics”, had 100% of their ads served on various “made for kids” channels.

3. One ad campaign that was targeting users who were looking to get a pet (known audience behaviors), had their ads served on over 600 “made for kids” channels

4. Another ad campaign which was targeting consumers who were interested in various beauty and cosmetics products was served on close to 200 “made for kids” channels

In the table below, one can see some of the audience interest segments that were utilized in various YouTube ad campaigns which had ads served on “made for kids” channels:

These observations suggest that YouTube may appear to be:

1. Collecting data and creating demographic and behavioral audience segments on users who viewed “Made for Kids” channels
2. Serving personalized ads on “Made for Kids” channels

These two possibilities beg the question of whether YouTube’s data collection practices and ad targeting on “made for kids” content are compliant with COPPA.

Ad campaigns appear to receive significant clicks originating from “made for kids” videos

Adalytics analyzed a dataset of over 1,000 YouTube ad campaigns from several years. These campaigns had different demographic and behavioral targeting criteria and parameters, objectives, geographies, and costs. The ad campaigns generated over a hundred thousand clicks.

In this sample of YouTube ad campaigns (which must be regarded as a non-representative sample until further statistical calibrations can be performed), 18% of ad clickthrough’s to the advertisers’ website appear to originate from YouTube channels that were labeled as “made for kids”.

YouTube sets ad targeting and tracking cookies on channels for kids

After identifying several thousand channels which are labeled as “madeForKids=True” according to YouTube’s own Data API, ten channels were selected for downstream manual analysis. As described in the methodology section, the brand new Chrome browser browser profiles were created with no prior browsing history, cookies, or session data. Each of these ten browser profiles was used to visit a specific “madeForKids” YouTube channel, and the HTTP network traffic going into and out of the browser was recorded using Chrome browser’s Developer Tools. The purpose of this exercise was to assess whether there were any advertising related cookies or unique identifiers set on the user’s browser while visiting “madeForKids” channels.

It is important to note that in each of these ten manual experiments, the tester directly navigated to a given YouTube channel for kids by inputting the channel URL directly into the browser bar and clicking enter. The YouTube homepage and search pages were effectively bypassed through this direct-to-target-channel browser navigation. Furthemore, the user was not logged into their Google account and all cookies were (initially) cleared or empty.

The table below shows the ten “madeForKids=True” YouTube channels that were selected to assay whether any advertising related cookies were set while watching children directed content.

Selection of ten YouTube channels that were labeled as “madeForKids” by the YouTube Data API

Upon creating a new Chrome browser profile and directly navigating to the “✿ Kids Diana Show” YouTube channel and selecting a video to watch, several ads were shown to the viewer. During that page view session, a number of various cookies were set on the viewer’s browser, include several set via the HTTP “Set-Cookie” response header.

This page view session was recorded and saved to a .har file. The .har file was then opened in a Jupyter notebook using the Python programming language, and analyzed. Every cookie that was set was cross referenced against a public list of “Advertising” functionality cookies that Google publishes on its Business Data Responsibility page. Cookies that are listed as being exclusively used for “Functionality”, “Security, or “Analytics” were excluded from further analysis.

This analysis revealed that several advertising related cookies were being transmitted and stored for long periods of time on the consumer’s browser while they were watching videos on the “✿ Kids Diana Show” YouTube channel. In the Loom video screen recording below, one can observe a brand new Chrome profile being generated, and it being navigated directly to the “✿ Kids Diana Show” (bypassing the YouTube home page or search pages). When the viewer starts watching a particular video on the channel, the user is shown a TrueView skippable in-stream ad for the automobile brand Hyundai. Several cookies are set on the consumer’s browser via HTTP response headers, including the advertising related “IDE” cookie.

Video screen recording of a brand new Chrome profile, using Chrome Developer Tools on the “madeForKids” YouTube channel “✿ Kids Diana Show”

Screenshot of Chrome Developer Tools showing the IDE advertising cookie set on the consumer’s browser

By analyzing the set of cookies set on the user’s browser, one can observe the at least three “advertising” purpose cookies were set on the user’s browser:

According to the “Google Privacy & Terms”, “The ‘NID’ cookie is used to show Google ads in Google services for signed-out users, while the ‘ANID’ and ‘IDE’ cookies are used to show Google ads on non-Google sites […] The ‘IDE’ cookie lasts for 13 months in the European Economic Area (EEA), Switzerland, and the United Kingdom (UK), and 24 months everywhere else […] YouTube may also use these and other cookies and technologies, like the ‘VISITOR_INFO1_LIVE’ cookie, for advertising.”

Repeating the manual experiment nine more times, with brand new Chrome profiles, shows that every single time (ten out of ten), Google’s servers set the “VISITOR_INFO1_LIVE”, “NID”, AND “IDE” advertising cookies on the consumer’s browser, even though the consumer is only watching made for kids YouTube channels.

Furthermore, during each of the ten manual channel visits, it was observed that advertisers had their ads shown on the ten “madeForKids” channels. For example, in the screenshot below, one can observe a Hyundai ad serving on “Bounce Patrol – Kids Songs”. The “Why this ad” modal alleges that the ad was not demographically or behaviorally targeted, though it is not possible to verify this without obtaining data from Hyundai’s media buyers.

Hyundai ad serving on “Bounce Patrol – Kids Songs”

Performance Max (pmax) campaigns appear to be delivering on “Made for Kids” YouTube videos

As described in the background section of this report, Google has created a new ad targeting algorithm called “Performance Max” or “pmax”. According to Google’s documentation, Performance Max “combines Google's AI technologies” and “audiences” and “audience signals”.

“Performance Max uses machine learning models to optimize bids and placements to drive conversions or conversion value for your goals, but you can provide important inputs like audience signals.”

Advertisers have told Adalytics that they do not receive detailed placement reports on where ads are served on specific YouTube channels when they run Performance Max campaigns – the media buyers only get to review aggregate spend and delivery on YouTube, without channel or video level reporting granularity.

Source: Google’s online documentation on Performance Max campaigns

Source: Google’s online documentation on Performance Max campaigns

During the course of this research project, there were several instances where what appeared to be Performance Max campaigns had their ads served on “made for kids” YouTube videos. For example, in the screenshots below, one can observe that BMO Bank had ads for its credit cards placed on a ‘made for kids’ YouTube channel called “Kids Diana Show”.

The ads appear to have been placed by the media agency IPG Universal McCann (UM). If the viewer of this made for kids YouTube video were to click on the particular BMO Bank ad, their device would open the bmo.com website. The query string parameters suggest that the campaign was a Performance Max campaign. The bmo.com website appears to share data about the viewer of the made for kids YouTube video with dozens of third party ad tech and data brokers – without first asking for informed parental consent.

Screenshot of an ad for BMO Bank being served on the “Made for Kids” channel “Kids Diana Show”, on the video titled: “Diana Barbie and Roma Ken Pink vs. Blue Challenge” (https://www.youtube.com/watch?v=QIb7jejDOkw).

Screenshot of an ad for BMO Bank being served on the “Made for Kids” channel “Kids Diana Show”, on the video titled: “Diana Barbie and Roma Ken Pink vs. Blue Challenge” (https://www.youtube.com/watch?v=QIb7jejDOkw). The “Why this ad?” info modal indicates that the ad was placed by the media agency IPG Universal McCann (UM).

Screenshot of the BMO bank website bmo.com, showing UTM strings that reference Performance Max.

Analysis of the UTM query string parameters generated by the BMO Bank YouTube ad that was served on the “made for kids” video suggest that the ad was a Performance Max (pmax) campaign:

·  "utm_campaign":"P&C_CC_CA_EVI_ECLIPSE PerformanceMax Q3 MidFunnelTraffic_FY23_EN/FR",

·  "utm_content": "CC_EVI_1x1_PERFORMANCE-MAX-Q3_EN_5XPOINTS_LEARN MORE_PROS_MidFunnelTraffic",

·  "utm_medium": "PeformanceMax_Visa-Mid",

·  "utm_source": "BMO Mastercard -MC Advisors",

·   "utm_term": "Google_1x1_EN_CPM_PROS_Prospecting_MidFunnelTraffic_MASS- DETAILED_ALL_EVI_5XPOINTS_Performance-Max-MAY2023"

Screenshot of The Markup Blacklight website privacy inspector tool for the BMO Bank website (bmo.com), showing that the website shares data with dozens of third party data brokers and ad tech vendors, even when the user appears to be the viewer of a “made for kids” video on YouTube

Screenshot of the PageXraytool, showing that the bmo.com website shares data about viewers of “made for kids” videos with dozens of third party data brokers.

__________________________________________________________________________________________ As a 2nd example, in the screenshot below, one can observe an ad for “ADT Solar incentives Programs” being served on the “made for kids” YouTube video “Wheels on the bus - Zoo Friends - Animals Song Collection + More ChuChu TV Nursery Rhymes for Babies”, which is on the YouTube “made for kids” channel titled: “ChuChu TV Nursery Rhymes & Kids Songs”.

The landing page for the ad shows the presence of various clickthrough tracking UTM strings, including campaign: “ADT-Brand-Solar-PMAX-AllZips” and source: “Google-Pmax”.

Screenshot of an ad for ADT Solar being served on the “made for kids” YouTube video “Wheels on the bus - Zoo Friends - Animals Song Collection + More ChuChu TV Nursery Rhymes for Babies”, which is on the YouTube “made for kids” channel titled: “ChuChu TV Nursery Rhymes & Kids Songs”.

Screenshot of the adt.com/solar landing page, showing the presence of campaign and source query string tracking parameters that reference Performance Max

___________________________________________________________________________________________ As a 3rd example, in the screenshot below, one can observe an ad for Urban Science Access Success being served on the “made for kids” YouTube video “SuperHero Ryan Red Titan and Daddy save the City!”, which is on the YouTube “made for kids” channel titled: “Ryan's World

The landing page for the ad shows the presence of various clickthrough tracking UTM strings, including “utm_source” = “google-performance-max”.

Screenshot of an ad for Urban Science Access Success being served on the “made for kids” YouTube video “SuperHero Ryan Red Titan and Daddy save the City!”, which is on the YouTube “made for kids” channel titled: “Ryan's World”.

Screenshot of the urbanscience.com landing page, showing the presence of query string tracking parameters that reference Performance Max

___________________________________________________________________________________________

As a 4th example, in the screenshot below, one can observe an ad for “KBR Kitchen and Bath” being served on the “made for kids” YouTube video “Wheels on the bus +Baby Shark & More Popular Kids Songs | Animals Cartoons for Kids |Funny Cartoons”, which is on the YouTube “made for kids” channel titled: “Moonbug Kids – Animals for Kids”.

The landing page for the ad shows the presence of various clickthrough tracking UTM strings, including “utm_campaign” = “FA-PMax-Local”.

Screenshot of an ad for KBR Kitchen and Bath being served on being served on the “made for kids” YouTube video “Wheels on the bus +Baby Shark & More Popular Kids Songs | Animals Cartoons for Kids |Funny Cartoons”, which is on the YouTube “made for kids” channel titled: “Moonbug Kids – Animals for Kids”.

Screenshot of the kbrkitchenandbath.com landing page, showing the presence of query string tracking parameters that reference Performance Max

__________________________________________________________________________________________

In a 5th example, the advertiser Infor had ads serve on the “made for kids” video titled: “Vlad and Niki and new useful stories for kids about behavior and friendship”. The ad clickthrough URL for the ad shows that the “utm_medium” query string parameter references Performance Max.

“infor.com/resources/healthcare-top-3-challenges?utm_campaign=26853-049&utm_source=google&utm_medium=p-max&utm_content=3challenges&utm_type=microsite&gclid=[redacted]&gclsrc=aw.ds”

___________________________________________________________________________________________

In a 6th example, the accounting software brand Intuit had pre-roll ads serve on the “made for kids” YouTube video “Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs”, on the YouTube channel for kids: “Moonbug Kids – Fun with Friends!”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“proconnect.intuit.com/proseries/?s_cid=BAC-MB_PS_G_PMAX__3Q-Google-PS-PerformanceMax_AD&infinity=[redacted]&gclid=[redacted]&gclsrc=aw.ds”

Intuit’s website appears to set ad trackers and cookies with numerous third parties without first asking for informed parental consent.

Screenshot of a browser on the “made for kids” YouTube video “Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs”, on the YouTube channel for kids: “Moonbug Kids – Fun with Friends!”. The screenshot shows an ad for the accounting software company Intuit running pre-roll the ‘made for kids’ video.

Screenshot of a browser on the intuit.com advertiser page. The screenshot shows that thebrowser URL bar references the query string parameters “PMAX” and “PerformanceMax”. The screenshot also shows that the intuit.com website shares meta-data about the viewer of a “made for kids” YouTube video without asking for informed parental consent.

Screenshot of The Markup’s Blacklight tool, showing the presence of third party ad trackers and cookies being set on the devices of visitors to Intuit’s website.

___________________________________________________________________________________________

In an 7th example, Maxeon Solar Technologies – a solar panel manufacturer - had pre-roll ads serve on the “made for kids” YouTube video “The Farmer In The Dell | + More Nursery Rhymes and Kids Songs | Super Simple Songs”, on the YouTube channel for kids: “Super Simple Songs - Kids Songs”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“maxeon.com/us/solar-solutions/solar-panels-home?utm_source=google&utm_medium=cpc&utm_campaign=77_us_eng_search_multiple_google_pros_pmax&gclid=[redacted]”

Screenshot of Chrome browser, showing a pre-roll ad for Maxeon Solar Technologies – a solar panel manufacturer – serving on the “made for kids” YouTube video “The Farmer In The Dell | + More Nursery Rhymes and Kids Songs | Super Simple Songs”, on the YouTube channel for kids: “Super Simple Songs - Kids Songs”.

Screenshot of a browser on the maxeon.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The screenshot also shows that the maxeon.com website uses cookies. ___________________________________________________________________________________________

In a 8th example, Morningstar Investor – a financial stocks investing research tool - had pre-roll ads serve on the “made for kids” YouTube video titled: “Walking with Jesus | More Christian Songs for Kids | Kids Faith TV”, on the YouTube channel “Kids Faith TV”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“investor.morningstar.com/mm/learn?offercode&utm_source=google&utm_medium=cpc&utm_campaign=MORNP_General_Gen_PMAX_PMAX_NulL_Null_National%2520&utm_content=engine%253Agoogle%257Ccampaignid[...]”

Screenshot of Chrome browser, showing a pre-roll ad for Morningstar Investor served on the “made for kids” YouTube video titled: “Walking with Jesus | More Christian Songs for Kids | Kids Faith TV”, on the YouTube channel “Kids Faith TV”.

Screenshot of a browser on the investor.morningstar.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The screenshot also shows that the morningstar.com website uses various third party tracking scripts.

___________________________________________________________________________________________

In a 9th example, Wallaroo.AI – a machine learning platform - had pre-roll ads serve on the “made for kids” YouTube video titled   : “Маша и Медведь 2023 👶🍼 Дочки-Матери (Трейлер) 👱‍♀️🐻 Новая серия 3 августа!”. This is Russian for: “Masha and the Bear 2023 👶🍼 Mothers and Daughters (Trailer) 👱‍♀️🐻 New episode on August 3rd!”. The video appeared on the YouTube channel titled: “Маша и Медведь”, which is Russian for: “Masha and the Bear”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“wallaroo.ai/platform/?utm_term=x&utm_campaign=Performance+Max&utm_source=adwords&utm_medium=ppc&hsa_acc=7619311690&hsa_cam=20320996766&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gclid=[redacted]”

Screenshot of Chrome browser, showing a pre-roll ad for Wallaroo.AI served on the “made for kids” Russian-language YouTube video titled: “Masha and the Bear 2023 👶🍼 Mothers and Daughters (Trailer) 👱‍♀️🐻 New episode on August 3rd!”, on the YouTube channel “Masha and the Bear”.

Screenshot of Chrome browser, showing a pre-roll ad for Wallaroo. AI served on the “made for kids” Russian-language YouTube video titled: “Masha and the Bear 2023 👶🍼 Mothers and Daughters (Trailer) 👱‍♀️🐻 New episode on August 3rd!”, on the YouTube channel “Masha and the Bear”.

Screenshot of the PageXray tool, showing that the wallaroo.ai website shares data about viewers of “made for kids” videos with dozens of third party data brokers.

Screenshot of The Markup’s Blacklight tool, showing the presence of third party ad trackers and cookies being set on the devices of visitors to wallaroo.ai website.

___________________________________________________________________________________________

In a 10th example, HelloProject USA LLC – a house and bathroom remodeling service - had pre-roll ads serve on the “made for kids” YouTube video titled: “This is the Way (Doggy Care Version) | CoComelon Nursery Rhymes & Kids Songs”. The ad served on the YouTube channel titled: “Cocomelon - Nursery Rhymes”

The clickthrough URL for these ads references Performance Max in the query string parameters:

“helloprojectusa.com/home-windows/?SRC=HP_Windows_Google&Sub_ID=PMax&Pub_ID=All&utm_id=123&utm_source=google&utm_medium=paid&utm_campaign=PMax-Windows-All&utm_term=windows&utm_content&gclid=[redacted]&nab=0&utm_referrer=https%3A%2F%2Fwww.youtube.com%2F

Screenshot of Chrome browser, showing a pre-roll ad for HelloProject USA LLC served on the “made for kids” YouTube video titled: “This is the Way (Doggy Care Version) | CoComelon Nursery Rhymes & Kids Songs”. The ad served on the YouTube channel titled: “Cocomelon - Nursery Rhymes”.

Screenshot of a browser on the helloprojectusa.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The screenshot also shows that the helloprojectusa.com website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In an 11th example, Car Donation Foundation - had pre-roll ads serve on the “made for kids” YouTube video titled: “The Coffee Break On The Big Hill! ☕️ | Peppa Pig Official Full Episodes”. The ad served on the YouTube channel titled: “Peppa Pig - Official Channel”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“wheelsforwishes.org/?_vsrefdom=Adwords&utm_source=google&utm_medium=cpc&utm_campaign=GWFWNA_Performance_Max_National_Google_v8&utm_content&utm_term&gclid=[redacted]”

Screenshot of Chrome browser, showing a pre-roll ad for Car Donation Foundation served on the “made for kids” YouTube video titled: “The Coffee Break On The Big Hill! ☕️ | Peppa Pig Official Full Episodes”. The ad served on the YouTube channel titled: “Peppa Pig - Official Channel”

Screenshot of a browser on the wheelsforwishes.org advertiser page. The screenshot shows that the browser URL bar references the query string parameters “Performance_Max”. The screenshot also shows that the wheelsforwishes.org website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In a 12th example, an ad for the insurance company Outsurance, had pre-roll ads served on the “made for kids” YouTube video titled: “PAW Patrol Mega Robot Rescues! w/ Chase, Skye & Robo-Dog | 1 Hour Compilation | Nick Jr.”. The ad served on the YouTube channel titled: “Nick Jr.”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“outsurance.co.za/pet-insurance/?source=googlepmax_pet&gclid=[redacted]”

Screenshot of Chrome browser, showing a pre-roll ad for Outsurance served on the “made for kids” YouTube video titled: “PAW Patrol Mega Robot Rescues! w/ Chase, Skye & Robo-Dog | 1 Hour Compilation | Nick Jr.”. The ad was served on the YouTube channel titled: “Nick Jr.”.

Screenshot of a browser on the Outsurance advertiser page. The screenshot shows that thebrowser URL bar references the query string parameters “googlepmax”. The screenshot also shows that the website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In a 13th example, an ad for Volunteering Travel Solutions UK Limited, had pre-roll ads served on the “made for kids” YouTube video titled: “Ninja Kidz and Sneak Attack Squad Remastered! Ethan And Cole Play with Ninja Kidz Toys!”. The ad served on the YouTube channel titled: “ExtremeToys TV”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“volunteeringsolutions.co.uk/?utm_term=&utm_campaign=UK+PMax+-+VS&utm_source=adwords&utm_medium=ppc&hsa_acc=4090486960&hsa_cam=18885013827&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gclid=[redacted]”

Pre-roll ad for Volunteering Travel Solutions UK Limited served on the “made for kids” YouTube video titled: “Ninja Kidz and Sneak Attack Squad Remastered! Ethan And Cole Play with Ninja Kidz Toys!”. The ad served on the YouTube channel titled: “ExtremeToys TV”.

Screenshot of a browser on the volunteeringsolutions.co.uk advertiser page. The screenshot shows that the browser URL bar references the query string parameters “PMax”. The screenshot also shows that the website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In a 14th example, an ad for the Pluto TV ad-supported streaming television service owned and operated by the Paramount Streaming division of Paramount Global, had pre-roll ads served on the “made for kids” YouTube video titled: “I Can Put Away My Toys | Good Habits | Kids Cartoon | Funny Stories | Mimi and Daddy”. The ad served on the YouTube channel titled: “Mimi and Daddy - Kids Songs and Cartoons”

The clickthrough URL for these ads references Performance Max in the query string parameters:

“pluto.tv/en/live-tv/totally-turtles-ca?utm_source=google&utm_medium=pmax&utm_campaign=1007053&utm_content=10018117&gclid=[redacted]”

Pre-roll video ad for the Pluto TV ad-supported streaming television service owned and operated by the Paramount Streaming division of Paramount Global, served on the “made for kids” YouTube video titled: “I Can Put Away My Toys | Good Habits | Kids Cartoon | Funny Stories | Mimi and Daddy”. The ad served on the YouTube channel titled: “Mimi and Daddy - Kids Songs and Cartoons”

Screenshot of a browser on the pluto.tv advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”.

___________________________________________________________________________________________

In a 15th example,  Onlogic industrial computer Edge Servers had pre-roll ads served on the “made for kids” YouTube video titled: “Spiderman The Movie! Kids Fun TV Spider-Man Compilation Video!”. The video was served on the “made for kids” YouTube channel titled: “Kids Fun TV”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“onlogic.com/ac101/?utm_term=&utm_campaign=US-+PMax+-+Axial&utm_source=adwords&utm_medium=ppc&hsa_acc=9181945420&hsa_cam=20179618265&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gclid=[redacted]”

Onlogic industrial computer Edge Servers had pre-roll ads served on the “made for kids” YouTube video titled: “Spiderman The Movie! Kids Fun TV Spider-Man Compilation Video!”.   The video was served on the “made for kids” YouTube channel titled: “Kids Fun TV”.

Screenshot of a browser on the onlogic.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “PMax”. The screenshot also shows that the website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In a 16th example, a pre-roll ad for the Australian software vendor Roller Software was served on the “made for kids” YouTube video titled: “Here We Go Up | COCOMELON | Kids Songs | Nursery Rhymes | Sleep Baby Songs”. The ad was served on the “made for kids” YouTube channel titled: “Moonbug Kids - Lullabies For Babies”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“roller.software/features/hq-add-on/?utm_feeditemid=&utm_device=c&utm_term=&utm_source=google&utm_medium=ppc&utm_campaign=NA+%7C+Performance+Max&hsa_cam=16368958722&hsa_grp=&hsa_mt=&hsa_src=x&hsa_ad=&hsa_acc=7049633536&hsa_net=adwords&hsa_kw=&hsa_tgt=&hsa_ver=3&gclid=[redacted]”

A pre-roll ad for the Australian software vendor Roller Software was served on the “made for kids” YouTube video titled: “Here We Go Up | COCOMELON | Kids Songs | Nursery Rhymes | Sleep Baby Songs”. The ad was served on the “made for kids” YouTube channel titled: “Moonbug Kids - Lullabies For Babies”.

Screenshot of a browser on the roller.software advertiser page. The screenshot shows that the browser URL bar references the query string parameters “Performance Max”. The screenshot also shows that the website uses various third party tracking scripts, and does not ask for informed parental consent.

___________________________________________________________________________________________

In a 17th example, a pre-roll ad for the British GPS tracking hardware solutions vendor ABAX was served on the “made for kids” YouTube video titled: “Hop Little Bunnies Dance + MORE CoComelon Nursery Rhymes & Kids Songs”. The video is part of the “made for kids” YouTube channel “Cocomelon - Nursery Rhymes”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“abax.com/dk?utm_term=&utm_campaign=DK+-+Pmax-Leads+-+Work+Smarter+1&utm_source=adwords&utm_medium=ppc&hsa_acc=8776006114&hsa_cam=19885581240&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gclid=[redacted]”

A pre-roll ad for the British GPS tracking hardware solutions vendor ABAX was served on the “made for kids” YouTube video titled: “Hop Little Bunnies Dance + MORE CoComelon Nursery Rhymes & Kids Songs”. The video is part of the “made for kids” YouTube channel “Cocomelon - Nursery Rhymes”.

Screenshot of a browser on the abax.com software advertiser page. The screenshot shows that the browser URL bar references the query string parameters “Pmax”. The screenshot also shows that the website uses various third party tracking scripts.

___________________________________________________________________________________________

In an 18th example, a pre-roll ad for the British film school Metfilm School Ltd. was served on the “made for kids” YouTube video titled: “Hop Little Bunnies Dance + MORE CoComelon Nursery Rhymes & Kids Songs”. The video is part of the “made for kids” YouTube channel “Cocomelon - Nursery Rhymes”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“metfilmschool.ac.uk/courses/undergraduate/ba-digital-film-practice-visual-effects?utm_source=google&utm_campaign=mt-google-ug-london-performance-max&utm_medium=cpc&utm_content=mt-digital-film-visual-effects”

A pre-roll ad for the British film school Metfilm School Ltd. was served on the “made for kids” YouTube video titled: “Hop Little Bunnies Dance + MORE CoComelon Nursery Rhymes & Kids Songs”. The video is part of the “made for kids” YouTube channel “Cocomelon - Nursery Rhymes”.

Screenshot of a browser on the metfilmschool.ac.uk advertiser page. The screenshot shows that the browser URL bar references the query string parameters “performance max”. The screenshot also shows that the website uses various third-party tracking scripts. ___________________________________________________________________________________________

In a 19th example, a pre-roll ad for web development agency GetDevDone was served on the “made for kids” YouTube video titled: “LEO and TIG 🦁 🐯 NEW 🌌 The Cheerful Cassowary 🦃 Cartoon For Children 💚 Moolt Kids Toons Happy Bear”. The video is part of the “made for kids” YouTube channel “Moolt Kids Toons Happy Bear”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“getdevdone.com/webflow-development.html?utm_source=google&utm_medium=cpc&utm_campaign=P2H_PMax_All_Product&utm_content=cid|[redacted]&gclid=[redacted]”

A pre-roll ad for web development agency GetDevDone was served on the “made for kids”

Screenshot of a browser on the getdevdone.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “PMax”. The screenshot also shows that the website uses various third-party tracking scripts.

___________________________________________________________________________________________

In a 20th example, a pre-roll ad for American multi-national construction equipment manufacturer Caterpillar Inc. was served on the “made for kids” YouTube video titled: “Booba 🙃 Best Episodes Collection ⭐ Most Interesting Cartoons 💚 Moolt Kids Toons Happy Bear⭐”. The video is part of the “made for kids” YouTube channel “Moolt Kids Toons Happy Bear”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“cat.com/en_US/campaigns/awareness/lets-do-the-work/e-news.html?utm_source=google&utm_medium=cpc&utm_campaign=brand_ldtw_paid_search_pmax&utm_content=brand_ldtw_paid_search&utm_keyword=&gclid=[redacted]”

Pre-roll ad for American multi-national construction equipment manufacturer, Caterpillar Inc., was served on the “made for kids” YouTube video titled: “Booba 🙃 Best Episodes Collection ⭐ Most Interesting Cartoons 💚 Moolt Kids Toons Happy Bear⭐”. The video is part of the “made for kids” YouTube channel “Moolt Kids Toons Happy Bear”.

Screenshot of a browser on the cat.com advertiser page. The screenshot shows that the browser URL bar references the query string parameters “PMax”.

___________________________________________________________________________________________

In a 21st example, a pre-roll ad for the Canadian mobile phone store themobileshop.ca was served on a “made for kids” YouTube video titled: “SuperHero Ryan Red Titan and Daddy save the City!”. The video was served on the YouTube “made for kids” channel titled: “Ryan's World”. The ad was purchased by the media agency “DentsuX Inc.”

The clickthrough URL for these ads references Performance Max in the query string parameters:

“themobileshop.ca/en/phones/?utm_source=google&utm_medium=search&utm_campaign=2023~7~5~loblawagency~internal~pcf~na~tms~services~national~pmax~7001625-tms_ao_refresh_2023q3&utm_content=6043003~loyalty~conv~en&utm_term=&gclid=[redacted]&gclsrc=aw.ds”

A pre-roll ad for the Canadian mobile phone store themobileshop.ca was served on a “made for kids” YouTube video titled: “SuperHero Ryan Red Titan and Daddy save the City!”. The video was served on the YouTube “made for kids” channel titled: “Ryan's World”.

Screenshot of “My Ad Center” for a themobileshop.ca ad. The modal shows the ad was placed by “DentsuX Inc.”

Screenshot of a browser on the themobileshop.ca advertiser page. The screenshot shows that the browser URL bar references the query string parameters “PMax”. The website uses various third party ad trackers.

___________________________________________________________________________________________ In a 22nd example, a pre-roll ad for Dozr – a construction equipment rental vendor - was served on a “made for kids” YouTube video titled: “SuperHero Ryan Red Titan and Daddy save the City!”. The video was served on the YouTube “made for kids” channel titled: “Ryan's World”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“dozr.com/rent?url=https://dozr.com/rent/straight-boom-lift%3Futm_source%3Dsearch%26utm_medium%3Dgoogleads%26utm_campaign%3Dpmaxus%26cq_src%3Dgoogle_ads%26cq_cmp%3D19852657358%26cq_con%3D%26cq_term%3D%26cq_med%3D%26cq_plac%3D%26cq_net%3Dx%26cq_pos%3D%26cq_plt%3Dgp&gclid=[redacted]”

A pre-roll ad for Dozr – a construction equipment rental vendor - was served on a “made for kids” YouTube video titled: “SuperHero Ryan Red Titan and Daddy save the City!”. The video was served on the YouTube “made for kids” channel titled: “Ryan's World”.

Screenshot of a browser on the themobileshop.ca advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The website uses various third party ad trackers.

___________________________________________________________________________________________

In a 23rd example, a pre-roll ad for the “UK Business Centre” – an economic development initiative – was served on “made for kids” video. The initiative is “conducted by Nord France Invest alongside the British Chamber of Commerce and Industry of Lille and with the support of the UK Department of Business and Trade.” The ad was served on the “made for kids” YouTube video titled: “Curious George 🐵Housebound! 🐵Kids Cartoon 🐵Kids Movies 🐵Videos for Kids”. The particular video is part of the YouTube channel titled: “Curious George Official”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“hub.nordfranceinvest.com/uk_business_centre?utm_term=&utm_campaign=%5BUK%5D%5BPMAX%5D+BUSINESS+CENTRE&utm_source=adwords&utm_medium=ppc&hsa_acc=7449185125&hsa_cam=20316034926&hsa_grp=&hsa_ad=&hsa_src=x&hsa_tgt=&hsa_kw=&hsa_mt=&hsa_net=adwords&hsa_ver=3&gclid=[redacted]”

Screenshot of a pre-roll ad for the “UK Business Centre” – an economic development initiative – was served on “made for kids” video. The initiative is “conducted by Nord France Invest alongside the British Chamber of Commerce and Industry of Lille and with the support of the UK Department of Business and Trade.” The ad was served on the “made for kids” YouTube video titled: “Curious George 🐵Housebound! 🐵Kids Cartoon 🐵Kids Movies 🐵Videos for Kids”. The particular video is part of the YouTube channel titled: “Curious George Official”.

Screenshot of a browser on the hub.nordfranceinvest.com/uk_business_centre advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The website uses various third-party ad trackers.

___________________________________________________________________________________________

In a 24th example, a pre-roll ad for Royal Bank of Canada was served on “made for kids” video titled: “3 Branches of Government | Kids Educational Video | Kids Academy”. The video was part of the “made for kids” YouTube channel “Kids Academy”.

The clickthrough URL for these ads references Performance Max in the query string parameters:

“rbcwealthmanagement.com/en-us/campaign/financial-security-begins-by-building-a-plan-you-can-trust?utm_medium=paid-search&utm_source=google-performance-max&utm_campaign=golf&utm_id=[redacted]&gclid=[redacted]”

A pre-roll ad for Royal Bank of Canada was served on “made for kids” video titled: “3 Branches of Government | Kids Educational Video | Kids Academy”. The video was part of the “made for kids” YouTube channel “Kids Academy”.

Screenshot of a browser on the “rbcwealthmanagement.com/en-us/campaign/financial-security-begins-by-building-a-plan-you-can-trust” advertiser page. The screenshot shows that the browser URL bar references the query string parameters “pmax”. The website uses various third-party ad trackers.

___________________________________________________________________________________________

It is unclear whether these advertisers were aware that their Performance Max campaigns had ads served on made for kids YouTube videos.

Google Preferred ad campaigns were served on “made f or kids” channels

YouTube Select (formerly referred to as “Google Preferred”) is a premium YouTube ad product, which is generally more expensive than other YouTube ad products. It can be purchased by brands and media agencies after speaking with a Google account sales representative. According to Wikipedia, “Google Preferred is a YouTube program that allows advertisers to pay to place their ads on high-performing videos on the site. The program divides YouTube's most popular channels among 18- to 34-year-olds, comprising the most popular 5% of content on the site, into twelve categories. Its purpose is to signal advertisers that they can trust a given channel in the program to produce high-quality content.” YouTube’s online documentation states that “with YouTube Select, you can be confident thatyour ad buys are brand-safe.” YouTube Select has a “99% success rate on brand safety in third-party beta tests with IAS and DoubleVerify”.

During the course of this research study, there were multiple instances where ad campaigns that appeared to be Google Preferred appeared on “made for kids” videos. For example, in the screenshot below, one can observe an ad for the Canadian ecommerce platform Shopify appearing on a “made for kids” video titled: “ChuChu TV Classics - Johny Johny Yes Papa Collection - ChuChu TV Kids Songs”.

Careful inspection of the “Network” tab in Chrome Developer Tools’ shows that the particular Shopify ad has a Campaign Manager ad server pixel, which references the string “GOOGLEPREFERRED”.

Screenshot of a Shopify ad being served on a “made for kids” YouTube video. The Campaign Manager ad server pixel for the ad references “GOOGLEPREFERRED”.

Screenshot of a Shopify ad being served on another “made for kids” YouTube video. The Campaign Manager ad server pixel for the ad references “GOOGLEPREFERRED”.

Screenshot of Chrome Developer Tools network tab, showing the Campaign Manager ad server pixel for the Shopify ad references “GOOGLEPREFERRED”.

The terms of service for Shopify (https://www.shopify.com/legal/terms) state that: “You must be the older of: (i) 18 years, or (ii) at least the age of majority in the jurisdiction where you reside and from which you use the Services to open an Account.”

Screenshot of the Shopify terms of service, showing that Shopify requires the users to be 18 years or older.

It is unclear whether or not Shopify intended for its products to be advertised to viewers of “made for kids” YouTube videos.

YouTube iOS mobile app appears to allow data harvesting on viewers of “Made for Kids” channels

In addition to studying the behavior of HTTPS network traffic and cookies set on a consumer’s web browser while watching the youtube.com website, this study also analyzed network traffic and behavior of the YouTube native iOS iPhone mobile application. This mobile application can be found on the Apple iOS App Store under - https://apps.apple.com/us/app/youtube-watch-listen-stream/id544007664

The iOS app store listing for this YouTube app shows that the app collects various identifiers and uses them for the purposes of “Third-Party Advertising” or “Developer’s Advertising or Marketing”.

Source: https://apps.apple.com/us/app/youtube-watch-listen-stream/id544007664

During the course of analyzing this YouTube iPhone app, it was noted that the app itself generally does not appear to set advertising related cookies.

However, the study found six other observations:

1. The app created a persistent, immutable “installation ID” called the “X-Goog-Visitor-ID”, for which there does not appear to be anyway to delete, edit, or remove consent for this identifier. Google’s privacy policies and terms do not explicitly disclose this identifier. The identifier is regularly transmitted to YouTube’s servers, even if the user is constantly viewing “made for kids” channels. YouTube does not ask for parental consent or disclose to parents the existence of this identifier

2. The app appears to serve ads for brands who are likely intending to target adults (automotive, real estate, finance, and telecoms brands) – on “made for kids” channels

3. If a child or toddler inadvertently clicks on an ad on a Made for Children channel, the YouTube iOS app opens the advertiser’s website in a special “in-app browser webview”, rather than opening the ad in the dedicated iOS Safari browser. When opening this advertiser website, the YouTube app “injects” a unique click tracking ID called “wbraid” such that the YouTube app and the advertiser website can exchange information and track the user’s activity between the YouTube mobile app and the website context. The YouTube app does not appear to use Apple’s “App Tracking Transparency” (ATT) framework or ask for parental consent  before injecting this unique click tracking ID when a user clicks on an ad on a “made for kids” channel.

a. Various 3rd parties, such as Facebook, Twitter, MNTN (formerly SteelHouse Media) were observed harvesting the “wbraid” click conversion ID and sending it to their own servers. This could theoretically allow the third party vendors to perform “record linkage” on their respective user activity or audience graphs

4. In many observed cases, the YouTube app does NOT correctly configure or enable a specific Google signal called the “tag_for_child_directed” treatment, which would communicate to advertisers that a given user was coming from a “made for kids” channel

5. When a consumer clicks on an ad on a “Made For Kids” channel, Google’s various tools on advertisers’ websites were observed to:

a. Put the “made for kids” channel viewer into custom re-targeting audience pools

b. Set ad tracking cookies on the viewer’s phone

c. Put the “made for kids” channel viewer into various audience lists and segments

6. Furthermore, in addition to Google’s own tools collecting metadata about the viewer of the “made for kids” channel ad, it was observed that other companies, including Facebook, Trade Desk, Twitter, Linkedin, Pinterest, and others would create or set identifiers on user’s device

The YouTube iPhone app appears to create an undisclosed, persistent, immutable identifier without parental consent, and sends this identifier to YouTube’s servers even when a viewer is watching a “Made for Kids” channel

When a consumer installs the YouTube iPhone iOS app, and begins using the apps to watch YouTube videos on their iPhone, it appears that a specific HTTP request header called “X-Goog-Visitor-ID” is continuously sent to YouTube’s servers from the user’s phone. This request header contains what appears to be a high entropy, unique identifier. Regardless of whether or not a user is signed into the YouTube app, or whether they reset their app analytics IDs, this identifier appears to be persistent with a constant value. The identifier does not appear to be disclosed in any privacy policy or technical documentation.

Screenshot of analyzed HTTP network traffic logs from the iOS YouTube iPhone mobile app, showing that a specific HTTP request header called the “X-Goog-Visitor-ID” is sent continuously, even when the user is not signed and is watching “made for kids” videos.

It is unclear what this HTTP request header value is used for, and why it does not appear to be (readily) disclosed in any privacy policies or documentation.

The YouTube iPhone app appears to create unique click tracking IDs to combine data from the YouTube app with activity on advertisers’ websites, without asking for parental consent or using Apple’s ATT consent framework

If a user clicks on an ad on the YouTube iOS mobile app, the app appears to append a unique query string parameter called “wbraid”. This parameter contains a high entropy, unique value, and Google’s online documentation discloses that this identifier is used for ad measurement and attribution purposes.

The “wbraid” parameter appears to be passed to the advertiser’s website via a HTTP redirect response header that appends a modified version of the wbraid ID as another query string parameter, that is also called “wbraid”.

The “wbraid” parameters are appended to ad clickthrough, even when the ad is served on a “made for kids” video.

The YouTube iOS mobile app did not appear to ask for iOS App Tracking Transparency (ATT) consent before appending the high entropy wbraid identifier to ad clickthrough event on “made for kids” video ads.

The “wbraid” click ID appears to be “harvested” by various third party ad tech vendors and data brokers

If the viewer of a “made for kids” video clicks on an ad and comes to an advertiser’s website via the YouTube iOS mobile app, the “wbraid” parameter – which is a query string parameter, is relayed via HTTPS requests to various ad and data broker endpoints.

These include Google’s own endpoints, such as Google Analytics, as well as many third party endpoints, such as Facebook Pixel, Microsoft Bing, Trade Desk, Pinterest, and TikTok’s.

It is unclear whether Google is aware that third parties receive access to the “wbraid” ID.

Even when the user is coming from a “Made for Kids” YouTube channel, Google’s tools appear to put the user into various custom retargeting and audience data pools

Some of the advertiser websites whose ads were served on “made for kids” YouTube videos appear to have configured Google Re-marketing audiences. When the viewer of a “made for kids” video clicks on one of these ads and opens a given website, the user’s device has cookies placed on it, and those cookies are also relayed to Google’s servers to enable repeated and continuous ad exposure on that user’s device.

Inside the YouTube app, even when the user is coming from a “Made for Kids” channel, third parties are observed setting trackers and harvesting meta-data about the user

When the viewer of an ad served on “made for kids” video clicks on said ad, many advertisers’ websites are observed setting third party cookies and trackers on the user’s device, as well as sending HTTPS requests to ad measurement or targeting endpoints, such as the Facebook Pixel.

These advertiser websites are opened within the YouTube iOS app in-app webview.

Google’s ad server is not telling advertisers that ads are being served on content meant for kids

There were many observed instances of CM360/DCM pixels (indicated as`ad.doubleclick.net`) in ads served on "made for kids" YouTube channels where the "tag_for_child_directed_treatment" was not set to "1".

Brands whose ads were served on “made for kids” channels

The list of YouTube brands whose ads were observed being served on “made for kids” YouTube channels, included the sample of following brands. This list is neither comprehensive nor exhaustive.

Some of these brands may have intended to have their ads served on “made for kids” videos, whereas it’s ostensibly possible that for other brands – they may not have intended to have their ads served on “made for kids” videos:

1. Procter & Gamble (Gillette razor blades; Native natural deodorant brand (also known as Zenlen Inc or Native Cosmetics))

2. Kimberly-Clark (personal care products)

3. Google (Google Workspace, Google Chrome Enterprise, Google Pixel phone, YouTube NFL Sunday Ticket, and YouTube Premium subscription service, YouTube Music)

4. Michigan State Police (Office of Highway Safety Planning)

5. German Federal Ministry for Digital and Transport - deutschland-spricht-ueber-5g.de

6. Rothenberg Law Firm LLP (personal injury law firm – injurylawyer.com)

7. OnePlus (Chinese consumer electronics manufacturer)

8. BMW

9. Netflix (ads placed by Wavemaker media agency)

10. Dell computers – ads placed by Essence Mediacom agency

11.  General Motors (car brand – ads placed by Dentsu media agency)

12.  Apple (Apple gift cards, Apple iPhone 14)

a. Apple appears to be using the vendor Channel Factory for some of their iPhone 14 ad campaigns

13.  Mars (Whiskas cat food)

14.  GlaxoSmithKline (British multinational pharmaceutical and biotechnology)

15.  Ebay (Ebay Motors)

16.  Disney (Disney World, Disney+ streaming service)

17.  New York State Government - Office of Temporary and Disability Assistance - Low Income Household Water Assistance Program (LIHWAP) - https://otda.ny.gov/programs/water-assistance/

18.  Florida State Government - Florida Department of Environmental Protection – floridascoralreef.org

19.  Florida State Government – Florida Department of Transportation – SunPass (sunpass.com)

20.  Air France (airline)

21.  Subaru (car brand)

22.  L.L.Bean (retail, clothing, shoes)

23.  Royal Bank of Canada (rbcwealthmanagement.com)

24.  NBCUniversal (thesupermariobros.movie)

25.  Nissan

26.  BNP Paribas (French bank) – ads placed by media agency Havas

27.  Dole (orange juice)

28.  Canada Life (insurance and financial services company)

29.  Royal Canadian Mint (mint.ca)

30.  Government of Ontario (ServiceOntario - ontario.ca/page/serviceontario)

31.  Tang Prize (tang-prize.org/en/first.php)

32.  Nike (Nike Pegasus 40 running shoes, Nike Victory Collective)

33.  Reddit for Business (Reddit performance ads)

34.  Naturepedic (mattresses)

35.  Amazon (Blink security cameras)

36.  LG (dishwashers)

37.  Hoover

38.  UNICEF

39.  Virgin Plus (mobile cell provider)

40.  Renault (French car manufacturer)

41.  Montefiore Health System

42.  New Era Real Estate

43.  Reckitt Benckiser Group (Resolve Carpet Cleaner)

44.  Reckitt Benckiser (Australia) Pty Limited – Dettol (cleaner spray)

45.  Paramount (media and entertainment) – including Pluto TV, Paramount+ streaming

46.  Viacom International I nc. (serving ads for “Special Ops – Lioness”, a “TV-MA” mature audiences rated TV show)

47.  PPG Industries (Glidden paint)

48.  Samsung

49.  Dyson (vacuums) – ads placed by IPG Matterkind

50.  Terminix (Termite control) – ad was placed by IPG Matterkind

51.  Timberland (shoes)

52.  Philips (Dutch multinational health technology conglomerate)

53.  Michigan Wildlife Council (hereformioutdoors.org)

54.  Intuit (accounting software) – running Performance Max campaigns

55.  Mailchimp (email delivery vendor, now owned by Intuit)

56.  HP (laptop computers)

57.  Primo Golf Apparel

58.  Roller Networks Australia (Venue management software)

59.  Tidewater Community College (proud.tcc.edu; ad purchased by BH Media Group, a unit of Berkshire Hathaway)

60.  Texaco

61.  Zaptek (mosquito removal)

62.  Live Nation Entertainment – TicketMaster – Jerry Seinfeld

a. Ads were served on “Depression For Kids & Teens | Mental Health Treatment For Low & Depressed Mood-Overcoming Sadness” video

63.  Felix Mobile (TPG Telecom) – second largest telecommunications company on Australian Securities Exchange

64.  Credit One Bank (headquartered in Las Vegas, Nevada)

65.  Seaworld Orlando

66.  Marriott (hotels)

67.  Acura (cars)

68.  Medallia – customer & employee experience management software

69.  OnLogic (industrial computers; observed running Performance Max campaigns)

70.  Infor (running Performance Max campaigns via Marketing Direct Inc. advertising agency)

71.  Shopify (was purchasing Google Preferred)

72.  My Driven Threats (t-shirts)

73.  Colgate-Palmolive

a. Hill's Pet Nutrition, Colgate Herbal toothpaste, Sta-soft fabric softener

74.  Sunrise Senior Living (senior living communities)

75.  American Automobile Association (AAA)

76.  Realtor.com – owned by Move, Inc (owned by News Corp), in partnership with the National Association of Realtors

77.  Morgan & Morgan - Injury Law Firm (forthepeople.com)

78.  Louis Vuitton (luxury goods)

79.  Arc’Teryx (winter clothing)

80.  Audi (cars)

81.  SAS (German software - SAS Viya)

82.  Verizon

83.  Raymour's Furniture Company Inc (raymourflanigan.com)

84.  TD Bank

85.  BMO Bank (appears to be running Performance Max campaign via their agency IPG Universal McCann)

86.  Lumen Technologies, Inc.

87.  Fandango (movie tickets)

88.  Red Bull (energy drinks)

89.  Fidelity Investments

90.  Western Union (financial services)

91.  Boost Mobile

92.  Queensland (Australia) government - Queensland Fire and Emergency Services – (bushfire-survival-plan.qfes.qld.gov.au)

93.  Salesforce

94.  Walmart Business

95.  Payscale

96.  Wrike (project management software)

97.  Comcast Xfinity

98.  Comcast corporate – Project UP (corporate.comcast.com/impact/project-up)

99.  Wire Belt Company (UK)

100. Ram Trucks (part of car manufacturer Stellantis)

101. Tello Mobile

102. Freecaseevals.com (Personal injury law firms)

103. Adobe

104. Cleanomic (Compostable zip lock bags)

105. Philippine Airlines

106. Bridgestone (tire and rubber company)

107. Volvo

108. Aven Card (aven.com)

109. LendCare (LendCare Capital Inc., part of goeasy Ltd, a Canadian financial services company)

110. Earth Breeze (Laundry sheets detergent)

111. Vrbo (travel bookings)

112. Proper Cloth

113. DiGiorgi Roofing & Siding

114. Lenovo (computers)

115. Hisco (Industrial Equipment Supplier)

116. Quest Software Inc

117. Siemens (Siemens Industry Software - dex.siemens.com/zel-x)

118. Viz Media (American publisher and distributor of Japanese manga)

119. Telus (telus.com – Canadian telecommunications company)

120. Squarespace (website hosting and design)

121.  ADT Solar (part of ADT Home Security)

122. Exoticca Travel US (travel agency)

123. Kohl’s (retail)

124. Purple (mattress) – ad placed by the media agency Essence Global

125. Firestone (auto care)

126. Yeti (outdoor sportsware and equipment)

127. Tenlira

128. Lululemon

129. Planet Fitness

130. Office Depot

131. Walgreens (pharmacy)

132. New Orleans Tourism Marketing Corporation (NOTMC) (the City of New Orleans' leisure travel promotion agency)

133. Envestnet (financial technology)

134. Bose

135. Reebok

136.   Arizona Corporation Commission (Public Utilities Commission of the State of Arizona - azcc.gov)

137. Mint Mobile (mobile network operator)

138. Penske Truck Leasing

139. Vidyard.com (owned by Buildscale Inc)

140. Lampsplus.com

141. Chico’s (clothing)

142. Kia (automotive)

143. American Home Shield (home insurance)

144. Rover (Dog & Cat Care)

145. Certified Financial Planner Board of Standards (CFP)

146. REI (outdoors equipment)

147. Fiverr (freelancer marketplace)

148. St. George's University

149. John F. Kennedy Center for the Performing Arts in Washington, D.C.

150. Best Buy (retail)

151. JCPenny (retail)

152. Innovation Refunds

153. Bryant University

154. Voomly (video software)

155.  Regent Seven Seas Cruises

156.  NSM Insurance Group Inc (americancollectors.com/protect-community-classic)

157.  Designer Shoe Warehouse (DSW) store chain

158.  Invesco investment management

159. ThermoFisher (scientific lab equipment)

160. JCrew (retail)

161.  Water Country USA

162.  MassMutual Life Insurance

163.  ADP (payroll software)

164.  Cox Business Fiber Internet

165.  United Services Automobile Association (USAA)

166.  James Hardie Industries (cement & construction)

167.  Realtor.com

168. Serta Mattresses

169. Mazda

170. Charles Tyrwhitt Shirts

171. Grammarly

172. Coach (luxury fashion)

173. Solar Estimate (solar-estimate.org)

174. Wearfigs.com

175. Mercedes Benz

176. Ashley Furniture (ashleyfurniture.com)

177. Adultbunkbeds.com

178. Honda

179. Silver Sea Cruises

180. Land Rover

181. Dahan Electric

182. Maxeon (Solar Power)

183. Lucas Film

184. Atera Networks

185. Nassau Paradise Island, Bahamas (nassauparadiseisland.com)

186. University at Albany

187.  Western Governors University

188. University of Phoenix (Apollo Education Group, Inc.)

189. Astound Broadband

190. Genesis Motor (owned by Hyundai)

191. Maserati

192. Withings.com

193. Agent Image (agentimage.com – real estate marketing)

194. Day's Jewelers

195. Fuel Safe

196. University of St. Augustine for Health Sciences

197. Farfetch.com (clothing)

198. Living Spaces (livingspaces.com)

199. Mississippi State University

200. Brookfield Properties (apartment rentals)

201. Universal Windows Direct

202. GAF, a Standard Industries company (North America's largest roofing and waterproofing manufacturer)

203. Protelo (enterprise software reseller)

204. Pancake Pillow

205. DaySmart Vet (Veterinary Management Software) https://www.daysmartvet.com/upgrade-your-veterinary-practice?utm_campaign=Video-Remarketing

206. Octopusapp Inc.

207. Cambium Learning Group, Inc. (explorelearning.com)

208. Bingo tag-less dog collar (Bingotugless.com)

209. Amberton University in Texas

210. Inbox Health, Inc. (goinboxhealth.com)

211. Auberge Resorts LLC

212. McNichols Company (supplier of specialty metals and fiberglass)

213. Opera (Browser)

214. Evoto.ai

215. Ottobock

216. North Texas Tollway Authority (getmytolltag.com)

217. Apex Advisors (apexadvisorsinc.net/services/financial-planning-and-analytics)

218. Insight Global (insightglobal.com – staffing services for energy sector)

219. Connections Academy by Pearson

220. Taft University (taft.edu)

221. Start Barrier (startsafety.com)

222. Masonite International Corporation (exterior doors)

223. Techo-Bloc Corp (Construction supplies store)

224. Angel Flight West (network of volunteer pilots provide free medical transportation to people in need)

225. Floor and Decor Outlets of America (flooranddecor.com)

226. Local Reporting Lab Initiative Inc – Boulder Colorado Reporting Lab (boulderreportinglab.org)

227. Longmont Public Media

228. Christy Sports (ski and snowboards in Colorado)

229. Sports Clips (haircuts)

230. Kensington Tours Ltd

231. Vans (shoes; part of VF Corporation)

232. Blue Square Manufacturing (pool equipment manufacturer headquartered in Chandler, Arizona)

233. Arizona State University

234. MarineMax Inc (boat marinas)

235. Long Fence & Home / Long Roofing - Long Home Products

236. Watches of Switzerland Limited Company (Mappinandwebb.com)

237. Avalarea, Inc. (Tax Compliance Software)

238. wallaroo.ai (machine learning app)

239. Right Networks (cloud provider)

240. Kenny Products Inc. (badge accessories)

241. HelloProject USA LLC – a house and bathroom remodeling service

242. Car Donation Foundation (wheelsforwishes.org)

243. Absa Bank

244. Outsurance (Pet insurance)

245. 3T Software Labs GmbH (studio3t.com)

246. Canva (Australian graphics design software)

247. Shopee (Singaporean e-commerce firm)

248. MediaMarkt (German multinational chain of stores selling consumer electronics)

249. Teambank easyCredit (German financial services)

250. Inspirato (luxury vacations)

251. CGIS – valves and automation

252. Bell Canada Enterprises (telecoms)

253. Skyscanner

254. Super Brand Tools (SuperToughTape)

255. True Classic (trueclassictees.com; shirts)

256. Persefoni AI

257. Carousell Singapore (online marketplace)

258. Singtel (Singapore Telecommunications Limited)

259. DBS Bank (Singaporean multinational bank)

260. Vortex Co., Ltd. (vortex-net.com; Japan)

261. Levtech.jp

262. Meiko Network Japan

263. E-sales.jp (Softbrain Co., Ltd.)

264. Rakuten (Japanese mobile telecoms provider)

265. MetaLife (metalife.co.jp)

266. Fitness World A/S - Puregym.dk (gym network in Denmark)

267. Ikea (Swedish furniture company)

268. Vinduesgrossisten A/S (Danish company)

269. ABAX – GPS tracking hardware solutions

270. Hedrin (shampoo brand, part of Stada)

271. TIP Group (Truck transportation)

272. Xometry (industrial parts marketplace)

273. Akvatur ApS (Danish kitchen components)

274. WR Technologies AG (wandern.post.ch)

275. Radio SRF 3 – (srf.ch/radio-srf-3; Swiss radio broadcaster)

276. Xplorer Beast (bikes) – miloo.com/de/xplorer

277. Switzerland Tourism (myswitzerland.com)

278. Scolution.de (German software consultancy)

279. Ouigo.com (French train service, SNCF; French National Railway Company)

280. Ecosia.org (search engine)

281. Belkins Agency (lead generation advertising agency; belkins.io)

282. My CRM Manager (Sage Software)

283. Rogers Communications (Canadian communication and media company)

284. AJ Tek Corporation in Ontario, Canada

285. Fortinent (waf-security.com) (cybersecurity company)

286. Caterpillar Inc. (American construction equipment manufacturer) – observed running Performance Max ads

287. Questrade Financial Group (QuestMortgage)

288. The Source Electronics – Canadian consumer electronics and cell phone retail chain; ad placed by Accuen (Omnicom Media Group’s programmatic agency)

289. G adventures – See Costa Rica (travel)

290. Korea Tourism Organization (english.visitkorea.or.kr)

291. Vimeo (video platform)

292. Bulgari (luxury goods brand)

293. Ontario Motor Vehicle Industry Council

294. Spot.io by NetApp (cloud software optimization)

295. “UK Business Centre” – an economic development initiative. initiative is “conducted by Nord France Invest alongside the British Chamber of Commerce and Industry of Lille and with the support of the UK Department of Business and Trade

296. Safina.eu – Metal powers for additive manufacturing in the Czech Republic

297. Brother Industries (Japanese multinational electronics and electrical equipment company)

298. MG600 E Bike - Hong Kong Shushu Electronic Commerce Co., Ltd.

299. NorthC Datacenters – northcdatacenters.com

300. Nomoko.world – Swiss company - photorealistic 3D data

301. World Gold Council – gold.org

302. Ultimate Tennis Showdown

303. Verivox (verivox.de) – part of ProSiebenSat.1 Media – German mass media & digital company

304. C reditas (Brazilian fintech)

305. Disney+ & OnePass TV streaming bundle in Australia - onepass.com.au/bundles/onepass-disneyplus-bundle  - Wesfarmers OnePass Pty Ltd (Australia)

306. Pedders Suspension & Brakes (Australian automotive parts firm) – ads placed by Dentsu Amplifi Australia)

307. Cricut – smart cutting machines

308. beIN SPORTS Australia (part of beIN Media Group)

309. Springers Solar Australia - springers.com.au - Springer Consulting Services Proprietary Limited Australia

310. Great Southern Bank Australia - greatsouthernbank.com.au/home-loans/saving-for-a-deposit– ad placed by Dentsu Amnet

311. Bizdify – Remove News – Australian Reputation Management

312. Lorna Jane (Australian sports clothing)

313. Il Globo TV - Serie A & B – ilglobo.com

Ad for AutoRescule Tool being served on the “made for kids” YouTube video titled “VEGETABLES for kids 🍊🥝🍉 Can you name ALL of the different vegetables? Miss Ellis”, on the YouTube Channel “Love2Learn with Miss Ellis” - https://www.youtube.com/@Love2Learn. The rescue tool ad includes pictures of automobile drivers stuck in submerged or sinking cars.

Ad for the personal injury law firm Rothenberg being served on the “made for kids” YouTube video titled “Dinosaurs Showdown! T-Rex Ranch Dinosaur Videos”, on the YouTube Channel “T-Rex Ranch - Dinosaurs For Kids” - https://www.youtube.com/@TRexRanch. The law firm ad includes pictures of car crashes and medical injuries.

Ad for the personal injury law firm Rothenberg being served on the “made for kids” YouTube video titled “Dinosaurs Showdown! T-Rex Ranch Dinosaur Videos”, on the YouTube Channel “T-Rex Ranch - Dinosaurs For Kids” - https://www.youtube.com/@TRexRanch. The law firm ad includes pictures of car crashes and medical injuries.

Screenshot of an ad for Viacom International Inc. owned Paramount+ TV show “Special Ops: Lioness” showing on a “Made for Kids” YouTube video titled: “Here We Go Up | COCOMELON | Kids Songs | Nursery Rhymes | Sleep Baby Songs”. The particular TV show is rated “TV-MA”, meaning it is only intended for “mature audiences”. Children aged 17 and younger should not view programs that are rated “TV-MA’.

Pre-roll ads for the Jerry Seinfeld performance in Las Vegas tickets (sold by TicketMaster.com) served on a YouTube video titled: "Depression For Kids & Teens | Mental Health Treatment For Low & Depressed Mood-Overcoming Sadness".

Pre-roll ads for freecaseevals.com Personal Injury Lawyers being served on a YouTube video titled: "Depression For Kids & Teens | Mental Health Treatment For Low & Depressed Mood-Overcoming Sadness".

Ad for Sunrise Senior Living being served on the “made for kids” YouTube video titled “Wheels on the Bus – Baby songs – Nursery Rhymes & Kids Songs”, on the YouTube Channel “MyLittleBabySongs” - https://www.youtube.com/@MyLittleBabySongs

Ad for “forthepeople.com” – Morgan & Morgan injury law firm – being served on a “made for kids” YouTube video.

Ad for Fidelity Investments – being served on a “made for kids” YouTube video.

YouTube ads for Comcast Xfinity being served on a “made for kids” YouTube channel

Ad for Best Buy being served on a “made for kids” YouTube channel.

Louis Vuitton ad being served on a YouTube “made for kids” channel

Verizon ad being served on a YouTube “made for kids” channel 

Amazon Blink video ad serving on the “Gracie’s Corner” “made for kids” YouTube channel. The ad was served on the video “Five Little Pandas”.

Screenshot of an ad for Disney+ “Guardians of the Galaxy – Volume 3” serving on a “made for kids” video. The “Guardians of the Galaxy” video is rated “PG-13”.

Media agencies and vendors whose clients’ ads were served on “made for kids” channels

Many major media agencies, media vendors, and Google Marketing Platform resellers, and their clients appeared to have ads served on “made for kids” YouTube videos.

These appeared to include:

· Matterkind/IPG (BMO Bank; Terminix termite control, Dyson vacuums)

· Within (independent media agency in New York City) – Nike ads

· S4 Capital / MightyHive (ads for QuestMortgage)

· Jellyfish and TRKKN Australia – full service provider for Google Marketing Platform in Australia – (ads for Cricut Australia)

· WPP – Xaxis + Headlight (Ford)

· WPP - Wavemaker - Netflix

· WPP – Mindshare (Volvo cars)

· WPP – Essence Global – (Purple.com mattress ads; Dell computer ads)

· WPP – GroupM - thesupermariobros.movie – NBC Universal

· Omnicom Group (PhD Media – audioffers.com)

· Accuen – Omnicom Group’s programmatic media agency (ads for The Source Electronics)

· Havas – (BNP Paribas)

· Omnet – Planet Fitness

· OMD – Mercedes Benz USA

· Dandelion – Glidden paint ads

· Publicis Media - (ouigo.com SNCF train ads)

· Media IQ - (Louisiana Tourism, LG dishwashers)

· Marketing Direct Inc. - Infor (running Performance Max campaigns via Marketing Direct Inc. advertising agency)

· Dentsu - (Telus ads)

· Dentsu Amnet - (Absa Bank, General Motors, Great Southern Bank)

· DentsuX Inc. - (themobileshop.ca)

· Dentsu Amplifi Australia – (Pedders Suspension & Brakes)

· Horizon Media - (Seaworld Orlando, GreatWolf, Water Country USA)

· Vayner Media - (agency for Bose headphones, Connections Academy by Pearson)

· Canvas - (Hyundai)

· Croud

· Rise Interactive Media & Analytics, LLC - (Astound internet)

· Oxford Communications, Inc. – (ETS.org)

· Hoffman Lewis (H&L Partners) - (AAA)

· BH Media Group, a unit of Berkshire Hathaway - (ad for Tidewater Community College)

· Madwire, LLC – (Apexadvisorinc.net)

· War Room Inc - (Vancouver - warroominc.com) (CGIS – valves and automation)

· XPETO – Canadian Programmatic Trading Desk - (mint.ca)

· Targetcast LLC (part of Stagwell) – (Lenovo.com)

· EMG Media & Marketing - (cirquedusoleil.com)

· A-Z Mobile Apps - (ads for freecaseevals.com – personal injury lawyers)

· Ejam Inc (Performance marketing agency in California) - (Cleanomic)

· Belkins Agency (running ads promoting its own lead generation services)

An ad for QuestMorgage on a “Made for Kids” video titled: “Booba 🙃 Best Episodes Collection ⭐ Most Interesting Cartoons 💚 Moolt Kids Toons Happy Bear⭐”. The ad was served pre-roll on the “made for kids” YouTube channel: “Moolt Kids Toons Happy Bear”. The source code of the ad shows that is uses a Campaign Manager 360 tracking pixel from Mighty Hive, which is owned by S4 Capital.

Screenshot of an ad for the General Motors brand “Chevrolet” being served on the “made for kids” YouTube video titled: “LEO and TIG 🦁 🐯 NEW 🌌 The Cheerful Cassowary 🦃 Cartoon For Children 💚 Moolt Kids Toons Happy Bear”, on the “made for kids” YouTube channel: “Moolt Kids Toons Happy Bear”.

An ad for Terminix termite swarms control being served on a “Made for Kids” video titled: “Spiderman The Movie! Kids Fun TV Spider-Man Compilation Video!”. The ad was served pre-roll on the “made for kids” YouTube channel: “Kids fun TV”. The source code of the ad shows that is uses a Campaign Manager 360 tracking pixel from IPG Matterkind advertising agency.

An ad for LG dishwashers being served on a “Made for Kids” video titled: “Chocolate Factory | Virtual Field Trip | KidVision Pre-K”. The Campaign Manager tracking pixel suggests the ad was placed via the media agency MIQ.

An ad for the mattress company Purple served on a “Made for Kids” video titled: “Spiderman The Movie! Kids Fun TV Spider-Man Compilation Video!”. The “My Ad Center” information modal shows the ad was placed by the media agency “Essence Global Inc”.

An ad for Quality.innovationrefunds.com serving on a “made for kids” YouTube channel, with an IPG Matterkind Campaign Manager pixel.

An ad for Mercedes Benz USA serving on “made for kids” video titled: “Vlad and Niki and new useful stories for kids about behavior and friendship”. A Campaign Manager pixel registered to OMD is visible in Chrome Developer Tools’ network tab.

An ad for Planet Fitness serving on the “made for kids” video titled “Wheels on the Bus - Baby songs - Nursery Rhymes & Kids Songs”. The Campaign Manager tracker pixel indicates the ad was served via “OMNETMEDIAGROUP”, which is likely Omnicom media agency.

Screenshot of an ad for Bose headphones serving on a “Made for Kids” YouTube video, wherein the “Why this ad?” section shows the ad was placed by Vayner Media.

Screenshot of an ad for Ford Mustang cars serving on a “Made for Kids” YouTube video, wherein the Chrome Developer Tools’ network tab shows a Campaign Manager pixel from Xaxis Headlight.

Screenshot of an ad for Telus home security serving on a “Made for Kids” YouTube video, wherein the Chrome Developer Tools’ network tab shows a Campaign Manager pixel Dentsu.

Screenshot of an for Tidewater Community College being served on a “made for kids” YouTube video, wherein the “Why this ad?” section shows the ad was placed by BH Media Group Inc.

Screenshot of an for Infor software being served on a “made for kids” YouTube video, wherein the “Why this ad?” section shows the ad was placed by Marketing Direct Inc.

Screenshot of a YouTube pre-roll for Belkins Agency lead generation, serving on the “Made for Kids” YouTube video titled: “Booba 🙃 Best Episodes Collection ⭐ Most Interesting Cartoons 💚 Moolt Kids Toons Happy Bear⭐”. The ad was served on the YouTube channel titled: “Moolt Kids Toons Happy bear”.

Advertisers may be inadvertently collecting & sharing data about children

Google’s Advertising Policies state that “advertising […] on content set as made for kids must […] otherwise attempt to collect personal information without first obtaining parental consent”.

Source: Google’s Advertising Policies

However, despite Google’s Advertising Policies, it appears that many advertisers have not configured their websites in a way that would anticipate young children visiting their sites. Specifically, many advertisers’ whose ads were observed being served on “made for kids” channels were observed setting ad targeting and tracking cookies on the consumer’s device upon the user visiting their webpages. These websites did not appear to ask for parental consent before setting tracking cookies on the user’s device.

This would suggest that, if a child were to inadvertently or accidentally click an ad from one of these advertisers while watching a “made for kids” video on YouTube, the website of the advertiser would be opened and set ad tracking and targeting identifiers on the child’s device.

As an example, one can see in the next few screenshots how an ad for Verizon was served on a “made for kids” channel. If a child or toddler accidentally clicked on the ad, their phone or computer opens the Verizon.com website. Verizon’s website is configured to set tracking and ad targeting cookies, as well as transmit some of those user identifiers to dozens of third parties. While Verizon itself may not be fully aware that it has children watching and clicking its ads on “made for kids” YouTube channels, Verizon’s website appears to track and share meta-data about these putative children.

Screenshot showing an ad for Verizon on the YouTube video “I've Got a Boo Boo! | Sing Along with Bebefinn | Healthy Habits | The Boo Boo Song”, on the “made for kids” channel titled “Bebefinn - Nursery Rhymes & Kids Songs”

If the viewer of this “made for kids” YouTube channel clicks on the video ad, the viewer’s device will open the Verizon website. Using the Chrome browser’s Developer Tools’ “Network” tab allows one to inspect and archive the internet traffic sent into and out of the browser while the former visitor of the “made for kids” YouTube channel peruses Verizon.com. Verizon’s website does not ask for informed parental consent before setting these cookies or persistent user identifiers on the computer or phone of the viewer of the “made for kids” YouTube content where the ad served.

Screenshot of verizon.com, showing various third party tracking pixels and code transmitting cookies and various unique persistent user identifiers. The screenshot on the right has Chrome Developer Tools open, with HTTPS traffic filtered exclusively for requests that go to third party domains such as facebook.net, tiktok.com, and others.

Sankey diagram from PageXray, illustrating how Verizon.com shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Bebefinn - Nursery Rhymes & Kids Songs”. Verizon’s website does not ask for informed parental consent before sharing these identifiers with third parties.

Exporting and visualizing this network traffic (as an HTTP Archive .HAR file) reveals that Verizon.com contacted over 31 different ad trackers and set 44 different third party cookies while the viewer of the “made for kids” YouTube channel was visiting Verizon.com. These trackers and cookies belong to several different American and foreign ad tech platforms and data brokers, including:

·   The Trade Desk Inc

·   Telaria

·   SpotX, Inc.

·   Amazon

o  Amazon agreed to pay the FTC a $25 million penalty as well as “overhaul its deletion practices and implement stringent privacy safeguards” to settle charges that Amazon had violated COPPA

·   Adobe

·   Pinterest

·   OpenX Technologies Inc

o  OpenX was previously fined $2 million by the Federal Trade Commission “for collecting personal information from children in violation of children’s privacy law”

·   LiveRamp Holdings, Inc.

·  eyeota Limited

·  Oracle Corporation

·  Innovid Media

·  Conversant LLC

o Conversant’s owner – Epsilon Data Management LLC – agreed to pay $150 million to settle criminal charges “for facilitating elder fraud schemes”. Conversant LLC is owned by Publicis Groupe.

·  IPONWEB GmbH

·  PubMatic, Inc.

·  Alphabet, Inc.

·  Kenshoo TLD

·  TVSquared

·  Magnite, Inc.

·  Index Exchange, Inc.

·  Microsoft Corporation

o Microsoft was previously fined $20 million for “its practices for collecting and retaining personal information from children”

· Adobe Inc.

·  Verizon Media

o A Verizon owned subsidiary previously paid $5 million to settle charges that it had “place targeted display ads on hundreds of websites that it knew were directed to children”

·  Facebook, Inc.

o Meta was previously “fined $400 Million for Failing to Protect Children's Privacy on Instagram”

·  Pulsepoint, Inc.

·  AdRoll, Inc.

·  Media.net Advertising FZ-LLC.

The Markup’s Blacklight inspection tool, showing that Verizon.com contacts 31 different ad trackers and sets 44 different third party cookies

__________________________________________________________________________________________

As another example, one can observe an ad for Disney+ being served on a “made for kids” channel.

An ad for Disney+ served on the YouTube video titled: “Learn Addition up to 10 | Addition 1 to 9 | Math for Kindergarten & 1st Grade | Kids Academy”, as part of the “Kids Academy” YouTube channel.

If the viewer of this “made for kids” channel clicks on the Disney+ ad, the viewer’s phone or computer will open the disneyplus.com website.

Screenshot of disneyplus.com, showing various third party tracking pixels and code transmitting cookies and various unique persistent user identifiers without asking for parental consent for the viewer who clicked on an ad on a YouTube “made for kids” video. The screenshot on the right has Chrome Developer Tools open, with HTTPS traffic filtered exclusively for requests that go to third party domains such as facebook.net, tiktok.com, and others.

The disneyplus.com website can be observed contacting numerous ad tech and data broker domains without asking for informed parental consent, including those of TikTok, Twitter, Facebook, SnapChat, Microsoft, Oracle Bluekai, Adobe, Google, and Trade Desk.

Sankey diagram from PageXray, illustrating how disneyplus.com shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Kids Academy”. Disney+’s website does not ask for informed parental consent before sharing these identifiers with third parties.

___________________________________________________________________________________________

As a third example, an ad for Paramount-owned BET Network (co-branded with McDonald’s) was served on the “made for kids” video “Wheels on the Bus – Baby songs – Nursery Rhymes & Kids Songs”, which is hosted on the YouTube channel “My Little Baby Songs”.

Screenshot showing an ad for Paramount-owned BET.com on the child-directed video “Wheels on the Bus – Baby songs – Nursery Rhymes & Kids Songs”, which is hosted on the YouTube channel “My Little Baby Songs”.

If a viewer of this “made for kids” directed video clicks on the Paramount BET ad, the viewer’s device will open the bet.com website. The website proceeds to set and share cookies and persistent user identifiers without asking for informed parental consent.

Screenshot of the bet.com website, with Chrome Developer Tools’ Network tab open and showing various third party trackers and identifiers being set. The website does not ask for informed parental consent before setting such identifiers on the device of a viewer who arrived at the site after clicking an ad on a “made for kids” YouTube channel.

The BET.com site was observed setting cookies or sharing user meta-data about the viewer of the “made for kids” YouTube channel who clicked on the BET ad with the following ad tech and data brokers:

·  Salesforce.com, Inc.

·  YieldMo, Inc.

·  Beachfront Media LLC

·  TripleLift

·  Teads ( Luxenbourg ) SA

·  OpenX Technologies Inc

·  GumGum

·  Simplifi Holdings Inc.

·  RhythmOne

·  PubMatic, Inc.

·  FreeWheel

·  Tapad, Inc.

·  IPONWEB GmbH

·  Merkle Inc

·  Sharethrough, Inc.

·  Amazon Technologies, Inc.

·  The Trade Desk Inc

·  Narrative I/O, Inc

·  Media.net Advertising FZ-LLC

·  Outbrain

·  Integral Ad Science, Inc.

·  LiveIntent Inc.

·  Conversant LLC

·  Alphabet, Inc.

·  Verizon Media

·  Unruly Group Limited

·  Smaato Inc.

·  Amobee, Inc

·  LiveRamp Holdings, Inc.

·  Sovrn Holdings

·  Parsely, Inc.

·  Quantcast Corporation

·  Magnite, Inc.

·  Pulsepoint, Inc.

·  Neustar, Inc.

·  MediaMath, Inc.,

·  Centro, Inc.,

·  Undertone Networks,

·  Twitter, Inc.

·  The Nielsen Company,

·  Microsoft Corporation

·  Nativo, Inc

·  Index Exchange, Inc.

·  Smartadserver S.A.S

·  Criteo SA

·  Skimbit LTD

·  ID5 Technology Ltd

·  Oracle Corporation

·  Appier

Screenshot from the Markup’s Blacklight tool showing third party ad tech vendors and data brokers who are contacted when the viewer of a “made for kids” YouTube channel clicks on an ad and opens the BET.com website on their device

Sankey diagram from PageXray, illustrating how bet.com shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Wheels on the Bus - Baby songs - Nursery Rhymes & Kids Songs”. The BET.com website does not ask for informed parental consent before sharing these identifiers with third parties.

___________________________________________________________________________________________

As a fourth example, an ad for car brand Hyundai was served on the “made for kids” video “Meet the Math Facts - Addition & Subtraction Level 1 (FREE) | Preschool Prep Company”, which is hosted on the “made for kids” YouTube channel “Preschool Prep Company”.

Screenshot showing an ad for Hyundai cars on the “made for kids” video “Meet the Math Facts - Addition & Subtraction Level 1 (FREE) | Preschool Prep Company”, which is hosted on the “made for kids” YouTube channel “Preschool Prep Company”.

If the viewer of the “made for kids” video clicks on the Hyundai video ad, the viewer’s device will open the website hyundaiusa.com in a browser, which immediately proceeds to collect and share meta-data about the user with companies such as TikTok.

Screenshot of the hyundai.com website, with Chrome Developer Tools’ Network tab open and showing various third party trackers and identifiers being set. The website does not ask for informed parental consent before setting such identifiers on the device of a viewer who arrived at the site after clicking an ad on a “made for kids” YouTube channel.

The Hyundaiusa.com website is observed setting various 3rd party tracker and scripts, even before the consumer has a chance to interact with the Cookie consent module that appears at the bottom of the screen. The consent banner does not ask for informed parental consent before setting these cookies and trackers on the device of the viewer of the “made for kids” YouTube channel.

Sankey diagram from PageXray, illustrating how hyundaiusa.com shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Preschool Prep Company”. The hyundaiusa.com website does not ask for informed parental consent before sharing these identifiers with third parties.

Screenshot from the Markup’s Blacklight tool showing third party ad tech vendors and data brokers who are contacted when the viewer of a “made for kids” YouTube channel clicks on an ad and opens the BET.com website on their device

Hyundai’s website was observed sharing meta-data about the viewer of the “made for kids” YouTube channel with numerous third parties, including: Snap Inc., LiveRamp Holdings, Inc., Merkle Inc, Neustar, Inc., Oracle Corporation, Adobe Inc., Microsoft Corporation, Index Exchange, Inc., Valassis Digital, Dstillery Inc., KBM Group LLC, Navegg S.A., 33Across, Inc., Alphabet, Inc., Verizon Media, Tapad, Inc., Bombora Inc., eyeota Limited, Facebook, Inc., Tealium Inc., IPONWEB GmbH, The Trade Desk Inc, Magnite, Inc., Flashtalking Inc, Twitter, Inc., and Lotame Solutions, Inc. ___________________________________________________________________________________________

As a fifth example, an ad for Disneyland amusement park was served on the “made for kids” YouTube video “12 Days of Christmas! | 2 HOUR CHRISTMAS CoComelon Nursery Rhymes” on the “made for kids” YouTube channel “Moonbug Kids - Fun with Friends!”.

Screenshot showing an ad for Disneyland on the “made for kids” video “12 Days of Christmas! | 2 HOUR CHRISTMAS CoComelon Nursery Rhymes” on the “made for kids” YouTube channel “Moonbug Kids - Fun with Friends.

If the viewer of the “made for kids” YouTube video clicks on the Disneyland video ad, the viewer’s device will open the website disneyland.disney.go.com in a browser, which immediately proceeds to collect and share meta-data about the user with companies such as Facebook, Google, and TikTok. The disneyland.disney.go.com website proceeds to set and share cookies and persistent user identifiers without asking for informed parental consent.

Screenshot of disneyland.disney.go.com, showing various third party tracking pixels and code transmitting cookies and various unique persistent user identifiers without asking for parental consent for the viewer who clicked on an ad on a YouTube “made for kid” video. The screenshot on the right has Chrome Developer Tools open, with HTTPS traffic filtered exclusively for requests that go to third party domains such as facebook.net, tiktok.com, and others.

Sankey diagram from PageXray, illustrating how disneyland.disney.go.com shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Preschool Prep Company”. The hyundaiusa.com website does not ask for informed parental consent before sharing these identifiers with third parties.

The disneyland.disney.go.com website was observed setting cookies or sharing user meta-data about the viewer of the “made for kids” YouTube channel who clicked on the Disneyland ad with the following ad tech and data brokers:

·  Resonate Networks

·  Neustar, Inc.

·  Facebook, Inc.

·  MediaMath, Inc.

·  Index Exchange, Inc.

·  Magnite, Inc.

·  Adobe Inc.

·  Snap Inc,

·  The Trade Desk Inc

·  Verizon Media

·  Twitter, Inc.

·  Microsoft Corporation

·  Alphabet, Inc.

·  Oracle Corporation

·  IPONWEB GmbH

·  Amazon

Screenshot from the Markup’s Blacklight tool showing third party ad tech vendors and data brokers who are contacted when the viewer of a “made for kids” YouTube channel clicks on an ad and opens the disneyland.disney.go.com website on their device

___________________________________________________________________________________________ As a sixth example, an ad for NBCUniversal’s “The Super Mario Bros” movie (which appears to have been placed by the GroupM media agency) was served on the “made for kids” YouTube video “Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs” on the “made for kids” YouTube channel “Moonbug Kids - Fun with Friends!”. If a viewer of this “made for kids” video clicks on the ad that was placed by GroupM and navigates to `thesupermariobros.movie/watch-at-home`, the website (which appears to be operated by NBC Universal based on a WHOIS domain registrar lookup), sets various ad targeting cookies and persistent identifiers on the user’s device.

An ad for The Super Mario Bros movie was served on the “made for kids” YouTube video “Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs” on the “made for kids” YouTube channel “Moonbug Kids - Fun with Friends!”.

Screenshot of NBCUniversal’s website - https://www.thesupermariobros.movie/watch-at-home/ after a viewer of a “made for kdis” YouTube video clicks an ad and navigates to the website.

Sankey diagram from PageXray, illustrating how NBCUniversal’s thesupermariobros.movie website shares data and communicates with third party ad tech and data broker domains after being visited by the viewer of an ad on a “made for kids” YouTube channel such as “Moonbug Kids - Fun with Friends!”. NBCUniversal’s thesupermariobros.movie website does not ask for informed parental consent before sharing these persistent identifiers with third parties.

The NBCUniversal thesupermariobros.movie website was observed setting cookies or sharing user meta-data about the viewer of the child-directed YouTube channel who clicked on the Disneyland ad with the following ad tech and data brokers:

·   Index Exchange, Inc.

·   ByteDance Ltd.

·   iSpot.tv

·  The Trade Desk Inc

·  Alphabet, Inc.

·  Twitter, Inc.

·  Microsoft Corporation

·  Tapad, Inc.

·  Snap Inc.

·  Facebook, Inc.

·  IPONWEB GmbH

·  Verizon Media

·  Reddit Inc.

·  4Cite Marketing

·  PubMatic, Inc.

Per The Markup’s Blacklight website inspector tool - the NBCUniversal thesupermariobros.movie website appears to use Google Analytics and seems to use its ”remarketing audiences” feature that enables user tracking for targeted advertising across the internet.

Screenshot from the Markup’s Blacklight tool showing third party ad tech vendors and data brokers who are contacted when the viewer of a “made for kids” YouTube channel clicks on a GroupM placed ad and opens NBCUniversal’s thesupermariobros.movie website on their device.

___________________________________________________________________________________________

Below is a sample meta-analysis showing how much data various YouTube advertisers may be collecting and sharing with third party ad tech and data brokers when the viewer of a child-directed YouTube video clicks on an ad and visits their websites. For example, if the viewer of a child-directed YouTube video sees and clicks on a Verizon ad, Verizon’s website is configured to send about 6.48 MB worth of data to 112 different third party domains, many of which are ad tech vendors or data brokers such as Facebook, TikTok, or Trade Desk. In all observed cases, the advertisers’ website did not appear to be configured to ask for informed parental consent collecting and sharing data on the viewer of the child-directed YouTube video who had clicked on their ads.

Data table showing a sample of YouTube advertiser websites and their data sharing behaviors. Each of the above advertisers was confirmed to be serving ads on child-directed YouTube videos, and not asking for informed parental consent before collecting and sharing meta-data about the viewers of the child-directed YouTube videos.

While some of the data brokers that these advertisers aresharing data with appear to be registered in the United States, there are also several foreign data brokers – such as TikTok or Eyeota – who appear to be receiving data from these advertisers regarding the viewers of “made for kids” YouTube videos.

Advertisers who appear to avoid data collection and sharing about viewers of “made for kids” videos

While the previous section documents many instances where advertisers’ websites appear to collect and share data about viewers of “made for kids” videos who had clicked on an ad, there were a small number of advertisers who appear to have properly anticipated that viewers of “made for kids” content may be visiting the brands’ websites. This small subset of advertisers appear to have configured their websites in a way that reduces or avoids collecting and sharing data about potential children.

The Danish plastic construction toys brand Lego had many of their ads served on “made for kids” videos. For example, in the screenshot below, one can observe an ad for Lego served on the “made for kids” YouTube video titled: “The Big Bang Theory for Kids | Learn about this theory for how the universe began”. The video is on the “made for kids” YouTube channel: “Learn Bright.”

Screenshot of a Chrome browser showing pre-roll ads for Lego serving on the “made for kids” YouTube video titled: “The Big Bang Theory for Kids | Learn about this theory for how the universe began”. The video is on the “made for kids” YouTube channel: “Learn Bright.”

The clickthrough URL for the particular Lego Pre-Roll video ad is: https://www.lego.com/en-us/kids/campaigns/disney/making-wonder/.

Screenshot of the lego.com website. The Chrome developer tools network tab on the right side of the screen shows that the lego.com website does not appear to initiate HTTPS request to third party ad tech or analytics domains such as Google Analytics or Facebook Pixel.

Analyzing the source code of this Lego.com clickthrough URL shows that the Lego.com website does not appear to use Google Analytics or share advertising related meta-data about the viewer with third parties.

For example, the network Sankey diagram from PageXRay below shows that lego.com does not initiate HTTPS requests to third party ad tech domains or endpoints.

Screenshot of a HTTPS request network Sankey diagram from PageXRay. The diagram shows that lego.com does NOT initiate HTTPS requests to ad serving or tracking domains, such as Google Analytics or Facebook Pixel.

Analyzing the lego.com website with The Markup’s Blacklight tool also demonstrates that there are no ad trackers, Google Analytics, or Facebook Pixel on the lego.com website. The only third party cookies set on the consumer’s browser upon visiting this website are those related to performance or functionality monitoring (distinct from advertising-purpose cookies).

Screenshot of The Markup’s Blacklight tool for the website lego.com. The tool shows that the lego.com website does not use Google Analytics, does not use Facebook Pixel, and does not have any ad trackers configured on the website.

Ad tech vendors and data brokers may be inadvertently collecting & sharing data about children

Which ad tech platforms or data brokers are likely the largest recipients of data from the viewers of child-directed YouTube videos who had clicked on a YouTube ad?

As mentioned in the earlier section, many advertisers do not appear to configure their websites in anticipation of children visiting their sites. Many of the advertisers’ websites set persistent cross contextual unique identifiers (such as ad targeting cookies) on the user’s device upon the user visiting their webpages following clicking a YouTube ad (on a ‘made for kids’ channel), and do not ask for informed parental consent before doing so.

These advertiser websites share data with 3rd parties such as Facebook or TikTok, who were observed either collecting meta-data about the user (who in this case, could likely be a child) or setting persistent data on the putative child’s device.

Analysis of network traffic and cookies being set upon visiting some of the advertiser websites mentioned in the previous two sections revealed user meta-data sharing, tracking, and identifiers being set by the following ad tech vendors and data brokers. This analysis is predicated upon a sample of fifty different advertisers, for whom:

·  The advertiser was confirmed to have served ads on ‘made for kids’ YouTube videos

·  The advertiser was confirmed to not ask for informed parental consent before engaging in data tracking and sharing on the device of a viewer of a child-directed YouTube video ad clickthrough

·  The advertiser may not have been notified that it would be receiving presumed-child-created data

The sample of 50 advertisers included many large brands, such Ford, Verizon, Disney, Hyundai, Paramount, Adobe, and Samsung.

Which ad tech platforms or data brokers are likely the largest recipients of data from the viewers of child-directed YouTube videos who clicked on an ad? This data table shows that – out of a sample of 50 YouTube advertisers whose ads ran on ‘made for kids’ channels, 98% of YouTube advertiser websites generate and transmit meta-data to Google for advertising purposes, without asking for parental consent.

The analysis shows many different ad tech and data broker vendors are likely receiving meta-data about the viewers of child-directed YouTube videos who clicked on ads. For example, 98% of advertiser websites in the sample were observed as transmitting meta-data about the viewers of child-directed YouTube video ad clickers to Google.

78% of advertisers were transmitting data about the viewers of child-directed YouTube video ads to Facebook and Microsoft, while 48% of sites transmitted data to Trade Desk. 28% of advertisers in the sample transmitted meta-data about users who clicked on ads on YouTube child-directed videos to TikTok.

Some of the recipients of this data about users who clicked on ads on child-directed YouTube videos appear to be entities that had previously paid fines or settlements related to alleged COPPA violations:

·  Google and YouTube agreed to pay $170 million to settle allegations ”collected ‘kids’ personal information without parental consent”

·  Amazon agreed to pay the FTC a $25 million penalty as well as “overhaul its deletion practices and implement stringent privacy safeguards” to settle charges that Amazon had violated COPPA

·  OpenX was previously fined $2 million by the Federal Trade Commission “for collecting personal information from children in violation of children’s privacy law”

·  Microsoft was previously fined $20 million for “its practices for collecting and retaining personal information from children”

·  A Verizon owned subsidiary previously paid $5 million to settle charges that it had “placed targeted display ads on hundreds of websites that it knew were directed to children”

·  Facebook was previously “fined $400 Million for Failing to Protect Children's Privacy on Instagram”

Ad tech vendors and data brokers who may be harvesting Google’s own user identifiers

Many advertisers use Google Analytics on their websites to track conversions coming from YouTube ad campaigns. Google Analytics uses cookies and other systems to uniquely identify and differentiate individual users, for purposes of analytics, audience segmentation, ad conversion tracking, and in some cases – retargeting.

https://developers.google.com/analytics/devguides/collection/protocol/v1/parameters#cid

Google Analytics’ documentation references a “Client ID” parameter (“cid”), which is defined as:

“This pseudonymously identifies a particular user, device, or browser instance. For the web, this is generally stored as a first-party cookie with a two-year expiration. For mobile apps, this is randomly generated for each particular instance of an application install. The value of this field should be a random UUID (version 4) as described in http://www.ietf.org/rfc/rfc4122.txt.”

During the course of this research, it was observed that some external parties – other than Google and the advertiser itself – appeared to be making “copies” of these “cid” Client ID parameters.

For example, in the screenshots below, one can see an ad for Reddit for Business being served on a “made for kids” video. If the viewer of this video clicks on the ad, they are taken to the redditforbusiness.com website. On this website, the “cid” parameter is sent to Google Analytics. But another ad tech company called “MNTN” is also observed to be receiving copies of the “CID”.

It is unclear whether Reddit or Google are aware that “MNTN” appears to have in its possession copies of the individual consumer’s “client ID” parameter.

Advertisers’ expectations about YouTube channels for kids. Media buyers report that they want to avoid having their ads served on “made for kids” channels

Adalytics surveyed media buyers at both brands and media agencies, asking the buyers:

“Do you want to have your behaviorally targeted ads served on content that is specifically directed at young kids?” and “Please elaborate on your answer to the previous question.”

The majority of the media buyers indicated that they do not want their ads served on “made for kids” channels.

The surveyed media buyers’ responded, in free form text, that:

·   “The target audience on my brand are individuals 25-54 with a high household income because the product is expensive. Delivering targeted ads to children is not only ethically wrong but a complete waste of my budget.”

·    “No, I don’t want to be wasteful with my clients budget since children generally don’t make purchases”

·    "My brand assignment is focused on adult consumers and kids seeing some of our ads would be highly concerning."

·    “Wastage of media budget, plus unethical”

·    “These channels are primarily for kids, I am concerned about COPPA compliance. I also used data for targeting so I should not be on these channels anyway."

Media buyers report difficulties with avoiding “made for kids” channels

“We aim to use exclusion keyword lists with specific kids related keywords yet still see constant delivery on made for kids channels. I don’t understand the videos and channels have the words kids in them when we’re blocking that exact word.”

“Blocking kids channels is a constant and very manual game of whackamole. YouTube does not provide an option to opt out of made for kids channels. Media buyers like myself are forced to constantly scan site lists and remove kids channels after they’ve already seen delivery.”

“There doesn’t seem to be anyway to reliably block kids’ channels, despite trying to block keywords and categories related to children’s content. Kids’ stuff still shows up on my placement reports. The only way to block kids’ videos is blocking individual channels, but that’s very time consuming and becomes a never-ending task.”

"I have blocked some kid’s content by blocking keywords, categories and channels but this is not successful. Kids videos still show up. There are so many things to block, it becomes a game of whackamole."

“Only confident when using a Channel placement inclusion list”

Media buyers claim they want refunds for ad served on “made for kids” channels

Media buyers were asked: “If your brand's behaviorally targeted ads were served on "made for kids" YouTube channels - would you ask for a refund?”.

The majority of respondents said: “Yes – I would ask for a refund”.

Media buyers claim that YouTube makes it difficult to avoid having behaviorally targeted ads served on “made for kids” channels

Adalytics surveyed media buyers, asking: “Does YouTube make it easy to avoid having your brand's behaviorally targeted ads served on "made for kids" channels?”.

The majority of media buyers responded that: “No - it is NOT easy to avoid "made for kids" channels”.

Several of the media buyers explained in further detailed follow-ups:

·   “There doesn’t seem to be anyway to reliably block kid’s channels despite trying to block keywords and categories related to children’s content. Kids stuff still shows up on my placement reports. The only way to block kid’s videos is blocking individual channels but that’s very time consuming and becomes a never ending task.”

·    "Buyers have zero ability to turn off appearing in these types of placements. Mislabeling inventory in this way is fraud."

·    “Blocking kids channels is a constant and very manual game of whackamole. YouTube does not provide an option to opt out of made for kids channels. Media buyers like myself are forced to constantly scan site lists and remove kids channels after they’ve already seen delivery.”

·    "There isn't an option to select to avoid kids channels. Furthermore, using keywords like "kids" or "games" or "toys" etc. does not stop us from running on channels made for kids."

·    "Although targeting criterias are easy to select, we still have seen ads running on kids content, even if we blocklisted kids' age groups."

·    "I have to comb through the where ads are shown and exclude these individually”

·    "There's no explicit option that I've come across during set-up to avoid targeting kids channels."

·     "I have to manually add Baby focused channels to all of my campaigns."

·     "While we cannot target under 18, due to settings and profile information, it is still easy to reach a younger audience. I would be interested in how this could be prevented."

·      "You need to proactively research relevant and updated lists of Child Channels to exclude before launching campaigns."

·     "There are options to seemingly remove kids content or 3rd parties that enable channel lists, but it appears these aren’t enough."

Google and YouTube were observed setting ad personalization cookies & tracking viewers of “made for kids” YouTube videos

While many brands may not be aware that they are potentially harvesting and sharing meta-data about the viewers of “made for kids” YouTube video, there is one brand that may potentially have actual knowledge that this brand was setting ad personalization cookies and identifiers on the devices of viewers of “made for kids” videos.

This particular brand is Google and YouTube itself.

The screenshots below show that YouTube and Google serve ads for their own products on ‘made for kids’ channels. If a viewer of one of these ‘made for kids’ channels were to click on a given ad for one of Google or YouTube’s own products, the respective advertiser websites appear to set ad targeting cookies (like the IDE cookie) or put the consumer into “Google remarketing audiences”.

A Video ad for "YouTube TV - NFL Sunday Ticket" is observed being served on the 'made for kids' YouTube channel titled: "Moonbug Kids - Fun with Friends!" (Channel URL: https://www.youtube.com/@MoonbugKids_FunwithFriends). The specific YouTube video on which the ad was served is: "Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs" (video URL: https://www.youtube.com/watch?v=JWPS3WJw4Vo).

The URL for the YouTube TV NFL Sunday Ticket advertisement is: https://www.youtube.com/watch?v=JWPS3WJw4Vo.

If a baby or toddler viewing this 'child-directed' YouTube channels happens to click on the YouTube TV advertisement, their device will open the advertiser's website - tv.youtube.com/learn/nflsundayticket.

The advertiser's website (in this case, `tv.youtube.com/learn/nflsundayticket`), proceeds to set ad targeting cookies and to put the viewer of the child-directed YouTube Video into custom re-marketing audiences using Google Analytics.

Video ad for "YouTube TV - NFL Sunday Ticket" being served on the 'made for kids' YouTube channel titled: "Moonbug Kids - Fun with Friends!" (Channel URL: https://www.youtube.com/@MoonbugKids_FunwithFriends). The specific YouTube video on which the ad was served is: "Old MacDonald! | 2 HOUR CoComelon Nursery Rhymes and Kids Songs" (video URL: https://www.youtube.com/watch?v=JWPS3WJw4Vo). The URL for the YouTube TV NFL Sunday Ticket advertisement is: https://www.youtube.com/watch?v=JWPS3WJw4Vo.

Video ad for "YouTube TV - NFL Sunday Ticket" being served on the 'made for kids' YouTube channel titled: "Moonbug Kids - Fun with Friends!” The URL for the YouTube TV NFL Sunday Ticket advertisement is: https://www.youtube.com/watch?v=JWPS3 The advertiser's website (in this case, `tv.youtube.com/learn/nflsundayticket`), proceeds to set ad targeting cookies and to put the viewer of the child-directed YouTube Video into custom re-marketing audiences using Google Analytics.

The advertiser's website (in this case, `tv.youtube.com/learn/nflsundayticket`), proceeds to put the viewer of the child-directed YouTube Video into custom re-marketing audiences using Google Analytics.

Screenshot of The Markup’s Blacklight website privacy inspector tool, showing that the `tv.youtube.com` advertiser website appears to use Google “remarketing audiences” and track the user across the internet for ad targeting purposes.

The advertiser's website (in this case, `tv.youtube.com/learn/nflsundayticket`), proceeds to set ad targeting cookies.

Screenshot from Google’s privacy policy pages showing that the “IDE” cookies are used for ad targeting. ___________________________________________________________________________________________

As another example, in the screenshots below, “Google Chrome Enterprise” being served on the ‘made for kids’ YouTube channel “ChuChu TV Nursery Rhymes for Babies”. YouTube does not configure or set the “tag_for_child_directed” treatment parameter in Campaign Manager 360 to signal that the viewer of this ad was likely a child.

The Google Chrome Enterprise product page, where a privacy notice at the bottom left hand corner of the page says: “Google uses cookies to deliver its services, to personalize ads” (emphasis added). Developer Tools on the right half of the screenshot shows that the website is setting persistent, unique ad personalization cookies on the browser of the viewer of the “ChuChu TV Nursery Rhymes” video, without informed parental consent.

A video ad for “Google Chrome Enterprise” being served on the ‘made for kids’ YouTube channel “ChuChu TV Nursery Rhymes for Babies”. YouTube does not configure or set the “tag_for_child_directed” treatment parameter in Campaign Manager 360 to signal that the viewer of this ad was likely a child.

The Google Chrome Enterprise product page, where a privacy notice at the bottom left hand corner of the page says: “Google uses cookies to deliver its services, to personalize ads”. Developer Tools on the right half of the screenshot shows that the website is setting persistent, unique ad personalization cookies on the browser of the viewer of the “ChuChu TV Nursery Rhymes” video, without informed parental consent.

Screenshot from The Markup’s Blacklight tool, showing that Google’s Chrome Enterprise website “uses Google Analytics and seems to use its ”remarketing audiences” feature that enables user tracking for targeted advertising across the internet. This feature allows a website to build custom audiences based on how a user interacts with this particular site and then follow those users across the internet and target them with advertising on other sites using Google Ads and Display & Video 360.”

It is unclear why Google’s websites are configured to set ad personalization and targeting cookies such as the IDE cookie, or why these are putting users in Remarketing Audiences – without informed parental consent even though the user is arriving to the websites by clicking on an ad on a “made for kids” video.

As mentioned before, YouTube’s CEO wrote publicly in 2019 that YouTube “will treat data from anyone watching children’s content on YouTube as coming from a child, regardless of the age of the user” and “will also stop serving personalized ads on [YouTube channels for kids] content entirely”.

Furthermore, Google’s own Advertising Policies state that “advertising […] on content set as made for kids must […] otherwise attempt to collect personal information without first obtaining parental consent”.

Source: Google’s Advertising Policies

Lastly, Google's Advertising Policies have a prohibition: "Paid Ads cannot include features or call-to-actions that do not work or where the desired action can’t be completed."

Source: Google’s Advertising Policies

Given that children viewing “made for kids” videos are under the age of 18, and thus cannot subscribe to YouTube NFL Sunday Ticket or YouTube premium (whose Terms of Service require prospective customers to affirm the user is at least 18 years of age), it is unclear why ads for these products are being served on “made for kids” YouTube videos.

Other Google products that were advertised on “made for kids” videos include Google Workspace (the enterprise version of Gmail).

Screenshot of a Google Workspace ad being served on the “made for kids” YouTube channel: “Dave and Ava - Nursery Rhymes and Baby Songs”

Conclusion

Caveats & limitations

Interpreting the results of this observational study requires nuance and caution. This study should not be construed as a legal commentary. This study does not allege that any entities knowingly or intentionally harvested data from kids or violated COPPA or any other laws. This study does not allege, prove or confirm that any entities have suffered a “data leak” or “data breach”, or that any entities were “hacked”.

This study did not make any extensive consultations with data privacy lawyers or other legal experts. The study is meant to be viewed as a highly preliminary observational analysis of publicly available information and empirical data.

Some alleged user identifiers that were observed in this study may be exclusively used for the purposes of contextual ad targeting, attribution, frequency capping, or other advertising functions that are permissible under COPPA.

Some of the data that was observed being collected during the course of this study may be immediately discarded by the receiving vendor, and not saved to any database.

This study makes use of empirical data and open-source datasets, but ultimately the methodology represents only a sample of the entire YouTube and Google Ads ecosystems. As such, any numbers cited in this report must be construed as estimates and may not be representative of the broader ad ecosystem.

Adalytics welcomes data sharing outreach from Google, YouTube, or any other entities that would like to help clarify or expand on observations or data from this study.

Discussion

This study documented observations, in which it appears that YouTube:

·   Sometimes does not classify certain channels as being “madeForKids”, even if every individual public video on a given channel is labeled as “madeForKids” or the title of the channel includes references to children, such as the channels “Code for kids”, “Study for kids”, “Car Videos for kids”, or “Musical Playtime for Kids | Nursery Rhymes”

·   Sets ad targeting related cookies on a consumer’s browser, even if the consumer exclusively watches videos and channels that are labeled as “madeForKids” by YouTube’s own systems

· Serves demographically and behaviorally personalized ads on YouTube channels that are labeled as “madeForKids”

· Serves Performance Max ad campaigns that use audience signals on “made for kids” videos.

Many brands and advertisers were observed setting ad targeting cookies, persistent identifiers, and engaging in meta-data sharing with data brokers, despite the fact that their website was being visited by the viewer of a “made for kids” video. This raises the possibility that advertisers have inadvertently harvested data from large numbers of viewers of “made for kids” videos and transmitted that data to dozens of data brokers.

Google itself was observed running ads for YouTube TV NFL Sunday Ticket and YouTube premium on “made for kids” videos, despite that the fact that the terms of service for both of these products require the consumer to acknowledge they are at least 18 years old in order to be able to purchase the products.

Furthermore, this study documented instances where it appears that Performance Max and Google Preferred ad campaigns were served on “made for kids” videos. Advertisers reported they cannot see exactly on which channels their Performance Max ad campaigns serve on, which begs the question of how much Performance Max may be optimizing to drive clicks on “made for kids” inventory. Furthermore, it is unclear whether the potential incorporation of audience signals into the Performance Max algorithm is consistent with various children’s data privacy protection rules.

It is unclear whether Google is aware that third parties such as the ad tech vendor MNTN appear to be creating derivative copies of Google’s own audience identifiers. It is unclear how Google could comply with “Right to Know” or “Right to Delete” requests if other companies like MNTN have copied Google’s user audience graph. It is unclear whether or not this may constitute a “data leak” or “data breach” of Google’s data, particularly with regards to the subset of data that came from viewers of “made for kids” videos.

Lastly, it is unclear why Google does not make “made for kids” channels into an “opt-in” choice for advertisers, rather than requiring advertisers go through an intensive and imperfect manual opt-out process. Furthermore, it is unclear why Google is not passing any form of “do not track” signals to advertisers’ websites to communicate to advertisers that the viewer of a “made for kids” video ad had clicked on ad. Alternatively, YouTube could simply disable clicks completely for any ads on “made for kids” channels.

A senior advertising executive who reviewed an advanced copy of this report commented:

“Google has failed advertisers, again. There is no reasonable excuse for ads running on content intended primarily for kids other than to extort advertisers through a toddler-enabled click farm. The observations around Pmax (Preschooler Max) are damning given the hard sell Google is putting on us to trust their so-called AI black box. We're overdue real transparency and Google needs to be made accountable - refunding us for all ads on this content and explaining themselves to the FTC.”

Another senior advertising executive who read an advanced copy of this report commented:

“The presence of advertising on children's content on YouTube, with no effective ability for advertisers to explicitly and easily opt in or out, creates significant and unacceptable reputational and regulatory risks for advertisers.

Furthermore, the exfiltration of American children's data across the advertising data ecosystem, particularly to foreign entities such as China via TikTok, is a significant risk.”

The Chief Strategy Officer of Ebiquity (Ruben Schreurs) – an advertising auditing firm – said the following upon reviewing an advanced copy of this report:

“Advertisers rely on the efficacy of the tools and systems operated by Google to help them prevent inadvertent misuse of data and/or targeting of children in their advertising campaigns on YouTube; in many categories even bound by regulations with severe penalties and reputational risk in case of non-compliance, such as for advertisers of products in the alcoholic beverages or sugary product categories.

The alleged shortcoming of YouTube in this regard as outlined in the Adalytics study, if true, is concerning. We look forward to Google’s response on the matter and hope any technical issues will swiftly be resolved to ensure children are appropriately protected when engaging with content on YouTube."