IPG Mediabrands advised its clients to temporarily pause campaigns using Google’s Performance Max.

The company issued a “privacy alert” email in response to allegations in a new report that YouTube ads may have led to improperly tracking children.

Brands using PMax may inadvertently violate the Children’s Online Privacy Protection Act (COPPA) as a result, according to the study conducted by Adalytics.

Why we care. If brands are found to be in violation of COPPA, they may have to pay a significant financial penalty just as YouTube did in 2019 when it spent a record $170 million to settle similar charges.

Have any laws been broken? Under COPPA, online services must get parental consent before collecting data for targeted advertising purposes from children under the age of 13.

Adalytics researchers found the platform serving personalized ads from more than 300 brands on “made for kids” videos. When viewers clicked on these campaigns, they were redirected to the brand’s website, which sometimes resulted in dropping cookies on the user’s browser.

IPG Mediabrands investigates. In response to the findings, IPG Mediabrands conducted its own investigation. They reportedly found that at least one of its clients, which was running an adult-targeted campaign, had its ad feature on a “made for kids” channel.

If a child had clicked on the ad, tracking pixels from the brand’s website would have gathered data from the child as well as their associated ID. This data would then have been shared with Google’s PMax.

IPG Mediabrands, which manages $40 billion in marketing investment worldwide, reportedly concluded that a full investigation was needed to identify the full extent of the impact on its clients.

What has IPG Mediabrands said? Although an IPG Mediabrands spokesperson said it was incorrect to say it had recommended a pause on any Google product, a company email – which was obtained by Business Insider – read:

• “Because placement reporting is not available for PMAX, we recommend that clients temporarily pause PMAX until the efficacy of the above controls are validated on non-PMAX campaigns where placement reporting is available.”
• “Clients should consult with their legal, privacy/infosec, website, and data teams to consider potential exposure, and determine the appropriate process for identifying and removing data potentially collected from children.
  For example, advertisers may assess data in their CDPs that originated from YouTube as a traffic source.”
• “These recommendations are being made on the basis of the probability of FTC scrutiny, as well as in light of the evidence of waste in advertising investment against unintended audiences.”

What has Google said? Dan Taylor, Google’s Vice President of Global Ads, said the Adalytics study was “flawed”. Addressing the report in a post on X (formerly known as Twitter), he stated:

• “[This is the] 2nd time [Adalytics has] produced faulty research about Google advertising this summer. Here are 6 facts about how we protect kids on YouTube that Adalytics gets completely wrong or ignores.”
• “#1 We don’t personalize ads to kids, ever. And we treat everyone who watches Made for Kids content as a child, regardless of their age.”
• “#2 We built YouTube Kids as a dedicated app designed from the ground up to be a safer experience for kids to explore, with tools for parents and caregivers to guide their journey. The YouTube Kids app has never had personalized ads either.”
• “#3 Made for Kids content has ads but we restrict the types of products that can be advertised: e.g. no ads for video games or media unsuitable for children, no ads about dating and relationship, no ads for food and beverage.”
• “#4 Google does not share with advertisers what content/video a person was watching when they click on an ad. That means advertisers never know if a click came from someone watching Made for Kids content, regardless of their age.”
• “#5 Advertisers, with a single click, can choose to opt out of Made for Kids content. The opt-out, called Content Suitable for Families, prevents advertisers from having their ads run alongside Made for Kids content. Adalytics doesn’t appear to know this.”
• “#6 Cookies ≠ ad personalization. Cookies are permitted under COPPA for statistical reporting, for spam and fraud detection and for frequency capping. They are critical to YouTube creators’ monetization which encourages a rich diversity of content on YouTube.”
• “#7 Though we only just received the report, what we have reviewed shows no violations of our commitments nor privacy policies. Given Adalytics’ last report was debunked by 2 independent organizations, we do not put much stock in the accuracy of their research.”
• “#8 The NYTimes, who was given early access to the report, couldn’t even verify the bulk of Adalytics’ claims. It does not corroborate Adalytics’ accusations and in fact found the opposite: no violation of COPPA, no personalization of ads to kids, and no improper use of cookies.”
• “#9 Adalytics’ report has no substance and tries to make a gotcha when there is none. We offered to meet with them weeks ago and heard crickets. Do they have the credentials and expertise to publish these reports?”

Deep dive. Read Adalytics’ YouTube study in full for more information on its research. Read Google’s official documentation on how ads work on YouTube for supervised accounts for more information.