YouTube breached child protection laws, suit claims

The first child protection complaint ever made against Big Tech under UK law

A British man has made the first ever complaint against a Big Tech firm under the Children's Code, a 2021 law that requires companies to take the best interests of child users into account.

Duncan McCann, a father who works for the 5Rights charity, has lodged a complaint with the Information Commissioner's Office. He alleges that YouTube has breached data protection laws by "systematically" recording information on as many as 5 million UK children.

That information includes location, viewing habits and preferences for children under the age of 13.

The Children's Code, more formally known as the Age Appropriate Design Code (AADC), bans or limits features specifically includes user profiling and location tracking, as well as use of nudge techniques that encourage users to provide more data.

Firms must also consider whether using their data keeps young people safe from commercial and sexual exploitation; provide a high level of privacy by default; and map the personal data they collect from children, even if the company is not based in the UK.

McCann says, "Imagine YouTube as an adult stranger following your child 'online' with a virtual clipboard recording everything they do. That is what is happening every day and they are not just doing it with your child. They are doing it with up to 5 million other UK children as well, resulting in an enormous amount of personal information being gathered.

"Never mind it being against the law, it is a massive, unlicensed, social experiment on our children with uncertain consequences. YouTube should change the design of their platform and delete the data they have been gathering unlawfully from under 13s."

The complaint states that YouTube has been in breach of the rules since "at least" 25th May 2018, when the Data Protection Act (of which the AADC is part) and GDPR came into force.

YouTube's terms of service state users should be at least 13 years old. However, the complaint quotes Ofcom data showing that children use the platform heavily, without parental oversight. It was the most popular site for children aged 3-17 in 2021, while the dedicated YouTube Kids app was used much less frequently.

"It's all well and good to claim that the platform should not be used by those under a certain age, but the protection in place should be designed for the real world, where it is easy for children to access YouTube from family devices," said Simon Randall, CEO and Co-Founder of video analytics platform Pimloc.

Baroness Beeban Kidron, founder of 5Rights, said, "It is well established that data privacy regimes are central to the safety of children online. Data law is not a pick and mix of what elements companies want to adhere to, it is a holistic approach that requires companies to offer children the highest degree of data privacy and in doing so lessen their exposure to harmful experiences and exploitation online."

The complaint calls on the ICO to require YouTube to delete unlawfully collected data from children, and/or impose a fine. Under the GDPR and DPA that can be up to £17.5 million or 4% of the company's worldwide turnover, whichever is higher.

It also goes a step further and urges the ICO to consider whether YouTube should roll back or completely delete machine learning algorithms it has trained on data captured from children.

Analytics data like viewing habits may seem innocuous, says Randall, but YouTube also encourages viewers to upload their own videos, which contain "lots of biometric information."

He added, "It is vital that data protection and privacy are at the forefront of YouTube's practices, especially when it comes to children - who may not yet understand the complex risks of sharing their biometric information online and may not yet have developed a full sense of what constitutes harmful content for themselves and others."