What? Why? Children in Hospital
What has happened?
What? Why? Children in Hospital offer videos for parents and children to watch about going into hospital for various services a hospitla may offer.
There are a range of videos available
Sadly these videos all use YouTube
The YouTube players are not using YouTube's privacy enhanced mode. Thus, from a privacy perspective this was a worse situation than the Childline situation currently.
As a result of this, identifiable data is being sent to YouTube revealing the health problems children have.
Furthermore, the YouTube embed asks the child to "Watch on youtube.com" when they hover over the YouTube icon and the video title takes the child to YouTube. Thus the embed the trust chose, is encouraging the kids to go to YouTube, where they are then at risk to the online harms risks outlined on the NSPCC article on this site.
Is it fixed?
No
The cookie banner has been updated to advise that the YouTube will load and that the user must consent to YouTube's use of cookies.
However, YouTube is not appropriate for this data, it is not the in the best interests of a child for their health conditions to be populated into Youtube's advertising system and content recommendation system.
Whilst, data protection law does allow for usages of consent, the YouTube terms and conditions and policies are too much for any child to be expected to read.
The ICO offers advice about how consent must be freely given and not a condition of service - the videos the charity offer are a very significant feature of what they offer as a charity, it is not right for them to restrict access to support content because a child does not want to be targetted by advertising or a parent risk allowing YouTube access that may expose the child to online harms.
Raising the complaint
13th January 2023: A complaint was sent to the charity and the ICO
16th January 2023: On receipt of the intial response, the charity was reminded of the terms it had agreed to with YouTube and that it needed to read them.
25th January 2023: Charity advised that their improved cookie banner flow was still non-compliant and violating kids privacy.
The Response
16th January 2023: Not a great response, let's not dwell on it.
24th January 2023: Advised that the YoUTube videos were now blocked until consent was given (but as explained above, this is still inappropriate).