NSPCC
The NSPCC lobbies for laws that protect children from the online harms present on sites like YouTube.
"the sites our children use are still awash with dangerous self-harm and suicide content because there are no consequences for industry inaction"
Yet they direct children using Childline to YouTube.
Childline is an emergency help service to support the most vulnerable and harmed children in the UK.
These children need a safe experience when looking for support material for their troubles.
Not YouTube, where quickly they can chance on inappropriate material.
The NSPCC should heed their own warnings and use safer video hosting.
Why YouTube is an Online Harms site
- YouTube is referenced in the Online Harms White Paper consultation
- Ofcom's 2021-22 survey placed YouTube 4th for platforms where users are most likely to experience online harm, above TikTok and Snapchat.
- YouTube is famed for breaching Children's privacy
- Under 18? You need parental permission to use YouTube. A higher bar than the over 13 requirements on some social media sites.
- Parental control tools know YouTube isn't safe enough, offering blocking features and advice for parents
- A basic web search reveals a breadth of risks to children on YouTube.
YouTube is not for kids by default
- YouTube terms require parental permission and that a parent accepts responsibility for their child's activity
- YouTube advises accounts may be created by over 13s, still with parental permission
- Because of risks, YouTube offers parents supervised and restricted account features they can use for kids.
- YouTube also has a lot of documentation to help parents develop a safer experience for their child on YouTube
- Age restrictions are applied voluntarily by uploaders - so a lot of adult content (even explicit content from PEGI or BBFC adult rated sources) remains accessible to kids.
If a parent navigates all the above for their child, so their child will be safer, then some of the problems mentioned here may be reduced.
However, the Childline website does not know if any of the above has been done.
NSPCC knows YouTube is not safe or appropriate
Various articles by the NSPCC identify that they recognise risks of social media, video sharing and poor content moderation.
The last link advises the following, something they do not always advise children; as when recommending YouTube to them on Childline there are typically no recommendations about supervision.
"While the platform uses a range of different filters to stop adult content from playing, these aren’t always 100% effective. We always recommend supervising your child when they're watching videos or watching them to make sure they are suitable."
The above is only a small sample of what the NSPCC publishes about the harms. A search of online safety and NSPCC should return many pages across publishers, citing research or spokespeople from the NSPCC making the case of how dangerous platforms like YouTube can be for kids.
NSPCC promotes YouTube
NSPCC advertises their YouTube channel to children on Childline, encouraging them to leave the safety of their site
"We have lots of different videos on our YouTube channel. Get involved in the discussion and let us know what you'd like us to make a video about."
The videos on the Childline website are YouTube embedded videos and although you can play a video on the Childline website without going directly to YouTube; the site includes non-obvious links to YouTube.
- Clicking the video title takes you to youtube.com
- Clicking recommended videos, shown at the end of playing any, takes you to youtube.com (instead of continuing to play in the Childline site)
NSPCC risks not reaching the intended audience
Were a parent not to give permission or to block YouTube for the safety of their child, the embedded videos should not work.
Parents with children most at risk to online harms, are hopefully those most likely to block YouTube.
Does the NSPCC intend for these kids to lose access to their support videos? Because that is what happens when a responsible parent, in the know about their child's state, blocks YouTube.
NSPCC risks children accidentally losing their privacy
The NSPCC are conscious that the sensitive topics they offer advice for, may need the child to protect their privacy. If you find it, there is advice on Childline to stay safe online by protecting browsing history
The problem with YouTube embeds is that it is so easy to accidentally follow a link through to YouTube - or even intentionally, but not realise the privacy risks.
This may be easier on mobile phones, especially with broken screens, in the rain, a wet finger after wiping some tears, with an older phone or just a cheap one. In these cases, a simple gesture to scroll over a video to the next content, may be mistaken as a tap on the video title.
But, mouses or touchpads aren't immune either, especially if a child is not familiar with their parent's laptop.
When this happens, the child risks their activity on YouTube being recorded in YouTube's watch history and persisting after the child clears their last hour of web browsing history.
On someone else's device, that watch history can be easily available to that person, but even on their own it wouldn't be surprising if a parent had access to a child's YouTube account.
This is another reason why YouTube is a poor design choice for the NSPCC.
Examples of inappropriate content on YouTube
Warning: mature content and privacy risks, skip this section if inappropriate:
If under 18 you must not consent to the embeds (mature content and invasion of your privacy).
Also, if you are not a YouTube user, you must not consent to the embeds (using them will make you one).
Consenting to embeds loads a YouTube video player and Google/YouTube may receive identifiable data that you are online, what videos are offered to you and infer your page visit.
Google requires that, you consent to:
- the use of cookies or other local storage where legally required; and
- the collection, sharing, and use of personal data for personalization of ads.
You must agree to YouTube's terms and Privacy Policy
Google account tools offer tooling to delete some data, also there is an online tool here to delete your data
Adult recommendations on Childline's YouTube pages
A child clicks follows the recommendation on the Chidline site and clicks on a video, arriving at YouTube. What else do they see?
Mostly YouTube will recommend videos to kids related to the current video content type (a support topic) and publisher (Childline).
But, the recommendations fall further from this relationship as you look down the list.
For instance, when I visited Hearing Voices ft. Sammee the list included CONTENT returns (adult only content)- a graphic recording from an 18 rated game, with the player taking sniper shots and stabbing people.
Whilst this did not happen on every Childline video or every time on the same video, it was also not a one off.
The screenshot was taken in private browsing mode, not logged in and with no prior YouTube page visits except for Childline videos.
Adult recommendations on Childline's YouTube Kids pages
An under 12 child clicks a video link in the Childline Kids section of their website and arrives at YouTube.
Assuming, the NSPCC have marked the video as "Made for Kids" (you would see "Try YouTube kids" advertised), then YouTube know the intended audience includes under 13s.
However, what else is on the page?
The same risk as on the videos not "Made for Kids".
Hopefully less frequently as the video is marked as for under 12s, but YouTube's content moderation is not good enough, even in their kids section as demonstrated by the following screenshots.
The above screenshots are taken on an iPhone with Brave Browser in private browsing mode, not logged into YouTube.
Most Childline videos are not marked "Made for Kids"
This means YouTube's features, not appropriate for under 13s are still enabled.
As part of the Settlement for privacy violations in the USA, the FTC reached an agreement that includes requirements for YouTube to limit the collection of data and features on videos aimed at under 13s, this includes mixed audiences where older ages may watch, but the publisher know under 13s are part of the target audience.
The problem is, that Childline is a service that intends to support children under 13, not only 13 and over.
A general site, perhaps a home improvement site, could argue it never lured kids under 13 to YouTube as it had no ideas under 13s would be interested.
Childline know a significant audience of theirs is under 13 and need their support.
Part of the requirements on Google include
"A website or online service shall be deemed directed to Children when it has actual knowledge that it is Collecting Personal Information directly from users of another Website or Online Service Directed to Children."
So it makes sense that Google's own terms include similar terms that hopefully meet this requirement (and various others).
Hence there is the page Determining if your content is 'Made for Kids' which the NSPCC are contractually obliged to follow.
Things might not be so bad, if the Childline website only directed under 12s to the Marked for Kids videos and over 13s to the rest. It does not.
For instance, Childline's Home for Kids recommends under 12s visit a Bullying page
Despite the link advising Childline's servers that the page being loaded is as part of the "under12service" it continues to include this video that is not "Made for Kids".
Although you don't have to go through that whole dance of following recommended links out of the kids section, as "Jeremy Lynch Q+A" on the Kids home page has not been marked as Kids content either.
NSPCC directs under 12s to their apparently 13-18 channel.
Although not easy to spot (I found it through an item in the Info and advice menu), Childline has a Kids section for Under 12s
The About Section in Childline's YouTube Channel advises "Our YouTube channel is for 13-18 year olds living in the UK"
That about section is not presented unless you actively choose to go to it, so who knows this?
Confusingly, Childline re-use the channel for videos targeting the under 12s, evident in the BSL screenshot shown earlier.
When the child clicks a YouTube video, in the Childline website's Kids section and arrives at YouTube: the Childline channel is proposed by the YouTube page for the under 12 child to click on or subscribe to, with no suggestion of age restriction.
Childline's choice to use the same channel for over 13s and under 12s, risks under 12s unnecessarily being promoted to their over 13 content. Failing any other option, put it in the title of the channel ("Childline - age 13 and over only")
The NSPCC's decision to put an age restriction in an about page suggests a lack of understanding about how to provide usable age warnings.
If the channel content is mostly for over 13s, then as a lot of it is on childline.org.uk in YouTube embeds, I would hope the NSPCC consider splitting their site into teens.childline.org.uk and kids.childline.org.uk so they can optimise content, privacy and safety experience for what is more appropriate for the different age bands.
NSPCC demands kids give up their privacy for support videos
Your kids cannot watch support videos unless they agree to the following.
"To be able to see YouTube videos, we have to ask you to accept Targeting Cookies within our Cookie Tool. This can be found at the bottom of the page."
NSPCC confuses kids about privacy
"If you allow these cookies, they will remember what you looked at on our website. We use this information to make our website and advertising more related to things that might interest you. If you turn on these cookies, we will also share this information with other websites to build a picture of what else might interest you and show you relevant adverts on other sites. This means that you may see NSPCC adverts shown to you even after you have left our website."
This seems to be against the spirit of their Confidentiality Promise
What NSPCC are not stating
When a child is targeted by YouTube what is happening ...
- The child will be labelled with a unique number by YouTube
- YouTube will monitor which Childline videos about depression, body image, alcohol, bullying, etc that your child watches on YouTube's site.
- Targeted advertising typically records not just the source, but it is tagged against a taxonomy. Here is an example from IAB
-
The targeting of kids is then what content YouTube will automatically show kids
- Targeted adverts try to correlate a users viewing with adverts kids will engage with: what does a troubled kid engage with?
- Recommended videos will throw kids into an addictive stream of next videos to watch about topics and take them off Childline to various other publishers NSPCC does not have control of
- Targeting does not stop there as YouTube is part of Google.
Google targeting
The cookie consent and privacy policy of YouTube are not just for YouTube to get data, but Google too.
Google runs targeted advertising on other sites, including Google Search
Google runs ads on many websites, with integrations like DoubleClick.
"Your activity and information can also be used to personalize ads within YouTube and other Google Services."
YouTube and Google are websites that children with troubles should be recommended to avoid where possible and presented with privacy friendly alternatives.
Not because there aren't privacy options to disable ad collection and maybe even some analytics in Google: there are.
However, Childline's website does not know the tracking setup already on the device:
- what consents have been left in place when the last user was on
- that the child clicked the "Accept All" options, perhaps they only watch cartoons normally and wanted personalised recommendations to match them again.
- that the parent accepted all and had not given the child permission to watch videos about their troubles on there
- that they're borrowing a familly member's, friend's or whoever is near them's device and personalisation will be tied to the wrong person
Regardless of ad data collection, much of the non-ad based analytics poses risks and we shouldn't have to trust that Google keeps it secure, because this type of problem should not be captured using identifiable data collection mechanisms. As typically, YouTube and Google products advise they do that, they should be avoided for these purposes.
Childline's cookie banner breaks privacy law
"You must tell people if you set cookies, and clearly explain what the cookies do and why"
The Childline cookie banner is asking children to sign a blank cheque with their privacy and inappropriate. There is no informative what or why.
"Can we store cookies?
We use cookies to give you the best possible experience on our website. Do you wish to accept cookies?"
For comparison, here is what YouTube's cookie banner looks like, with some details of usages they have for cookies, which in their case includes targeted advertising, content, analytics and more.
An informative cookie banner allows a child to decide whether they should accept the cookies and help them decide how to manage them later.
Cookies may matter for various reasons, for instance
- If the site uses a cookie for login purposes, then the child may wish to delete the cookie when finishing their session in case a family member is a source of their troubles.
- If the site advises their data will be kept for analytics, then because they just want privacy, in case of data leaks or perhaps they know a data engineer at NSPCC or its analytics partners, they may not wish it to be stored.
- If the site integrates with targeted advertising or personalised content, then the child may decide they do not want to see more related to their activity than they choose to look for.
This is a short list off the top of my head and a specialist in privacy could hopefully provide a fuller picture of why it matters.
I wouldn't recommend the YouTube version either and again a specialist in privacy could probably do better:
- I know there are significant terms not present in the cookie banner, such as parents have to give permission or consent.
- It is seems vague about what is collected ("data")
- Some of the necessary cookies are not necessary
- To show this on a Kids Video, seems a bit much for an under 13, even for an over 13 and most adults
- Brand terminology is vague -"personalised" sounds like the advertiser will know who I am and "tailored" that they get my profile and return an ad that fits my viewing of Childline videos?
And because YouTube's cookie consent flow is not appropriate for children, it re-enforces that the YouTube embed is an inappropriate technology choice - as this is the consent dialogue kids are presented with when they click on the YouTube Icon, video title or recommended videos in a YouTube embed.
Some of NSPCC's response to some of the complaint
If a journalist is interested, I may be happy to share the emails in full.
The following are some selected quotes from their email responses with facts regarding why the NSPCC have it wrong.
"the NSPCC decided that YouTube was the best platform to host the videos on the Childline website due to its superior digital accessibility features."
A ‘Reject all’ button is not a legal requirement under the Privacy and Electronic Communications Regulations (PECR). Regulation 6 PECR confirms what a business must do to comply with PECR (and consequently, Data Protection Laws). Childline is fully compliant in this respect by obtaining the user’s consent to cookies. Further, a ‘reject all’ option would not work in practice as it would capture ‘Strictly Necessary’ cookies which are needed in order for the website to work properly. Strictly necessary cookies are exempt from the consent requirement under Regulation 6(4) of PECR. Users are able to reject the other cookies by opting to customise what cookies they accept.
Childline’s Cookies policy is compliant with Regulation 6 of PECR in that it provides clear and comprehensive information about Childline’s purposes. As explained previously, it has been reviewed by ICO and praised by focus groups consisting of children and young people. As part of our processes, it remains under continuous review and update.
There is no legal requirement for a data subject to be able to delete their own personal data. However, under ‘Asking for a copy of your records’ in Childline’s privacy policy, it clearly explains that a user can ask Childline to delete any of the personal information held by Childline if Childline does not have a reason to keep it.
The relationship between Childline and YouTube is not one of joint controller.
Legitimate interest is not the lawful basis for data processing in this context, rather it is consent.
We are concerned that you are engaging in this public criticism of the NSPCC. For example, by setting up a website specifically designed to criticise NSPCC and to recommend that people complain to NSPCC. This will only serve to waste valuable resources responding to such complaints, which resources would be better spent in a more positive way. As stated above, we have considered your concerns and explained our position in our previous email. Further complaints from others will not change that. NSPCC's position and all of its rights and remedies against you in connection with your website and its contents or any activities of a similar nature are strictly reserved..
Note regarding parental guidance
I'm sure my kids will watch some age inappropriate content, hopefully within sensible bounds.
If my children ever want support for any troubles affecting them, I may be out of my depth.
I want my kids to be able to learn about these topics with or without me, so they can explore the topics whilst in control of whether someone is looking over their shoulder. Childline should be a safe space for that.
It is great that the NSPCC have support videos for kids; but to restrict them to kids only able to go to a social media site, that advises most kids should not be there, with so much inappropriate and explicit content, with targeted advertising and algorithmically generated related content recommendations ... this does not seem the safe space you want a child to be in when they are trying to learn about problems troubling them.
Note regarding the Online Safety Bill
If you have an interest in the bill, please read what various researchers and organisations are stating and draw your own conclusions.
This site does support the concern, with limited examples (I would not be surprised if there is much worse), that there are online harm risks to, at least, troubled children in social media.
The expectation here is organisations with a safeguarding responsibility for troubled kids should not be restricting aspects of their service and promoting kids to a site, that the organisation itself recognises as, containing harmful content. If anything this should be a requirement of safeguarding laws, regardless of whether this is in the Online Safety bill or not.
The NSPCC advising that sites are not appropriate for children, but continuing to promote children there, does not actually mean the original message is false, but please do judge the NSPCC for this behaviour.
The intent of this site is not to lobby for or against the bill.
Examples of inappropriate content on YouTube Links
See "Examples of inappropriate content on YouTube" above
Do not watch if under 18.
- Flagged as adult since original posting: "Last 10 Minutes | Evil Dead (2013)"
- "How to Roll the Perfect Joint"
- "Piercing My Tongue at Home"
- "Tattooing Yourself For Beginners"
- "15 Video Game Decapitations So Brutal They Will Make You Puke"
- "UK DRILL: TOP KILLERS IN EACH GANG (Part 1)"
- "GTA 5 - Torture Scene With All Weapons (Battery - Wrench - Plier - Gasolin)"
- "AIDS the Judgement of God - Baptist Preaching independent, fundamental, KJV"
- "9 Things to Do While Tripping on Magic Mushrooms"
- "Easiest beginner vape tricks"
- "Evil Dead(2013) - Olivia Face Carving scene"