I don’t imagine this is going to make a huge difference to anyone’s opinions, but there’s a lot of pretty profound misunderstanding going around about the whole YouTube/COPPA thing, and a lot of it seems to be aimed at making Google look less culpable than they really are, especially in a way that paints the FTC as the bad guy – when the fact of the matter is that the FTC is basically in the right for once.
The first misunderstanding has to do with the term “targeted advertising”. This doesn’t mean targeted based on the nature of the video it’s being run on. It means targeted based on the identity of the person watching the video. Basically, Google wants to show ads tailored as precisely as possible to your specific interests in order to maximise the odds that you’ll buy what they’re selling. They do this by analysing your online activity and building a profile – and here’s the trick: you do not need a Google account for them to do this.
How does that work? Well, every piece of hardware that’s directly connected to an Internet service provider – like, say, your home’s wireless router – has a uniquely identifiable network address assigned to it. This network address is exposed to every content provider you interact with, so that they know where to send the data you’ve requested. So when you view a YouTube video, Google may not have a name to put to that data, but they know the physical network location of the wireless router that was used to access it, and that’s enough to start building a profile.
And this doesn’t just apply to activity on YouTube. Google is also operates the world’s largest ad network. Whenever you visit a site that’s running ads, there’s a very good chance those ads are being served by Google’s ad network – which means that even if the site itself has nothing to do with Google, Google knows what pages on that site you visited and when, based on which ad slots you triggered as you navigated about. And again, even if you don’t have a Google account, they can still build a profile based on recognising your router’s network address in their activity logs.
Oh, but you block your ads? Too bad – Google is also the world’s largest web analytics provider, which means that literally millions of sites are just straight up handing their activity logs over to Google, so that Google can crunch numbers and generate statistics about their visitors for them. Did you visit a site that’s using Google’s analytics services? Google is gonna recognise your router’s network address in that site’s logs, and into the profile your activity goes.
In this way, Google is able to build a profile of your online activity without you ever having to sign up or opt in to anything. Certainly, having a Google account makes it easier for them, because now they can snoop your inbox for keywords and such, but that’s all supplementary: your network activity alone is enough to guess at most facets of your identity with startling accuracy, even to the point of cleanly identifying specific individuals in a home whose router has more than one regular user. When you watch a YouTube video, Google thus has a pretty good idea whose eyes are on that content, and can advertise accordingly.
So, here’s the trouble: collecting this sort of identifying information about minors (strictly speaking, kids under 13) is against the law. This isn’t a new law – it’s been on the books for over twenty years. It’s historically been the position of content networks like Google that it’s impossible not to build profiles on minors, because unless they register for an account with that specific network and voluntarily disclose their ages, there’s no way to know for sure that they’re actually minors. For the last couple of decades, the FTC has been inclined to accept this rationale; however, this is no longer the case. Google’s basically been told that now the onus is on them to put forth a reasonable effort to ensure that they’re not building detailed profiles of minors – which, one must bear in mind, is how it should have been to start with.
(Of course, in a perfect world, this sort of profile-based targeting would be prohibited for everyone who hasn’t explicitly opted into it, regardless of age, but that’s neither here not there.)
From a technical standpoint, full compliance would be trivial: Google would simply have to ensure that they only build profiles for individuals who’ve signed up for a Google account, voluntarily disclosed their ages, and explicitly opted in to have their online activity tracked. Running targeted ads on child-friendly content would pose no compliance problems as long as the targeted ads themselves were only displayed to verified adults. Of course, Google’s never actually going to do that, because it would torpedo their advertising empire. Instead, they’ve dreamed up a frankly bizarre argument:
1. That it’s okay for them to build detailed profiles of individuals who are probably minors as long as they never actually use those profiles to serve targeted ads to a child; and
2. It’s the responsibility of individual YouTube content producers to ensure that inappropriate use of targeted advertising does not occur, by voluntarily opting out of participating in targeted advertising if they have reason to believe that their videos are likely to be viewed by minors.
These are not new laws the FTC conjured into existence; these are the terms of a settlement that Google themselves proposed to an ongoing lawsuit with the FTC concerning their flagrant harvesting of minors’ personal data, and which the FTC accepted. Should the FTC have accepted Google’s proposal? That’s something that can be argued – but the fact remains that none of this would have been necessary in the first place if Google had been willing to back off on the Big Brother bullshit even the tiniest bit.
(via vassraptor)
