What is the charity getting wrong with videos?
The charity offers support pages for children with cancer.
They can include videos
- When another friend with cancer dies is one that includes a YouTube embed.
- Looking after your hair. is one that includes a Vimeo embed.
These kind of situations seem very personal and very sensitive, the kind of information a child might struggle to share with those close to them. A child should own the privacy of this information and their efforts to find support material for it.
The YouTube embed is not using YouTube's privacy enhanced mode. Thus, from a privacy perspective this was a worse situation than the Childline situation currently. Vimeo is a similar style of risk.
As a result of this, identifiable data was being sent to YouTube and Vimeo revealing that a child has cancer.
Furthermore, the YouTube embed asks the child to "Watch on youtube.com" when they hover over the YouTube icon and the video title takes the child to YouTube. Thus the embed the trust chose, is encouraging the kids to go to YouTube, where they are then at risk to the online harms risks outlined on the NSPCC article on this site.
What is the charity getting wrong with other tracking?
Analytics tracking is happening without consent, and tied to IP addresses or cookies identifiers it poses risks to privacy where the analytics company can identify the user via another website (perhaps another site uses the same analytics tool on a user profile page).
The charity, also asks users to give consent to cookies for the charity to improve their website, but does not indicate in the banner it is not just the charity who will receive the data
For the children and parents who click "Accept" the site will then load Facebook's and Microsoft's (Bing) identifiable tracking of thier activity on the site; this seems unlikely restricted to only pages with videos.
Facebook, YouTube and Bing are all advertising systems and content recommendation systems - so there are discrimination risks in what a child or parent may have recommended to them... these wlil vary from perhaps positive suggestions that may help them with cancer. However, they may also include misleading and inconsiderate recommendations. It also risks the child or parent not receiving recommendations for products or contents that they might benefit from.
Is it fixed?
Not when last checked
Raising the complaint
13th January 2023: A complaint was sent to the charity and ICO
27th January 2023: The complaint was updated with regard to Facebook and Microsoft
18th January 2023:
I am writing to acknowledge your email which we received on 13 January 2023.
Thank you for raising these matters with us. The safeguarding of children and young people, and our responsibilities as a responsible data controller, are extremely important to us and ensuring we have appropriate protections in place is paramount, underpinning everything we do.
I would like to assure you that we are fully reviewing the matters raised.
I will update you when this review has been completed and the outcome of your complaint within 15 working days of the receipt of your email.