YouTube’s iOS App May Be Tracking Users Without Consent, Raising Privacy Concerns

YouTube’s iOS app may be tracking users without their consent, according to a recent study by Adalytics. The research found that YouTube’s app appends an identifier called WBraid to users who watch and click on ads, allowing the platform to track their behavior without obtaining explicit permission. This raises questions about whether YouTube is complying with industry privacy standards and Apple’s App Tracking Transparency (ATT) policy.

The study, conducted by head researcher Krzysztof Franaszek, observed over 300 clicks to ads on YouTube and found that the platform never asked for consent to track users. The WBraid identifier, which is designed to attribute conversions back to ad campaigns, is then shared with other trackers and data brokers that communicate with the website. Each WBraid appeared to be unique to each click on the ad, with the code changing significantly each time.

Mobile ad-tech consultant Thomas Petit raised concerns about the non-compliance of YouTube’s tracking practices with ATT, as the platform does not ask for user consent and offloads the responsibility onto advertisers. Google, which owns YouTube, has denied allegations of improper tracking of children on the platform but is facing scrutiny from regulators regarding its data practices.

Laura Edelson, a postdoctoral researcher at New York University, suggested that the use of WBraid may violate Apple’s ATT policy, which requires user consent for tracking within in-app browsers and prohibits the use of unique identifiers for ad targeting without permission. Google claims that WBraid is a privacy-compliant identifier used for measurement purposes and does not identify individual users.

Despite the ambiguity surrounding Google’s relationship with ATT, YouTube has not implemented consent prompts post-ATT, unlike other apps. Mobile ad-tech experts have debated the compliance of Google’s tracking practices with ATT, with some questioning whether the platform is violating the spirit of the policy. However, the debate remains inconclusive, as Google has not shared details about the technology it uses to avoid showing the ATT prompt.

The findings of the study highlight the challenges of balancing user privacy with targeted advertising practices in the digital age. As regulators continue to scrutinize big tech companies like Google, the advertising community is left questioning how much they can trust these platforms with their data.