Whizz Kids' Public Notice
Please read How Whizz-Kidz keeps your data safe and what it means for you
When last checked, there are still failings.
The charity appears to acknowledge this with the exceptions they note in their response (9th March below) that also advises that their efforts are still ongoing.
What is the charity getting wrong?
Some of their pages like this one aimed at helping Kids learn Wheelchair skills, include videos.
The video content is hosted using YouTube embeds and therefore directing the children to the online harms risks of YouTube.
The embeds are also not using YouTube's privacy enhanced mode. Thus, from a privacy perspective this is a worse situation than the Childline situation currently.
As a result of this, identifiable data is being sent to YouTube, without user consent, from the Whizz Kids website, that indicates the user is a kid trying to learn skills in their wheelchair, revealing a disability to YouTube. Data, that YouTube advises they will use for various purposes including their analytics, personalised adverts and video recommendations.
Furthermore, the YouTube embed asks the child to "Watch on youtube.com" when they hover over the YouTube icon and the video title takes the child to YouTube. Thus the embed the charity has chosen, is encouraging the kid to go to YouTube, where they are then at risk to the online harms risks outlined on the NSPCC article on this site.
Raising the complaint
4th January 2023, Whizz Kids and the ICO received a complaint detailing how Whizz Kids were sharing data with YouTube.
Summary of their response
Acknowledgement of receipt of complaint.
An apology to me (which I am grateful for) and summary of actions taken so far:
- YouTube videos in ‘privacy mode’ – we are investigating this matter and will implement an appropriate action plan.
- Due to the weaknesses you have helped us to identify, we are looking at more robust cookie and consent management systems for our site going forwards.
Thank you for your patience whilst we took further action following your email sent on 15/02/2023.
We have removed the Facebook tracking pixel from all website pages except for our fundraising (e.g. London Marathon/Gift in Wills) and donation pages. These are only for individuals aged 18 plus.
We have published a blog post, drawing attention to the changes that we have made: www.whizz-kidz.org.uk/discover/post/how-whizz-kidz-keeps-your-data-safe-and-what-it-means-for-you
We are in ongoing communication with the ICO to ensure that we are following their advice and guidance on best practice. We will wait for the ICO’s guidance before communicating again on this matter.
Thank you again for taking the time to get in contact with your concerns.
The response is a little worrying, as YouTube cookies are not appropriate on the page.
I am not aware whether they have completed the efforts to improve their site, but hope not as last checked, YouTube was still loading.