Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Analysis

Authors: (1) Tinhinane Medjkoune, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG France; (2) Oana Goga, LIX, CNRS, Inria, Ecole Polytechnique, Institut Polytechnique de Paris France; (3) Juliette Senechal, Université de Lille, CRDP, DReDIS-IRJS France. Table of Links Abstract and Introduction Background Legislation on Advertising to Children Mechanisms for Targeting Children Usage of Placement-Based Targeting Limitations Related Works Conclusion, Acknowledgements and References Appendix ABSTRACT Many researchers and organizations, such as WHO and UNICEF, have raised awareness of the dangers of advertisements targeted at children. While most existing laws only regulate ads on television that may reach children, lawmakers have been working on extending regulations to online advertising and, for example, forbid (e.g., the DSA) or restrict (e.g., the COPPA) advertising based on profiling to children. At first sight, ad platforms such as Google seem to protect children by not allowing advertisers to target their ads to users that are less than 18 years old. However, this paper shows that other targeting features can be exploited to reach children. For example, on YouTube, advertisers can target their ads to users watching a particular video through placement-based targeting, a form of contextual targeting. Hence, advertisers can target children by simply placing their ads in children-focused videos. Through a series of ad experiments, we show that placement-based targeting is possible on children-focused videos and, hence, enables marketing to children. In addition, our ad experiments show that advertisers can use targeting based on profiling (e.g., interest, location, behavior) in combination with placement-based advertising on children-focused videos. We discuss the lawfulness of these two practices with respect to DSA and COPPA. Finally, we investigate to which extent real-world advertisers are employing placement-based targeting to reach children with ads on YouTube. We propose a measurement methodology consisting of building a Chrome extension able to capture ads and instrumenting six browser profiles to watch children-focused videos. Our results show that 7% of ads that appear in the children-focused videos we test use placement-based targeting. Hence, targeting children with ads on YouTube is not only hypothetically possible but also occurs in practice. We believe that the current legal and technical solutions are not enough to protect children from harm due to online advertising. A straightforward solution would be to forbid placement-based advertising on children-focused content. CCS CONCEPTS • Information systems → Online advertising. KEYWORDS YouTube, online advertising, children ACM Reference Format: Tinhinane Medjkoune, Oana Goga, and Juliette Senechal. 2023. Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS ’23), November 26–30, 2023, Copenhagen, Denmark. ACM, New York, NY, USA, 16 pages. https://doi.org/ 10.1145/3576915.3623172 1 INTRODUCTION Many researchers have studied how advertisements affect children since their television appearance and highlight their potential negative impact on children’s development and well-being [43]. One reason why advertisements can harm children is that their cognitive skills are underdeveloped. Children cannot distinguish an advertisement from a television program before age three and hence cannot fire the mental defenses adults have when seeing ads [56]. Only between the ages of 8 and 12 do children begin to understand the commercial ambitions of ads [61]. Nevertheless, even if they understand the underlying commercial intent, the attractive nature of advertisements makes children infatuated with them (see Section 7). As WHO & UNICEF put it in their 2020 report [11]: “Marketing to children is deliberate, strategic, innovative and well resourced, and exploits their developmental vulnerability.” Understandably, many laws across the World forbid or restrict children’s advertising. For example, in France, Article 7 of the decree of March 27, 1992, states that “advertising must not cause moral or physical harm to minors [...] it must not directly encourage minors to purchase a product or service by exploiting their inexperience or credulity [...]” and Article 15 of the same decree prohibits advertising breaks on television during children’s programs of less than 30 minutes [41]. While most existing laws have been set to protect children from television ads, legislators worldwide have been working on updating legislation to consider ads on social media and streaming platforms. Given the gravity of the problem, in this paper, we focus on understanding whether children can be targeted with ads on online streaming platforms. [1] For clarity, our work focuses not on whether children accidentally see ads while watching videos on online streaming platforms but on whether advertisers can intentionally target them with ads. We take YouTube as a case study as it is one of the most used online platforms for children [10, 55]. Understanding how and if advertisers can reach children is essential for understanding what risks targeting technologies bring to children, understanding what transparency we need, and helping inform lawmakers with adapted restrictions. We review in Section 3 legal acts that relate to advertising to children in the U.S. and Europe to understand what is currently legally allowed, forbidden, or restricted. In particular, we examine the Children’s Online Privacy Protection Rule (COPPA) in the U.S. [23] and the Digital Services Act, a new Regulation voted on 19 October 2022 at the European Union level [46]. The COPPA Act does not prohibit advertising to children; however, it places some restrictions on it: it states that advertisers and content owners may not collect any personal information (which includes cookies and other persistent identifiers) from children under 13 years of age without verifiable parental consent. Hence, COPPA restricts online platforms’ capabilities to serve profile-based ads to children but does not restrict contextual-based advertising. The DSA takes a step further and forbids altogether targeting children with ads based on profiling (e.g., interest, location, behavior). On the technical side, ad platforms have also deployed solutions to protect children from online marketing. For example, the advertising interface on Google does not allow advertisers to target users less than 18 years old [30]. In addition, Google launched YouTube Kids in 2015. This platform only contains content (videos and ads) filtered explicitly for children. Content creators and advertisers cannot explicitly ask for their videos or ads to be shown on YouTube Kids. YouTube curates content in an independent way (see Section 2) [28]. As there is no direct way to target children on YouTube Kids, this paper focuses on targeting mechanisms that allow advertisers to target children on YouTube. This choice is consequential because content available on YouTube Kids is also available on YouTube, and previous studies showed parents use YouTube more frequently than YouTube Kids to let their children watch videos [37]. First, we investigate what targeting mechanisms can be exploited to target children with ads on YouTube (see Section 4). We find that, Google allows advertisers to target their ads to users watching a particular video through placement-based targeting, a form of contextual advertising. Hence, advertisers could target children by simply placing their ads in children-focused videos. Through a series of real-world ad experiments, we show that placementbased targeting is allowed on a set of children-focused videos we curated from YouTube Kids, hence, enabling marketing to children. In addition, through four other ad campaigns, we show that placement-based targeting on children-focused videos can be used in combination with targeting based on profiling.[2] According to our legal analysis, placement-based targeting on children-focused videos is not forbidden by either the COPPA or the DSA; however, the use of profiling for targeting children is forbidden in the DSA and might be (as the text is not clear in this respect) forbidden in the COPPA as well. Hence, combining placement-based targeting with targeting based on profiling is against these rules. Second, we investigate if advertisers exploit these targeting mechanisms to reach children in the wild (see Section 5). For this, we propose a measurement methodology that consists of building a Chrome extension that can collect data about the ads shown on YouTube videos and instrument six browser profiles to watch children-focused videos. Using this approach, we collected 3,321 ads that appear on 620 videos. Next, given an ad shown on a particular video, the challenge is to distinguish whether the ad was targeted based on contextual parameters (e.g., placement-based), based on profiling parameters (e.g., behavior, interest, location), or based on other parameters such as time and language. We find a simple yet effective way to make the distinction by exploiting the ad explanations provided in the “Why you’re seeing this ad” feature [35]. Our analysis shows that 7% of the ads we collected while watching two sets of children-focused videos (across the six profiles) had an ad explanation suggesting the advertiser used placement-based targeting. In addition, 25% of ads collected on children-focused videos had ad explanations suggesting they have been targeted based on profiling. While these numbers are not representative and are obtained over a small scale dataset, they show that targeting children is not only hypothetically possible but also appears to occur in practice. Finally, we observe that YouTube provides a reduced level of transparency for ads on YouTube videos labeled as being suitable for children[3] compared to other videos (see Section 5.3). To validate this, we created an ad campaign and instructed Google to use placement-based targeting and show it on ten videos sourced from YouTube Kids and ten adult-focused videos. Whenever our ad was shown on adult-focused videos, it had the ad explanation, “The video you are watching.” that reflected precisely our targeting parameters. However, on the children-focused videos sourced from YouTube Kids, the explanation was: “Personalization is disabled for this account or content. Therefore, this ad is not personalized based on your data. Its distribution depends on other factors (such as the time or your geographical position)”. While this explanation is not necessarily wrong, it does not reflect the precise targeting parameters we used in our ad campaign. Hence, for the same ad campaign (and the same targeting parameters) and the same profile watching the video, Google showed different ad explanations depending on whether the video was present on YouTube Kids or not. Therefore, not only can children be targeted with ads through placement-based advertising, the ad explanations provided on children-focused videos do not reflect the use of such targeting. The implications of this study are multi-faceted. Since many countries are updating their legislation to protect children from online harm, we hope our paper clarifies how advertisers can reach children online and provides valuable technical insights. In particular, we want to raise awareness that advertisers can reach children through placement-based advertising. While the DSA and the COPPA do not currently forbid this practice, we think regulators have not realized that contextual advertising can be done at the granularity of the video the user is watching and, hence, can be used to reach children watching well chosen sets of videos that could be indicators of their age, gender, or interests. Even worse, current online advertising legislation is missing clear guidelines on the ad content that can be targeted at children (as in the case of television advertising); this is important to clarify, especially since placement-based advertising is currently allowed. We believe that the current legal and technical solutions are not enough to protect children from harm due to online advertising. We recommend that: (1) Regulators and ad platforms should simply forbid placement-based advertising on children-focused content. (2) Regulators should set clear guidelines on the ad content that can be shown on children-focused content, including ads that are shown because they were targeted at children-focused content or ads that appear there by chance and use other targeting parameters. (3) When addressing Article 39 (Additional online advertising transparency) in the DSA, ad platforms should include, for all ads, whether the advertiser used placement-based targeting and provide the complete list of placements used by the advertiser. This will enable researchers to check if the ads’ content is harmful to the chosen audience. (4) Ad platforms should provide consistent ad explanations for the same ad. Ad explanations should not be generated on the fly based on the content watched or the profile of the user watching. In addition, we believe that the current ad explanations provided by Google on children-focused videos are misleading and not “meaningful” as demanded in Article 26 of the DSA. At last, we want to salute efforts from online platforms to provide data about how their systems work, including explanations of why users receive particular ads and detailed statistics on ad delivery. Without such platform-provided data, this auditing study could not have been performed. This paper is available on arxiv under CC 4.0 license. [1] By targeting children, we refer to any means an advertiser can exploit features provided by online advertising platforms to reach an audience made mostly of children; hence, targeting does not necessarily mean micro-targeting or profiling. [2] For example, target users interested in Sports that are watching the video “Peppa Learns How To Whistle.” [3] These YouTube videos have a redirection to YouTube Kids as shown in Figure 2 in appendix just below the video content. Authors: (1) Tinhinane Medjkoune, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG France; (2) Oana Goga, LIX, CNRS, Inria, Ecole Polytechnique, Institut Polytechnique de Paris France; (3) Juliette Senechal, Université de Lille, CRDP, DReDIS-IRJS France. Authors: Authors: (1) Tinhinane Medjkoune, Univ. Grenoble Alpes, CNRS, Grenoble INP, LIG France; (2) Oana Goga, LIX, CNRS, Inria, Ecole Polytechnique, Institut Polytechnique de Paris France; (3) Juliette Senechal, Université de Lille, CRDP, DReDIS-IRJS France. Table of Links Abstract and Introduction Abstract and Introduction Background Background Legislation on Advertising to Children Legislation on Advertising to Children Mechanisms for Targeting Children Mechanisms for Targeting Children Usage of Placement-Based Targeting Usage of Placement-Based Targeting Limitations Limitations Related Works Related Works Conclusion, Acknowledgements and References Conclusion, Acknowledgements and References Appendix Appendix ABSTRACT Many researchers and organizations, such as WHO and UNICEF, have raised awareness of the dangers of advertisements targeted at children. While most existing laws only regulate ads on television that may reach children, lawmakers have been working on extending regulations to online advertising and, for example, forbid (e.g., the DSA) or restrict (e.g., the COPPA) advertising based on profiling to children. At first sight, ad platforms such as Google seem to protect children by not allowing advertisers to target their ads to users that are less than 18 years old. However, this paper shows that other targeting features can be exploited to reach children. For example, on YouTube, advertisers can target their ads to users watching a particular video through placement-based targeting, a form of contextual targeting. Hence, advertisers can target children by simply placing their ads in children-focused videos. Through a series of ad experiments, we show that placement-based targeting is possible on children-focused videos and, hence, enables marketing to children. In addition, our ad experiments show that advertisers can use targeting based on profiling (e.g., interest, location, behavior) in combination with placement-based advertising on children-focused videos. We discuss the lawfulness of these two practices with respect to DSA and COPPA. Finally, we investigate to which extent real-world advertisers are employing placement-based targeting to reach children with ads on YouTube. We propose a measurement methodology consisting of building a Chrome extension able to capture ads and instrumenting six browser profiles to watch children-focused videos. Our results show that 7% of ads that appear in the children-focused videos we test use placement-based targeting. Hence, targeting children with ads on YouTube is not only hypothetically possible but also occurs in practice. We believe that the current legal and technical solutions are not enough to protect children from harm due to online advertising. A straightforward solution would be to forbid placement-based advertising on children-focused content. CCS CONCEPTS • Information systems → Online advertising. • Information systems → Online advertising. KEYWORDS YouTube, online advertising, children ACM Reference Format: ACM Reference Format: Tinhinane Medjkoune, Oana Goga, and Juliette Senechal. 2023. Marketing to Children Through Online Targeted Advertising: Targeting Mechanisms and Legal Aspects. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security (CCS ’23), November 26–30, 2023, Copenhagen, Denmark. ACM, New York, NY, USA, 16 pages. https://doi.org/ 10.1145/3576915.3623172 1 INTRODUCTION Many researchers have studied how advertisements affect children since their television appearance and highlight their potential negative impact on children’s development and well-being [43]. One reason why advertisements can harm children is that their cognitive skills are underdeveloped. Children cannot distinguish an advertisement from a television program before age three and hence cannot fire the mental defenses adults have when seeing ads [56]. Only between the ages of 8 and 12 do children begin to understand the commercial ambitions of ads [61]. Nevertheless, even if they understand the underlying commercial intent, the attractive nature of advertisements makes children infatuated with them (see Section 7). As WHO & UNICEF put it in their 2020 report [11]: “Marketing to children is deliberate, strategic, innovative and well resourced, and exploits their developmental vulnerability.” Understandably, many laws across the World forbid or restrict children’s advertising. For example, in France, Article 7 of the decree of March 27, 1992, states that “advertising must not cause moral or physical harm to minors [...] it must not directly encourage minors to purchase a product or service by exploiting their inexperience or credulity [...]” and Article 15 of the same decree prohibits advertising breaks on television during children’s programs of less than 30 minutes [41]. While most existing laws have been set to protect children from television ads, legislators worldwide have been working on updating legislation to consider ads on social media and streaming platforms. Given the gravity of the problem, in this paper, we focus on understanding whether children can be targeted with ads on online streaming platforms. [1] For clarity, our work focuses not on whether children accidentally see ads while watching videos on online streaming platforms but on whether advertisers can intentionally target them with ads. We take YouTube as a case study as it is one of the most used online platforms for children [10, 55]. Understanding how and if advertisers can reach children is essential for understanding what risks targeting technologies bring to children, understanding what transparency we need, and helping inform lawmakers with adapted restrictions. We review in Section 3 legal acts that relate to advertising to children in the U.S. and Europe to understand what is currently legally allowed, forbidden, or restricted. In particular, we examine the Children’s Online Privacy Protection Rule (COPPA) in the U.S. [23] and the Digital Services Act, a new Regulation voted on 19 October 2022 at the European Union level [46]. The COPPA Act does not prohibit advertising to children; however, it places some restrictions on it: it states that advertisers and content owners may not collect any personal information (which includes cookies and other persistent identifiers) from children under 13 years of age without verifiable parental consent. Hence, COPPA restricts online platforms’ capabilities to serve profile-based ads to children but does not restrict contextual-based advertising. The DSA takes a step further and forbids altogether targeting children with ads based on profiling (e.g., interest, location, behavior). On the technical side, ad platforms have also deployed solutions to protect children from online marketing. For example, the advertising interface on Google does not allow advertisers to target users less than 18 years old [30]. In addition, Google launched YouTube Kids in 2015. This platform only contains content (videos and ads) filtered explicitly for children. Content creators and advertisers cannot explicitly ask for their videos or ads to be shown on YouTube Kids. YouTube curates content in an independent way (see Section 2) [28]. As there is no direct way to target children on YouTube Kids, this paper focuses on targeting mechanisms that allow advertisers to target children on YouTube. This choice is consequential because content available on YouTube Kids is also available on YouTube, and previous studies showed parents use YouTube more frequently than YouTube Kids to let their children watch videos [37]. First, we investigate what targeting mechanisms can be exploited to target children with ads on YouTube (see Section 4). We find that, Google allows advertisers to target their ads to users watching a particular video through placement-based targeting, a form of contextual advertising. Hence, advertisers could target children by simply placing their ads in children-focused videos. Through a series of real-world ad experiments, we show that placementbased targeting is allowed on a set of children-focused videos we curated from YouTube Kids, hence, enabling marketing to children. In addition, through four other ad campaigns, we show that placement-based targeting on children-focused videos can be used in combination with targeting based on profiling.[2] According to our legal analysis, placement-based targeting on children-focused videos is not forbidden by either the COPPA or the DSA; however, the use of profiling for targeting children is forbidden in the DSA and might be (as the text is not clear in this respect) forbidden in the COPPA as well. Hence, combining placement-based targeting with targeting based on profiling is against these rules. Second, we investigate if advertisers exploit these targeting mechanisms to reach children in the wild (see Section 5). For this, we propose a measurement methodology that consists of building a Chrome extension that can collect data about the ads shown on YouTube videos and instrument six browser profiles to watch children-focused videos. Using this approach, we collected 3,321 ads that appear on 620 videos. Next, given an ad shown on a particular video, the challenge is to distinguish whether the ad was targeted based on contextual parameters (e.g., placement-based), based on profiling parameters (e.g., behavior, interest, location), or based on other parameters such as time and language. We find a simple yet effective way to make the distinction by exploiting the ad explanations provided in the “Why you’re seeing this ad” feature [35]. Our analysis shows that 7% of the ads we collected while watching two sets of children-focused videos (across the six profiles) had an ad explanation suggesting the advertiser used placement-based targeting. In addition, 25% of ads collected on children-focused videos had ad explanations suggesting they have been targeted based on profiling. While these numbers are not representative and are obtained over a small scale dataset, they show that targeting children is not only hypothetically possible but also appears to occur in practice. Finally, we observe that YouTube provides a reduced level of transparency for ads on YouTube videos labeled as being suitable for children[3] compared to other videos (see Section 5.3). To validate this, we created an ad campaign and instructed Google to use placement-based targeting and show it on ten videos sourced from YouTube Kids and ten adult-focused videos. Whenever our ad was shown on adult-focused videos, it had the ad explanation, “The video you are watching.” that reflected precisely our targeting parameters. However, on the children-focused videos sourced from YouTube Kids, the explanation was: “Personalization is disabled for this account or content. Therefore, this ad is not personalized based on your data. Its distribution depends on other factors (such as the time or your geographical position)”. While this explanation is not necessarily wrong, it does not reflect the precise targeting parameters we used in our ad campaign. Hence, for the same ad campaign (and the same targeting parameters) and the same profile watching the video, Google showed different ad explanations depending on whether the video was present on YouTube Kids or not. Therefore, not only can children be targeted with ads through placement-based advertising, the ad explanations provided on children-focused videos do not reflect the use of such targeting. The implications of this study are multi-faceted. Since many countries are updating their legislation to protect children from online harm, we hope our paper clarifies how advertisers can reach children online and provides valuable technical insights. In particular, we want to raise awareness that advertisers can reach children through placement-based advertising. While the DSA and the COPPA do not currently forbid this practice, we think regulators have not realized that contextual advertising can be done at the granularity of the video the user is watching and, hence, can be used to reach children watching well chosen sets of videos that could be indicators of their age, gender, or interests. Even worse, current online advertising legislation is missing clear guidelines on the ad content that can be targeted at children (as in the case of television advertising); this is important to clarify, especially since placement-based advertising is currently allowed. We believe that the current legal and technical solutions are not enough to protect children from harm due to online advertising. We recommend that: (1) Regulators and ad platforms should simply forbid placement-based advertising on children-focused content. (2) Regulators should set clear guidelines on the ad content that can be shown on children-focused content, including ads that are shown because they were targeted at children-focused content or ads that appear there by chance and use other targeting parameters. (3) When addressing Article 39 (Additional online advertising transparency) in the DSA, ad platforms should include, for all ads, whether the advertiser used placement-based targeting and provide the complete list of placements used by the advertiser. This will enable researchers to check if the ads’ content is harmful to the chosen audience. (4) Ad platforms should provide consistent ad explanations for the same ad. Ad explanations should not be generated on the fly based on the content watched or the profile of the user watching. In addition, we believe that the current ad explanations provided by Google on children-focused videos are misleading and not “meaningful” as demanded in Article 26 of the DSA. At last, we want to salute efforts from online platforms to provide data about how their systems work, including explanations of why users receive particular ads and detailed statistics on ad delivery. Without such platform-provided data, this auditing study could not have been performed. This paper is available on arxiv under CC 4.0 license. This paper is available on arxiv under CC 4.0 license. available on arxiv [1] By targeting children, we refer to any means an advertiser can exploit features provided by online advertising platforms to reach an audience made mostly of children; hence, targeting does not necessarily mean micro-targeting or profiling. [2] For example, target users interested in Sports that are watching the video “Peppa Learns How To Whistle.” [3] These YouTube videos have a redirection to YouTube Kids as shown in Figure 2 in appendix just below the video content.