In 2019 YouTube paid $170 million for tracking children. In 2025, a federal judge said Google knowingly "engaged in highly offensive conduct" collecting kids' data — and approved another $30 million settlement. Disney got fined $10 million for mislabeling kids' videos on YouTube, which let Google's trackers follow children anyway. Six years and $210 million in penalties later, the same fundamental violation keeps happening. The children whose data was collected in 2019 are now teenagers — and their younger siblings are being tracked too. Alexander Hanff, a privacy researcher, filed a formal complaint that YouTube's ad-blocker detection qualifies as spyware under EU law. The Irish Data Protection Commission agreed and opened a formal probe in 2025. YouTube's scripts reach into your browser to detect what extensions you've installed — the exact behavior the ePrivacy Directive was written to prevent. If you refuse to let YouTube scan your browser, YouTube blocks you from watching videos entirely. The choice is: let us surveil your browser, or leave.
What they claim: YouTube's privacy policy states it respects user choices about data collection and operates transparently.
What we found: In 2023-2024, YouTube deployed anti-ad-blocker technology that privacy researcher Alexander Hanff formally complained violated Article 5.3 of the EU ePrivacy Directive — the same provision governing spyware. The Ireland DPC accepted the complaint in 2025 and opened an investigation. YouTube's detection scripts probe browsers to detect ad-blocking extensions without consent.
What they claim: YouTube states its recommendation system helps users discover content they'll enjoy and actively reduces harmful content.
What we found: A 2023 PNAS audit using 100,000 sock puppet accounts found YouTube's algorithm recommends progressively more extreme content. Caleb Cain told the New York Times he was pulled into white supremacist ideology through autoplay recommendations. YouTube's own leaked internal research showed the company knew but prioritized engagement metrics. A 2026 Turkiye study found the algorithm could radicalize conservative young people in a very short time.
What they claim: Google says YouTube collects general area location data and users can control location sharing through device settings.
What we found: Google was fined $391.5 million by 40 US state attorneys general in 2022 for tracking users' locations even after they turned off location history. Arizona's case revealed internal emails where employees called their own practices misleading. A Google engineer wrote the only way to stop tracking was to hide your phone in a Faraday cage. YouTube uses location data for zip code level ad targeting.
What they claim: Google positioned YouTube Shorts as a privacy-respecting alternative to TikTok during the ban debates.
What we found: YouTube Shorts collects the same behavioral data as TikTok: scroll timing, dwell time in milliseconds, swipe patterns, audio fingerprints, device identifiers. But Google's advertising ID links Shorts behavior to Gmail, Google Maps, Chrome browsing, and Android device data — creating a cross-platform profile far more comprehensive than TikTok's standalone surveillance.
What they claim: YouTube states creators are responsible for disclosing AI-generated content in their uploads
What we found: YouTube is now auto-scanning all uploaded videos to detect AI-generated content — regardless of whether the creator discloses it. Every upload is analysed by Google's detection models. This is content surveillance at scale: Google inspecting what you made and how you made it, applied to every video on the platform.
What they claim: YouTube Premium is marketed as an ad-free experience implying privacy benefits.
What we found: YouTube Premium removes visible ads but does not reduce data collection. Watch history, search queries, device information, and location data are still collected identically to free users. Google's 2024 10-K confirms Premium revenue is separate from advertising, meaning Google double-dips: subscription fee plus behavioral data powering its $307 billion ad business.
What they claim: YouTube says it supports creators and provides tools for them to manage their content and privacy.
What we found: YouTube requires government ID and tax details from creators, submits all videos to Content ID fingerprinting, and reserves the right to run ads on any video — even channels that chose not to monetize. During periodic purges, YouTube terminated thousands of accounts overnight, erasing years of content without meaningful explanation or appeal.
What they claim: YouTube's COPPA compliance page states it does not knowingly collect personal information from children under 13 without parental consent.
What we found: In 2019, the FTC fined Google $170 million for collecting children's data on YouTube for targeted ads. In 2025, a judge ruled Google knowingly engaged in highly offensive conduct, leading to a $30 million class action settlement. Disney was fined $10 million in December 2025 for mislabeling children's content which let Google's trackers collect data on kids.