Man files complaint accusing YouTube of harvesting UK children’s data

A man has filed a formal complaint accusing YouTube of harvesting young children's data, the first such complaint alleging a major tech firm has broken the new "age-appropriate design code".

Duncan McCann, a staff member at child advocacy group 5Rights, filed the AADC complaint with the Information Commissioner's office (ICO), asking the data watchdog to order Google to stop collecting children's data and potentially fine it as much as 4% of annual turnover.

"Imagine YouTube as an adult stranger following your child 'online' with a virtual clipboard recording everything they do," McCann said in a statement. "That is what is happening every day and they are not just doing it with your child. They are doing it with up to 5 million other UK children as well, resulting in an enormous amount of personal information being gathered.

"Never mind it being against the law, it is a massive, unlicensed, social experiment on our children with uncertain consequences. YouTube should change the design of their platform and delete the data they have been gathering unlawfully from under-13s."

Although YouTube officially bans children under 13 from using its main website, McCann's complaint alleges the company has failed to ensure that younger children are following the rules and only using the main platform with parental consent.

A separate app, YouTube Kids, is available for children under 13 and has much stricter data processing, but data from the telecoms watchdog Ofcom shows that while YouTube, including YouTube Kids, was used by 89% of children between three and 17, only 40% of YouTube users aged three to four exclusively used the Kids app, with the proportion falling even lower for older children.

Beeban Kidron, the film-maker and crossbench peer who founded 5Rights and pushed for the creation of the AADC, said she supported McCann's complaint. "It is well established that data privacy regimes are central to the safety of children online.

"Data law is not a pick and mix of what elements companies want to adhere to, it is a holistic approach that requires companies to offer children the highest degree of data privacy and in doing so lessen their exposure to harmful experiences and exploitation online."

As well as asking for the data collected from children to be destroyed, the complaint also asks for the ICO to consider ordering the rollback or deletion of any machine learning system that has been trained on the gathered data.

A YouTube spokesperson said: "Over the years, we've made investments to protect kids and families, such as launching a dedicated kids app, introducing new data practices for children's content, and providing more age-appropriate experiences.

"Building on that longstanding approach and following the additional guidance provided by the code, we implemented further measures to bolster children's privacy on YouTube, such as more protective default settings and a dedicated YouTube supervised experience.

"We remain committed to continuing our engagement with the ICO on this priority work, and with other key stakeholders including children, parents and child protection experts."

The AADC, also known as the "children's code", has been internationally influential. After it came into force in the UK at the end of summer 2021, technology platforms including Instagram, TikTok and Snap all announced new policies to child users of their apps. In August 2022, the California legislature enacted follow-up legislation introducing the AADC to state law.