YouTube is a video-sharing platform owned by Google LLC, itself a wholly owned subsidiary of Alphabet Inc., and its data practices are governed by Google's consolidated privacy policy rather than a YouTube-specific document. Google's own policy and help materials describe cross-service data collection, use of cookies and persistent identifiers for ad personalization, and sharing of personal data with advertising partners, while the company states it does not sell personal information outright. YouTube and its parent Google have been the subject of major regulatory actions, including a 2019 U.S. FTC/New York Attorney General COPPA settlement and a 2019 French CNIL GDPR fine, both concerning transparency, consent, and use of data for ad targeting.
TRACK RECORD
2 ENFORCEMENT ACTIONS
[2019-09-04]
On September 4, 2019, the FTC and New York Attorney General announced that Google LLC and its subsidiary YouTube, LLC would pay a combined $170 million civil penalty to settle allegations that YouTube violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children without parental consent.
On January 21, 2019, France's data protection authority CNIL imposed a €50 million fine on Google LLC under the GDPR, citing a lack of transparency, inadequate information, and lack of valid user consent regarding ad personalization.
Google's privacy policy discloses that information collected through its services, including YouTube, may be used and combined "across our services and across your devices" for the purposes described in the policy, indicating collection extends beyond a single YouTube feature into cross-service profiles.
The FTC's public case record for the 2019 settlement identifies YouTube, LLC as a subsidiary of Google LLC, documenting the parent-subsidiary relationship in an official regulatory filing.
A 2022 federal class-action complaint against YouTube, LLC states that Google, and by extension YouTube, is owned by the publicly traded parent company Alphabet Inc., incorporated in Delaware.
Google's EEA data-use page for YouTube states that when users interact with Google's advertising partners, personal data may be shared with those businesses, advertisers, or companies working on their behalf.
According to a September 2019 legal summary of the FTC/NYAG complaint, Google and YouTube earned close to $50 million through behavioral advertising tied to tracking cookies and IP addresses on child-directed channels, indicating that usage data was shared with, and monetized by, the ad-serving system for third-party advertisers.
On January 21, 2019, France's data protection authority CNIL imposed a €50 million fine on Google LLC under the GDPR, citing a lack of transparency, inadequate information, and lack of valid user consent regarding ad personalization.
On September 4, 2019, the FTC and New York Attorney General announced that Google LLC and its subsidiary YouTube, LLC would pay a combined $170 million civil penalty to settle allegations that YouTube violated the Children's Online Privacy Protection Act (COPPA) by collecting personal information from children without parental consent.
Google's EEA-specific data use disclosure for YouTube states that advertising partners must obtain user consent to share personal data with Google for personalized advertising in cases where cookies or local storage are used, confirming these technologies remain part of YouTube's ad-targeting infrastructure in that region.
In a September 4, 2019 statement, FTC commissioners described the underlying complaint's allegation that YouTube collected persistent identifiers (such as cookies) from viewers of channels it knew were directed to children, specifically to serve behavioral advertising.