IPG Mediabrands ‘privacy alert’ says clients should ‘consider’ a pause on Google ads product

• An IPG Mediabrands team issued a ‘privacy alert’ email across the agency on Thursday.
• It followed a report that alleged YouTube ads may have led to the improper tracking of kids online.
• Google has disputed the report; IPG MB memo suggested a pause on Performance Max ads.

A privacy alert from IPG Mediabrands advised clients “should consider” a pause on campaigns using Google’s ad product Performance Max following the publication of a report that found ads on YouTube could have led to the improper tracking of children online.

The research, from analytics firm Adalytics reported Thursday by The New York Times, found that YouTube served ads from more than 300 brands on YouTube channels with videos specifically labeled as “made for kids” — in some cases even when the advertiser had specifically been targeting an adult audience.

When viewers clicked on those ads they landed on the advertiser’s website, which on some occasions dropped tracking software called cookies on the user’s browser from the likes of Google, Meta, and other data brokers, the researchers found.

The report called into question whether these YouTube campaigns inadvertently may have put advertisers and the companies dropping those tracking cookies in violation of the Children’s Online Privacy Protection Act. The law, known as COPPA, requires online services to obtain parental consent before collecting personal information from children under 13 years old for uses such as targeted advertising. The Adalytics researchers couldn’t deduce exactly how the cookies were being used but did detect personalized ads served on “made for kids” videos.

The report also questioned whether Google was making good on its public statements that it had stopped serving personalized ads on children’s content on the video platform. In 2019 Google and YouTube agreed to pay a $170 million fine to settle accusations from the Federal Trade Commission that it had illegally collected personal data from children to make money from targeting them with ads. 

Google has disputed the Adalytics report, with a spokesperson describing it in a statement to Insider as “deeply flawed and misleading.” The statement continued that the report made “uninformed conclusions based solely on the presence of cookies.” It said that cookies in this context are widely used for the purposes of things like fraud detection or making sure the same ad wasn’t served too many times to the same person, which is permitted under COPPA.

Google said from the portions of the report shared by The New York Times prior to its publication, it had found no violation of its policies and that advertisers can apply a setting so their ads don’t appear on kids’ videos.

But IPG Mediabrands staffers emailed a “brand safety and privacy alert” across the agency Thursday, a copy of which was obtained by Insider and can be read in full below. It states that from its initial analysis, it found at least one instance in which a client’s adult-targeted campaign had run on a “made for kids” channel. In the event a child clicked on that ad, tracking pixels placed on the advertiser’s site would have collected data from the child and the associated ID could have been used to inform Google’s Performance Max targeting, the email read.

As a result, the IPG Mediabrands alert recommended the agency’s clients temporarily pause Performance Max campaigns while they validate the efficacy of YouTube’s brand safety controls that let advertisers exclude certain keywords, channels, and “content suitable for families,” according to the email. It said its recommendations, which also included adopting an “inclusion list strategy” to only target suitable channels, were being made on the basis of the probability of FTC scrutiny and to avoid wasting spend on unintended audiences. IPG Mediabrands manages around $40 billion in marketing investment globally on behalf of its clients, according to its website.

An IPG Mediabrands spokeswoman said it was not accurate to say the agency was recommending a pause on any Google product. 

Launched in 2020, Performance Max is a hugely important advertising tool to Google and is frequently called out by executives at parent company Alphabet’s earnings calls as a growth driver. Advertisers set an objective — such as sales, leads, or in-store visits — and Google uses the advertiser’s data and automation to optimize the campaign for the best placements across YouTube, display ads, search, Gmail, Maps, and other Google properties.

Google has said that advertisers on average achieve better results using Performance Max, but the product has been met with skepticism by some corners of the advertising community because it aggregates the results and doesn’t offer breakdowns about where the ads actually ran. 

“The premise of Performance Max seems to be ‘give us your budget and we will give you performance, don’t worry about anything else’,” said Ruben Schreurs, chief strategy officer of the marketing consultancy Ebiquity. 

“What worries me about this Adalytics report is that Performance Max campaigns have allegedly been observed to run on made-for children inventory,” Schreurs said. “Most media buyers know that inventory targeted at children or elderly audiences will deliver a lot of clicks, which scores well against vanity performance metrics, but does not drive any actual business value.”

Senator Edward J. Markey, Democrat of Massachusetts, and Senator Marsha Blackburn, Republican of Tennessee, sent a letter to the FTC on Thursday urging it to investigate whether Google had violated COPPA, based on Adalytics’s findings, The New York Times first reported.

“YouTube and Google cannot continue treating young people’s data as a commodity from which to profit with abandon,” the letter read. “Not only must the FTC act, but Congress must also pass legislation to protect young people’s privacy online and finally ban targeting advertising to kids and teens.”

IPG Mediabrands Privacy Alert letter in full:

Partner: YouTube

Background:

On Thursday, August 17th, the New York Times published an article that references brands advertising on YouTube channels and videos where the primary intended audience of the channel or content is young children (referred to a “Made for Kids” content).

NYT Article: https://www.nytimes.com/2023/08/17/technology/youtube-google-children-privacy.html
The article references research by 3rd party, Adalytics, available here: https://adalytics.io/blog/are-youtube-ads-coppa-compliant

There are multiple issues identified in the story and the Adalytics report that are of concern relating both to privacy and brand safety:

1. Brand Safety & Suitability: Instances of ads appearing on “Made for Kid” channels intended for children (<13), including where the advertiser is using audience and behavioral targeting against a defined adult audience.
While there are instances where YouTube channel owners appear to have mislabeled their content, failing to flag that it is “Made for Kids” as required by YouTube’s terms, many of the examples referenced in the report relate to ads running on correctly labeled “Made for Kids” channels/content.

2. Privacy & Data Collection: The audience of “Made for Kids” channels is likely to be under 13 years of age, raising privacy issues for advertisers; for example, related to COPPA compliance.

• –  Advertising engagement (clicks) from these channels may be coming from minors.

• –  As a result, advertisers may have collected cookie data from children under 13 absent parental consent, transmitting this data to ad tech companies, and potentially including IDs associated with children in retargeting pools. Advertisers that run ads with the intention of reaching minors may restrict pixel placement of their site and configure campaigns to limit data collection; however, for advertisers that aim to reach adults, particularly in the US, this is generally not the case.

  3. Targeting Efficacy & Waste: There are also secondary issues identified including the reliability and accuracy of YouTube’s targeting parameters, with suggestions that Google may be using demographic, behavior, and other data to serve these ads.
  Several examples cited include advertisers leveraging audience and behavioral targeting to reach adults.

  Given YouTube’s commitment following their 2019 consent decree to not serve personalized ads on “Made for Kids” channels, there are questions as to whether audience and behavioral targeting operates effectively – e.g., where adult demo targeting is used yet ads are served on “Made for Kids” channels. Further, the methodology outlined by Adalytics (e.g. using incognito browsing, not logged into YT), and the findings echoed by the NY Times are clear that these ads on Made for Kids channels were delivered to non-logged in users – meaning that these are not instances where parents were targeted (notwithstanding that this would also be a violation of YouTube’s commitment stemming from their 2019 COPPA settlement to ‘treat personal information from anyone watching children’s content on the platform as coming from a child, regardless of the age of the user’). Similarly, the report identifies alleged instances where keyword exclusion appears ineffective – e.g., channels with “kids” in title are excluded, but ads still running on such channels.

  As YouTube was previously fined in 2019 by the FTC for alleged COPPA violations and has since committed to improving safeguards for children’s privacy on the platform, it is possible that the privacy-related observations may result in FTC review: https://www.ftc.gov/news-events/news/press- releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations-childrens-privacy-law

  Advertisers Impacted:

  The New York Times article references a number of brand advertisers, including BMO. The article also refers to research undertaken by 3rd party (Adalytics) and the Adalytics report also mentions the following IPG/MB clients:

  1. BMW
  2. Nike
  3. Amazon
  4. Dyson
  5. Intuit
  6. Terminix 7. Salesforce 8. Honda
  9. GAF

  For several of the above clients, the Adalytics report references that IPG/Matterkind placed the ad.
  The client list in the report is extensive, and if we missed a client it is not intentional. We encourage people to check the list themselves.

  Implications for Advertisers:

  The allegations in the article will require action and special attention as a result of the privacy implications and risk of regulatory action.
  As evidenced by the progression of the Kids Online Safety Act and COPPA 2.0 through the latest markup, President Biden’s calls for greater protection of children’s privacy, and recent FTC enforcement actions, the collection and use of children’s data, as well as appropriate advertising to children, are priorities for regulators and lawmakers.

  Further, it is important to note that the FTC has taken a broad view of the actual knowledge standard in recent enforcement actions and has pursued algorithmic disgorgement as a remedy in some such cases. For advertisers, this is particularly important to note as such a “disgorgement” order could impact historical data, CRM or other first party data, and retargeting pools.

  Beyond policy and legal risk, there is reputational and advocacy risk as children’s protections have become a rallying cry for conservative political advocates in the United States. Association with collection of children’s data has the potential to become a significant political issue area.
  Our initial analysis has corroborated that there are instances where personalized ads have run on videos that are “Made for Kids”; however, given the comprehensive nature of the report, further analysis is needed to determine the full extent of the impact.

  Action Underway:

We are reaching out to obtain clarity on the following:

1. Personalized Ads on MFK Channels: We are seeking clarity from Google given that their policies indicate that only contextual ads should appear on such channels, despite claims cited by The New York Times story and Adalytics research which suggests that the ads served may not have been contextual.

2. Placement Reporting: We are also reaching out to 3rd Party Verification Providers (3PV) like IAS and DV to see what data they may be able to provide on historical ad delivery against content Made for Kids.

3. PMAX: Given that the article references PMAX, where there are limitations on reporting available, we are also seeking clarity from Google on placement data.

4. Brand Safety & Suitability: As discussed above, according to YouTube’s commitments in 2019, personalized ads should not be served on MFK content at all. While the NYT article has stated that Google disputes claims that personalized ads are running on MFK content, based on the Adalytics report and our initial analysis, we cannot confidently accept this assertion at this time, and are seeking clarity from Google.

a. Keyword & Content Exclusion: The report references instances of keyword exclusion failure that warrant investigation. In addition, while Google references the “Content Suitable for Families” content exclusion control as a one-click means of opting out of MFK content, Google’s Brand Suitability Best Practices indicate that the “CSF” content exclusion filter is intended for advertisers in categories that cannot advertise to children at all – e.g. alcohol. This appears distinct from a more narrow control to exclude content classified as “Made for Kids” and extend to any “Family Friendly” content.

We are reaching out to Google to understand more about the scope of the “Content Suitable for Families” content exclusion filter, and why keyword exclusion appear to be failing.

Action Required by Clients/Advertisers:

We cannot rule out that advertiser data sets and the advertising ecosystem at large may have data of and from children and used this to inform audience targeting and retargeting strategies.
From our initial analysis, we have identified at least one such instance where a client’s adult-targeted campaign has run on a “Made for Kids” channel, and where in the event that a child clicked on the ad, pixels placed on the advertisers’ site would result in collection of data from a child, and inclusion of the ID associated with this child in retargeting pools, and within the “Audience Data” used to inform PMAX campaign targeting.

Further to this point, based on the reporting and research by Adalytics, it is unclear whether or to what extent PMAX campaign performance may appear artificially inflated by accidental or invalid engagement with the ads by children.

Given the findings in this report, the likelihood of regulatory scrutiny, and our observed instances of client’s adult targeted campaigns on MFK channels, we advise the following:

1. Evaluate placement reports to confirm exposure to MFK channels where behavioral/audience targeting are in use, to determine individual client impact.

2. We recommend an inclusion list strategy until Google provides clarification on their exclusion controls; and clients should consider whether a short-term pause is warranted until placement reports have been evaluated for exposure.

3. Evaluate and adjust brand safety and suitability levers.
   If clients decide to proceed in the absence of an inclusion list approach, brands targeting adults should ensure the following controls are in place:

   1. Exclude “Content Suitable for Families” content exclusion

   2. Keyword Exclusion

   3. Channel Exclusion

Placement reports should be evaluated daily to ensure that targeted ads are not running on MFK channels and that the controls are indeed effective.

4. Because placement reporting is not available for PMAX, we recommend that clients temporarily pause PMAX until the efficacy of the above controls are validated on non-PMAX campaigns where placement reporting is available.

5. Clients should consult with their legal, privacy/infosec, website, and data teams to consider potential exposure, and determine the appropriate process for identifying and removing data potentially collected from children.
   For example, advertisers may assess data in their CDPs that originated from YouTube as a traffic source.

6. These recommendations are being made on the basis of the probability of FTC scrutiny, as well as in light of the evidence of waste in advertising investment against unintended audiences.

Our team are in the process of further investigating this issue and seeking clarity from Google, as well as monitoring for potential regulatory response. Further updates will be shared as they become available.