IPG Mediabrands ‘privacy alert’ says clients should ‘consider’ a pause on Google ads product

• An IPG Mediabrands team issued a ‘privacy alert’ email across the agency on Thursday.
• It followed a report that alleged YouTube ads may have led to the improper tracking of kids online.
• Google has disputed the report; IPG MB memo suggested a pause on Performance Max ads.

Following the publication of a report that found ads on YouTube could have led to the improper tracking of children online, IPG Mediabrands advised clients that they “should consider” pausing campaigns using Google’s ad product Performance Max.

The New York Times reported Thursday that Adalytics research found that YouTube served ads from more than 300 brands on YouTube channels with videos labeled as “made for kids” — even when the advertiser had specifically targeted an adult audience.

When viewers clicked on those ads, they were taken to the advertiser’s website, which on occasion dropped tracking software known as cookies on the user’s browser from companies such as Google, Meta, and other data brokers, according to the researchers.

According to the report, these YouTube campaigns may have inadvertently put advertisers and the companies dropping those tracking cookies in violation of the Children’s Online Privacy Protection Act. The law, known as the Children’s Online Privacy Protection Act, requires online services to obtain parental consent before collecting personal information from children under the age of 13 for purposes such as targeted advertising. Although Adalytics was unable to determine how the cookies were being used, it based its analysis on placement reports campaigns that exclusively used behavioral audience segment targeting.

The report also questioned Google’s public statements that it had stopped serving personalized ads on children’s content on the video platform. In 2019, Google and YouTube agreed to pay a $170 million fine to settle FTC allegations that they had illegally collected personal data from children in order to profit from ad targeting.

Google has disputed the Adalytics report, with a spokesperson telling Insider that it is “deeply flawed and misleading.” According to the statement, the report reached “uninformed conclusions based solely on the presence of cookies.” It stated that cookies in this context are widely used for purposes such as fraud detection or ensuring that the same ad is not served to the same person too many times, which is permitted under COPPA.

Google stated that based on the portions of the report shared with The New York Times prior to publication, it found no violations of its policies and that advertisers can use a setting to prevent their ads from appearing on children’s videos.

However, IPG Mediabrands staffers emailed a “brand safety and privacy alert” to the entire agency on Thursday, a copy of which Insider obtained and can be read in full below. It claims that based on its preliminary investigation, it discovered at least one instance of a client’s adult-targeted campaign running on a “made for kids” channel. If a child clicked on the ad, tracking pixels on the advertiser’s site would have collected data from the child, and the associated ID could have been used to inform Google’s Performance Max targeting, according to the email.

As a result, the IPG Mediabrands alert advised clients to temporarily pause Performance Max campaigns while they validated the effectiveness of YouTube’s brand safety controls, which allow advertisers to exclude specific keywords, channels, and “content suitable for families,” according to the email. It stated that its recommendations, which included using a “inclusion list strategy” to only target appropriate channels, were made in light of the possibility of FTC scrutiny and to avoid wasting money on unintended audiences. According to its website, IPG Mediabrands manages approximately $40 billion in marketing investment globally on behalf of its clients.

According to an IPG Mediabrands spokesperson, recommending a pause on any Google product is incorrect.

Launched in 2020, Performance Max is a critical advertising tool for Google, and executives at parent company Alphabet’s earnings calls frequently mention it as a growth driver. Advertisers specify a goal, such as sales, leads, or in-store visits, and Google optimizes the campaign for the best placements across YouTube, display ads, search, Gmail, Maps, and other Google properties.

Google claims that Performance Max helps advertisers achieve better results on average, but some in the advertising community are skeptical because the product aggregates the results and does not provide breakdowns of where the ads actually ran.

“The premise of Performance Max appears to be ‘give us your budget and we will give you performance, don’t worry about anything else,'” said Ruben Schreurs, chief strategy officer of marketing consulting firm Ebiquity.

“What worries me about this Adalytics report is that Performance Max campaigns have allegedly been observed running on made-for-children inventory,” Schreurs said. “Most media buyers understand that inventory aimed at children or elderly audiences will generate a large number of clicks, which will score well against vanity performance metrics but will not generate any actual business value.”

Senators Edward J. Markey, a Democrat from Massachusetts, and Marsha Blackburn, a Republican from Tennessee, wrote to the FTC on Thursday, urging it to investigate whether Google violated COPPA based on Adalytics’ findings, according to The New York Times.

“YouTube and Google cannot continue to treat young people’s data as a commodity from which they can profit recklessly,” the letter stated. “Not only does the FTC need to act, but Congress needs to pass legislation to protect young people’s online privacy and finally prohibit targeting advertising to kids and teens.”

Full IPG Mediabrands Privacy Alert letter:

Partner: YouTube

Background:

On Thursday, August 17th, the New York Times published an article referencing brands advertising on YouTube channels and videos whose primary intended audience is young children (referred to as “Made for Kids” content).

• From the New York Times: https://www.nytimes.com/2023/08/17/technology/youtube-google-children-privacy.html*
• The article refers to Adalytics research, which is available here: https://adalytics.io/blog/are-youtube-ads-coppa-compliant*

There are several issues raised in the story and the Adalytics report that are concerning in terms of both privacy and brand safety:

1. Brand Safety & Suitability: Ads appearing on “Made for Kid” channels aimed at children (13), including instances where the advertiser is using audience and behavioral targeting against a defined adult audience.

While there appear to be instances where YouTube channel owners mislabeled their content, failing to flag it as “Made for Kids” as required by YouTube’s terms, many of the examples cited in the report relate to ads running on correctly labeled “Made for Kids” channels/content.

2. Privacy & Data Collection: The audience of “Made for Kids” channels is likely to be under the age of 13, raising privacy concerns for advertisers, such as COPPA compliance.

• Advertising engagement (clicks) from these channels may be coming from minors.
• As a result, advertisers may have collected cookie data from children under 13, transmitting this data to ad tech companies, and potentially including IDs associated with children in retargeting pools, without parental consent. Advertisers who run ads with the intent of reaching minors may restrict pixel placement on their site and configure campaigns to limit data collection; however, this is generally not the case for advertisers who aim to reach adults, particularly in the United States.Action Is In Progress:

3. Targeting Efficacy & Waste: Secondary issues have been identified, such as the dependability and accuracy of YouTube’s targeting parameters, with suggestions that Google may be using demographic, behavior, and other data to serve these ads.

Advertisers using audience and behavioral targeting to reach adults is one of several examples given.

With YouTube’s commitment to not serve personalized ads on “Made for Kids” channels following their 2019 consent decree, there are questions about whether audience and behavioral targeting works effectively – for example, where adult demo targeting is used but ads are served on “Made for Kids” channels. Furthermore, the methodology outlined by Adalytics (e.g., using incognito browsing, not logged into YT) and the findings echoed by the NY Times are clear that these ads on Made for Kids channels were delivered to non-logged in users – indicating that parents were not targeted (despite the fact that this would also be a violation of YouTube’s commitment stemming from their 2019 COPPA settlement to ‘treat personal information from anyone watching children’). Similarly, the report identifies alleged cases where keyword exclusion appears ineffective – for example, channels with the title “kids” are excluded, but ads continue to run on such channels.

Because YouTube was previously fined by the FTC in 2019 for alleged COPPA violations and has since committed to improving safeguards for children’s privacy on the platform, the privacy-related observations may result in FTC review: https://www.ftc.gov/news-events/news/press- releases/2019/09/google-youtube-will-pay-record-170-million-alleged-violations-childrens-privacy-law

Advertisers Affected:

A number of brand advertisers, including BMO, are mentioned in the New York Times article. The article also refers to third-party research (Adalytics), and the Adalytics report mentions the following IPG/MB clients:

1. BMW

2. Nike

3. Amazon

4. Dyson

5. Intuit

6. Terminix 7. Salesforce 8. Honda

9. GAF

The Adalytics report for several of the above clients mentions that the ad was placed by IPG/Matterkind.

The client list in the report is extensive, and any omissions were unintentional. We encourage people to double-check the list.

Advertiser Implications:

Because of the privacy implications and the risk of regulatory action, the allegations in the article will necessitate action and special attention.

As evidenced by the latest markup of the Kids Online Safety Act and COPPA 2.0, President Biden’s calls for greater protection of children’s privacy, and recent FTC enforcement actions, regulators and lawmakers prioritize the collection and use of children’s data, as well as appropriate advertising to children.

It is also worth noting that in recent enforcement actions, the FTC has taken a broad view of the actual knowledge standard and has pursued algorithmic disgorgement as a remedy in some cases. This is especially important for advertisers to understand because a “disgorgement” order could have an impact on historical data, CRM or other first-party data, and retargeting pools.

There is reputational and advocacy risk in addition to policy and legal risk, as children’s protections have become a rallying cry for conservative political advocates in the United States. The collection of data on children has the potential to become a significant political issue.

Our preliminary analysis has confirmed that personalized ads have run on “Made for Kids” videos; however, given the comprehensive nature of the report, additional analysis is required to determine the full extent of the impact.

We’re contacting you to get clarification on the following:

1. Personalized Ads on MFK Channels: We are requesting clarification from Google because their policies state that only contextual ads should appear on such channels, despite claims in The New York Times story and Adalytics research that the ads served may not have been contextual.
2. Placement Reporting: We are also contacting 3rd Party Verification Providers (3PV) such as IAS and DV to see what data they may be able to provide on historical ad delivery against Made for Kids content.
3. PMAX: Because the article mentions PMAX, which has reporting limitations, we are also seeking clarification from Google on placement data.
4. Brand Safety & Suitability: As previously stated, personalized ads should not be served on MFK content at all, according to YouTube’s commitments in 2019. While the NYT article stated that Google disputes claims that personalized ads are running on MFK content, we cannot confidently accept this assertion at this time based on the Adalytics report and our preliminary analysis, and are seeking clarification from Google.

a. Keyword & Content Exclusion: The report cites instances of keyword exclusion failure that merit further investigation. Furthermore, while Google refers to the “Content Suitable for Families” content exclusion control as a one-click way to opt out of MFK content, Google’s Brand Suitability Best Practices state that the “CSF” content exclusion filter is intended for advertisers in categories that cannot advertise to children at all, such as alcohol. This appears to be distinct from a more narrow control that excludes “Made for Kids” content and extends to all “Family Friendly” content.

We are contacting Google to learn more about the scope of the “Content Suitable for Families” content exclusion filter, as well as why keyword exclusion appears to be failing.

We cannot rule out the possibility that advertiser data sets and the advertising ecosystem as a whole contain data about and from children that can be used to inform audience targeting and retargeting strategies.

Based on our preliminary analysis, we have identified at least one such instance in which a client’s adult-targeted campaign ran on a “Made for Kids” channel, and where, if a child clicked on the ad, pixels placed on the advertisers’ site resulted in the collection of data from a child, and the inclusion of the ID associated with this child in retargeting pools, and within the “Audience Data” used to inform PMAX campaign targeting.

Further, based on Adalytics’ reporting and research, it is unclear whether or to what extent PMAX campaign performance may appear artificially inflated by children’s accidental or invalid engagement with the ads.

In light of the findings in this report, the likelihood of regulatory scrutiny, and our observations of adult targeted campaigns on MFK channels, we recommend the following:

1. Evaluate placement reports to confirm exposure to MFK channels where behavioral/audience targeting is in use, in order to determine individual client impact.
2. We recommend an inclusion list strategy until Google clarifies their exclusion controls, and clients should consider whether a short-term pause is necessary until placement reports have been evaluated for exposure.
3. Assess and fine-tune brand safety and suitability levers. If clients decide to proceed in the absence of an inclusion list approach, brands aimed at adults should implement the following safeguards:
   1. Content exclusion for “Content Suitable for Families”
   2. Exclusion of Keywords
   3. Exclusion of Channels

Placement reports should be reviewed on a daily basis to ensure that targeted ads are not running on MFK channels and that controls are in place.

1. Because placement reporting is not available for PMAX, we recommend that clients temporarily pause PMAX until the efficacy of the above controls is validated on non-PMAX campaigns with placement reporting.
2. Clients should consult with their legal, privacy/infosec, website, and data teams to assess potential exposure and determine the best process for identifying and removing data that may have been collected from children. Advertisers, for example, may evaluate data in their CDPs that originated from YouTube as a traffic source.
3. These recommendations are based on the likelihood of FTC scrutiny, as well as evidence of waste in advertising investment against unintended audiences.

Our team is currently investigating this issue further and seeking clarification from Google, as well as monitoring for potential regulatory response. More information will be provided as it becomes available.