← Kids & Education
F

YouTube Kids

Fail
Google · 🇺🇸 United States
PolicyApp PermissionsNetwork TrafficFirmwareRegulatory
Technical details
App: com.google.android.apps.youtube.kids
Manufacturer: Google

⚠️ The bottom line

Google built YouTube Kids and called it "a safer online experience for kids." The FTC found Google was tracking children with persistent identifiers and serving them targeted ads -- the exact thing COPPA exists to prevent. The $170 million fine was the largest COPPA penalty ever. FTC Commissioner Chopra said it was "a fraction of what YouTube earned from the illegal conduct." Nobody at Google went to jail. Nobody was personally fined. A $170 million parking ticket for a company worth a trillion dollars. YouTube Kids promised a "contained environment filled with family-friendly videos." Parents found their toddlers watching Peppa Pig being tortured, Spider-Man injecting Elsa with needles, and cartoon characters being kidnapped -- all recommended by YouTube's algorithm. The BBC found this content within 10 clicks from the YouTube Kids homepage. Content farms churned out thousands of these videos daily because the algorithm rewarded them with views. The algorithm didn't care that the viewers were three years old. It cared about watch time.

Legal jurisdiction
🇺🇸 United States (headquarters)
CLOUD Act read more →
US govt can demand your data from this company even if stored overseas
FISA §702 / PRISM read more →
NSA collects stored emails, photos, messages without individual warrants
Geofence warrants read more →
Police can demand location data for everyone near a crime scene
Spying
3/4 HIGH
Is someone spying on me?
Kids at risk
Data Sharing
3/4 HIGH
Who gets my data?
Kids at risk
Security
3/4 HIGH
Is it actually secure?
Kids at risk
Honesty
3/4 HIGH
Can I trust what they say?
Kids at risk
CONFIGURE High-risk areas that can be partially mitigated with settings changes.
6Contradictions
2Critical
3High
1Medium
5Sources
Findings by concern
Spying 3/4 HIGH 3 findings
⚡ highpolicy claims vs network analysis
Google said it didn't track children. University of California researchers found the YouTube Kids app contacted seven different advertising and tracking domains. DoubleClick -- Google's own ad network -- was embedded in an app for five-year-olds. Every video a child watched was logged, profiled, and used to serve targeted ads. Google built surveillance infrastructure into a product with cartoon characters on the icon.

What they claim: Google stated it did not track children or serve them targeted advertising on YouTube.

What we found: 2018 University of California study found YouTube Kids app contacted 7 different advertising and tracking domains. Persistent identifiers tracked viewing behavior across sessions. Google Analytics, DoubleClick, and other ad-tech embedded in the child-directed app. FTC settlement confirmed Google used persistent identifiers to build profiles on children's interests and viewing patterns, then served targeted ads based on those profiles.

⚡ highmarketing claims vs third party research
YouTube Kids said content was filtered by machines, humans, and parent feedback. The Wall Street Journal found the algorithm created rabbit holes that pushed children from cooking videos to violence within a few auto-plays. The algorithm's only goal was watch time. A toddler watching Sesame Street clips was just a set of eyeballs to keep engaged. Four years after the scandal, advocacy groups found the algorithm was still recommending inappropriate content. "Mix of automated filters" means the algorithm decides what your child sees next.

What they claim: YouTube Kids: "Videos are narrowed down with a mix of automated filters, human review, and feedback from parents."

What we found: WSJ 2019 investigation documented YouTube's algorithm creating "rabbit holes" that pushed children to increasingly extreme content. A child watching a cooking video could reach violent content within a few auto-plays. Algorithm optimized entirely for watch time, not child safety. 2022: advocacy groups found algorithm still pushing inappropriate content despite years of promised reforms. "Approved content" mode still contained problematic recommendations.

⚫ mediummarketing claims vs app permissions
YouTube Kids says parents are in control. Parents can set a timer and turn search on or off. They cannot see what data Google collects about their child, cannot stop the collection, cannot review the behavioral profile built from their child's viewing. To understand what's happening, a parent would need to read Google's 4,000-word privacy policy. The controls let you limit screen time. They don't let you limit surveillance.

What they claim: YouTube Kids: "Built-in parental controls so you can customize the experience for your child."

What we found: Parental controls limited to timer, search toggle, and content level selection. Parents cannot see what Google collects about their child. Cannot opt out of data collection while using the app. Cannot review or delete the behavioral profile built from viewing history. 2019 settlement required "limited" data collection but enforcement mechanism is self-certification. Parent must navigate Google's 4,000+ word privacy policy to understand what data is collected.

Data Sharing 3/4 HIGH 2 findings
⚠️ criticalmarketing claims vs regulatory findings
Google built YouTube Kids and called it "a safer online experience for kids." The FTC found Google was tracking children with persistent identifiers and serving them targeted ads -- the exact thing COPPA exists to prevent. The $170 million fine was the largest COPPA penalty ever. FTC Commissioner Chopra said it was "a fraction of what YouTube earned from the illegal conduct." Nobody at Google went to jail. Nobody was personally fined. A $170 million parking ticket for a company worth a trillion dollars.

What they claim: YouTube Kids marketed as "a safer online experience for kids" with "family-friendly content."

What we found: FTC + NY AG fined Google $170M (2019) for collecting personal information from children without parental consent. YouTube tracked children with persistent identifiers and served targeted behavioral ads. FTC found YouTube knew channels were directed at children but treated them as general audience to maximize ad revenue. Commissioner Rohit Chopra dissented: "$170 million is a fraction of the revenues YouTube earned from the illegal conduct." No executive held personally liable.

⚡ highmarketing claims vs regulatory findings
YouTube Kids said ads would be "appropriate for kids." The app served behavioral ads -- tracking what a five-year-old watched and targeting them accordingly. Meanwhile, toy companies paid creators to make "unboxing videos" that were really infomercials dressed as entertainment. A child couldn't tell the difference between a video and an ad. That was the point.

What they claim: YouTube Kids: "We work to make sure ads are appropriate for kids."

What we found: YouTube Kids launched with behavioral advertising served to children. Unboxing videos and toy reviews blurred the line between content and advertising. Content creators were paid by toy companies to produce videos that functioned as ads but appeared as entertainment. Campaign for a Commercial-Free Childhood filed multiple FTC complaints. FTC found YouTube served targeted behavioral ads to children in violation of COPPA.

Security 3/4 HIGH 1 finding
⚠️ criticalmarketing claims vs third party research
YouTube Kids promised a "contained environment filled with family-friendly videos." Parents found their toddlers watching Peppa Pig being tortured, Spider-Man injecting Elsa with needles, and cartoon characters being kidnapped -- all recommended by YouTube's algorithm. The BBC found this content within 10 clicks from the YouTube Kids homepage. Content farms churned out thousands of these videos daily because the algorithm rewarded them with views. The algorithm didn't care that the viewers were three years old. It cared about watch time.

What they claim: YouTube Kids app description: "Designed to give kids a more contained environment filled with family-friendly videos."

What we found: Elsagate (2017-2018): mass-produced disturbing content featuring beloved children's characters (Peppa Pig, Elsa, Spider-Man) in violent, sexual, and terrifying scenarios was algorithmically recommended to children. Content farms produced thousands of disturbing videos daily. BBC investigation found deeply disturbing content within 10 clicks from YouTube Kids homepage. Parents discovered toddlers watching simulated injections, kidnapping, and gore. YouTube's recommendation algorithm actively pushed children toward increasingly extreme content to maximize watch time.

What happened to real people
Documented incidents involving Google products and user data.
Jorge Molina jailed 6 days for murder via geofence warrant based on Google Sensorvault location data. Lost job, car, reputation. Charges never filed. [source]
PRISM participant since 2009. NSA collects stored communications. FBI conducts warrantless 'backdoor searches' of American data using names and email addresses. [source]
Google received 180 geofence warrants per week by 2019. Each warrant searches tens of millions of accounts. Supreme Court hearing constitutionality (Chatrie v. United States). [source]
What your data is worth to governments
Google complied with 235,000 government data requests in H1 2024. That's +530% over 10 years. Google has been a confirmed PRISM participant since 2009. Under this programme, the NSA collects stored communications. The company is legally prohibited from telling you. Jurisdiction: US (CLOUD Act, FISA Section 702, Patriot Act).
Documented: Jorge Molina jailed 6 days for murder via geofence warrant based on Google Sensorvault location data. Lost job, car, reputation. Charges never filed.
Documented: PRISM participant since 2009. NSA collects stored communications. FBI conducts warrantless 'backdoor searches' of American data using names and email addresses.
What is PRISM? · What is the CLOUD Act? · Transparency report
Sources