Who competes with Ideo

YouTube video platform

Reading time: 13 minutes

description

YouTube is probably the best-known video platform on the internet. The platform is also of great interest to schools, both as a source of content and as a way to publish your own content. The subsidiary of Google or Alphabet impresses above all with the free, almost endless range of films in every language and on all topics. If desired, mostly machine-generated, but quite precise subtitles can be displayed. For various reasons, the media portals of the federal states can hardly compete with this. And so YouTube videos are used again and again in the classroom as well as in home preparation.

This data protection check should only deal with the consuming use of YouTube without a separate user account with Google and thus without the possibility of publishing your own content or commenting on other content. Possibilities are also to be presented to use YouTube in a (more) privacy-friendly manner.

YouTube can be used via the browser. Videos can also be easily embedded in other websites. Many platforms offer simple options for doing this. The provider's YouTube apps are available for mobile devices with iOS and Android operating systems. If videos are accessed directly from YouTube.com, they are usually played on mobile devices via the installed YouTube app. Videos embedded on websites, on the other hand, can be played directly in the browser.

When you view YouTube videos without your own Google account or with a login to a Google account but without a subscription, advertising can appear in various places in the video1A distinction is made between pre-roll and mid-roll. Pre-roll is shown before the actual film begins and can only be skipped once a certain part of the advertising has expired. A distinction is also made between video advertising and banner advertising. The latter appears as an overlay over the video and can be clicked away. are displayed. Whether, which and how much advertising is displayed depends on the length of the video, the content, the user and also the owner of the channel.

There is no specific privacy policy for YouTube. Instead, the link on the YouTube homepage refers to Google's privacy policy, to which the video service belongs. The data protection declaration is quite extensive and enriched with videos and graphics to make it easier to understand. If you have perseverance, you will find all information about data collection and processing by Google services via numerous links and additional searches in the documentation for various Google tools. Also of interest in connection with the use of YouTube videos are the terms of use, which, among other things, also describe the age from which the service can be used. First and foremost, it is about using your own account.

The documentation also provides information on how users can influence data collection by Google, be it via cookie settings in the browser or settings in the user account for registered users.

Privacy

Server location, provider

YouTube, a subsidiary of Google / Alphabet, is a US company. The European headquarters are in Ireland. To provide the service, Youtube uses Google server farms with locations in different countries. Around half of all server locations are in the USA, and almost as many locations are in Europe. There are also a few locations in other countries.

Cookies, tracking

To provide the services, YouTube stores a number of data. In the case of registered users, these are allocated to the user account and used. However, data is also collected and used without registration, and this is important in connection with this data protection check. In the data protection declaration it says:

"If you are not logged into a Google account, we save the data we collect with unique identifiers that are linked to the browser, app or device you are using. This enables us, for example, to ensure that your language settings are retained in all browser sessions. "

These unique identifiers, better known as Unique IDs, are described as follows:

A unique ID is a string of characters that can be used to uniquely identify a browser, app, or device. Such IDs have different usage times and differ in whether they can be reset by the user and how the user can access them. "

The various unique IDs have different functions, ranging from storing settings to displaying "relevant advertising". Relevant means personalized advertising. The personalization can also take place without Google being able to assign the unique ID to an identifiable person. It is sufficient if information from user behavior and metadata about the device, system, etc. is collected for this ID.

If a video is embedded in a website in the normal way, 13 requests to 5 unique hosts are determined after an analysis with WebbkollDatatskydd, all of which can be assigned to Google or YouTube. This also includes Doubleclick.net the Google advertising network. A cookie called IDE can be found at Doubleclick.net. This is the most important cookie that Google uses on third-party sites to display relevant advertising across different websites.2“We also use cookies for advertisements that we display in various places on the web. Our most important cookie for ad preferences for websites that do not belong to Google is called "IDE". It is stored in browsers under the domain doubleclick.net. Another cookie is stored under the domain google.com and is called “ANID”. We also use other cookies, such as B. "DSID", "FLC", "AID", "TAID" and "exchange_uid". Other Google products such as YouTube may also use these cookies to select more relevant advertising. ”Source: https://policies.google.com/technologies/types?hl=de-de
A nice overview of the various cookies that Google uses in connection with YouTube and DoubleClick.net can be found at https://www.digital.man/de/en/general/cookies.html The IDE cookie in the test case with the character string AHWqTUm9dtyTA3xlZUv0dqjaYvtJNRdxyxnZ-FQ5c53n_dKDWqZaSQ2NMEAASzzV is an example of a unique ID as used in the browser. It is valid for 10 years! The Doubleclick.net cookies are used to control the display of advertising in videos and then to display advertising on websites. When visiting websites that have Doubleclick.net services running in the background, the user is recognized by the cookie, even if this user does not necessarily have to be assigned to an identifiable person.

Brave Browser shows at least 12 cross-website trackers when playing an embedded video3The number can change upwards when pausing and continuing to play a video. and an instance of cross-site fingerprinting.

Google Analytics

There is no such thing as embedding YouTube videos in a page, unless the website itself uses the service. Since Google already has sufficient access to user data via the embedded video, Google Analytics is not required.

Notes on use by schools

Basics

The business model of YouTube or Google / Alphabet is mainly based on the collection and processing of personal data of users with the aim of selling advertising. The user is the product, they don't say for nothing. Even a paid YouTube subscription does not change that. The user can then watch videos without advertising, but his data is also used, as is the data of users without their own account or with free access. The only exception is when YouTube or YouTube videos have a school G Suite for Education account4The use of G Suite for Education is a topic of its own in terms of data protection that should not be discussed further at this point, as it is only about the facts themselves. be called. Then Google agrees that the data collected will not be used to create a profile with the aim of displaying advertisements.

This means that even if it is only about consuming videos, various services running in the background collect Google's data in order to record user behavior and display advertising, as described above. Advertisements do not have to be displayed in the video itself, but can also take place on another website on which Google adverts that are visited by a student after watching a video.

YouTube videos are often used in schools. Depending on the situation, students are specifically asked to watch a certain video, e.g. an explanatory video, or they watch a video while researching a topic because it appears in their search results. Even if many young people can hardly imagine life without YouTube, the school has a duty of care and may not expose students, at least younger students, to Google's data access without protection. While older students should be able to assess the scope of their decision to watch a YouTube video with a private device by the age of 16 at the latest, this definitely cannot be assumed for younger students.

Use in school

If students consume YouTube videos at school from school devices without logging in to other online platforms at the same time, the tracking mechanisms active in the background cannot collect any data that can be directly used by Google. However, there is the possibility that Google will create an anonymous profile from the usage data when using personal access to the educational network, which also stores browser settings and cookies, against which advertising could then be displayed. Whether and to what extent this is possible depends on the configuration of the personal access as well as the filter / blocking / and protection mechanisms of the educational network.

Use at home / on personal devices / BYOD

If YouTube videos are accessed from home or from a private device, there are numerous options for the provider to assign the collected data to an identifiable person, be it on the basis of the IP address or through existing logins on other platforms that already exist on the device Cookies. In the case of mobile devices, device IDs and other features are also added. In the case of devices that are used as part of a 1: 1 configuration, an assignment of the collected data to an identifiable person cannot be ruled out, as e.g. the IP address of the house connection can be determined and the device can have a device ID5Note: From iOS 14, tracking by advertising providers / analysis services can be controlled on an app basis using Identifier for Advertisers (IDFA) across apps and websites. Until then, this IDFA is definitely a #data protection problem on devices used 1: 1. In addition, devices with 1: 1 equipment are usually also used privately in leisure time.

If YouTube videos are to be viewed on private devices or from home, this cannot be mandatory for users due to the associated possible risks, even if many young people are already YouTube users and their parents have no problems with it. There should therefore always be alternatives. In addition, users should be shown ways in which they can prevent or at least restrict Google's access to their data. When it comes to videos not created by teachers or students or videos under free licenses, alternatives are hardly feasible without conflicting with copyright law. In the case of videos, the use of which is not restricted by copyright to retrieval via YouTube, there is still the option of storing these videos on a server of the school or the server of a European provider6The use of the services of such a provider requires the conclusion of an order processing contract between the school and the provider. available for download.

Data protection rating overview

Use in school with school devices (without user profile or with protective measures)

As long as students are not logged into other non-school online platforms at the same time or previous logins on such platforms have left usable data traces through which they can be identified by the tracking mechanisms active in the background when retrieving YouTube videos, there are no significant risks for them. This applies if iPads without user accounts or via temporary sessions are used alternately by different people in a learning group. If all data stored in connection with internet usage (browser history, cookies) are deleted after using the device, the risk should be equally low even when using a user profile on the device.

Use in school with school devices (no protective measures)

As soon as students are logged on to a school device with their own user profile and this is not protected, for example by automatically deleting cookies and browser history after each logout, Google can assign information from the user behavior to the school user, even if they never access a Google platform or another platform through which Google collects data. As long as the user does not log on to another non-school online platform from the school device, through which the identity of the user can be revealed, he should not be identifiable for Google. In this case, there is only a small risk for the user. The moment the user logs on to another non-school online service, the risk is the same as that of using it on a private device without protective measures (0 stars).

Use on private devices / BYOD (no protective measures)

When using private end devices, whether at home or at school, Google's access to personal data of users takes place without any restrictions, unless protective measures are taken. In particular, devices with mobile phone access can be identified in many ways and assigned to a user.7Anyway, users of Android devices are always connected to Google, unless they have provided their device with an alternative OS.

Use on private devices / BYOD (with protective measures)

When using private end devices, whether at home or at school, Google's access to personal data of users can be significantly restricted but probably not completely prevented by using a secure browser such as Brave Browser or DuckDuckGo on mobile devices. Possible risks that arise for users from calling up YouTube videos can thus be greatly reduced.

Conclusion

The use of YouTube to display videos in school and in connection with lessons from home is, apart from possible conflicts with copyright, not without problems from a data protection point of view. In contrast to data tools such as Google Analytics and Google Tag Manager embedded in external websites, the provider has almost unimpeded full access to a large number of user data by displaying videos on its own YouTube.com portal or by embedding it in external websites. These include information on Internet access, the browser, operating system and device used and can be used to collect user behavior, track it via various websites and apps, in order to create a profile against which personalized advertising can be displayed. Advertising can already be displayed directly in the video. Even that is not harmless in school, unless it is specifically about the topic of advertising. There are definitely ways to minimize or even completely eliminate the risks, and users should be aware of these if they are offered YouTube videos or if they should even be a mandatory part of the class.

Against the background that a large proportion of young people today, mostly with the approval of their legal guardians, regularly consume YouTube videos or music from the provider and Google is therefore able to create extensive profiles of these people, schools have a duty of care. This is especially true for younger students. Schools that use YouTube should address the risks to the right to informational self-determination in the classroom and show ways in which users can protect themselves from unchecked access by the provider to their data.

Schools that use YouTube videos in lessons and for home preparation and follow-up should inform parents in advance about this and about possible risks that may result for their children. If schools do not have the option of displaying YouTube videos without advertising or of using the measures described above to protect the students from Google access, they should obtain the consent of their parents in advance. This can only be voluntary, and for this to be possible the school must be able to offer alternatives.

If videos are to be used with younger students, it is generally advisable to either offer videos in such a way that Google's access is completely prevented or to use alternative platforms. There are different possibilities for this.

recommendation

Do not access YouTube videos directly from YouTube.com

The number of hits by Google is reduced if a video is not accessed directly via YouTube.com. If a video is embedded in a website, it is possible to play the videos directly in the browser on mobile devices such as smartphones and tablets. This is not possible with a call from YouTube.com! Devices with iOS such as Android open videos that are accessed from YouTube.com directly in the YouTube app, which should be in no way inferior in their data access without adjusting the data protection settings of the YouTube.com website.

Free YouTube videos from tracking using services

invidio.us

The other option is to use the Invidious platform. This is an open source project that is offered as a service at invidio.us. The platform makes it possible to prevent YouTube from accessing data and to integrate YouTube videos into other websites in a data protection-friendly manner.8However, invido.us processes the usual user data that arise when visiting web servers, such as IP address, browser, OS, date, time, etc. in log files. To do this, take the link to the video on YouTube, e.g. https://www.youtube.com/watch?v=m5hobLax9bM and copy the end part of it. This end part is placed at https://invidio.us/, so that the link https://invidio.us/watch?v=m5hobLax9bM. This could then be integrated into a padlet. You should know that the invidio.us service is a bit sluggish. So it may take a moment for the video to appear. Sometimes there is also a hint that the video might be blocked. Then it helps if you load the link several times. It can also help if the teacher calls up the link themselves at least once - until the video is displayed on invidio.us. After that, it should go faster with the students.

Invidious can also be self-hosted. The Techkids e.V. association has been offering its own Invidious instance under the URL EduVid Tubus since March 2021. The association provides schools with this free of charge.9The association is financed through donations. Schools that make extensive use of the offer should contribute to the work of the association with a donation. So that this offer can be used in compliance with data protection regulations, there is even an order processing contract upon request.

viewpure.com

The provider viewpure.com promises similar functions and actually blocks Google's access to user data via YouTube. However, with Viewpure, at least in the free version, numerous third-party services run in the background, which directly destroy the prospect of risk-free use of YouTube videos. Third-party services running in the background include Twitter, Facebook, Doubleclick.net (Google advertising network) and Google Analytics. It should be checked whether this changes when a payment account is used.

video.link (formerly safeyoutube.com)

Video.link also promises data protection-friendly use of YouTube videos and thus specifically addresses schools, but on closer inspection it is not really the alternative solution. In the background, Google is back on board via Google Analytics10The Goole-Analytics test of the University of Bamberg results in a query without IP anonymization. The title of the video is linked to various IDs on Google. and Doubleclick.net.

Protection through secure browsers and apps

The third option is to use the secure Brave Browser, which is available for desktops, tablets and smartphones, and open a “new private window” or a “new private window with Tor”. There, the data taps from YouTube are blocked quite well and you can watch the video safely. The Mozilla browser Firefox also offers quite good options for blocking tracking across different websites. The DuckDuckGo Browser can be used on mobile devices, an app that protects users from data access very well. As described above, this approach works most securely when YouTube videos are not accessed via YouTube.com, but are instead embedded in a website. This could be the school homepage or a teacher's page.

Alternative video portals

PeerTube network

There is also the option of using other video portals. One such alternative is the free video portal PeerTube. PeerTube describes itself as follows:

"PeerTube, developed by Framasoft, is the free and decentralized alternative to video platforms and offers users over 200,000 videos that have been published by 30,000 users and viewed over 10 million times."

As a promoted system of independent but interconnected video platforms, PeerTube lives from the fact that users / video producers participate with their own instances in order to distribute the load of the stored and streamed videos similar to a BitTorrent network. Different bodies specialize in different topics, depending on the topics with which the respective operators are concerned. There are also instances that take up educational content. The instances are at home in different countries and therefore have different languages. Schools can use the platform to publish videos they have created, whether they are explanatory videos or videos created by students. You can support the network with donations and should do so if you want to publish videos yourself about one of the participating providers or operators of an instance. The advantages of PeerTube are clearly in the openness of the systems, which are operated without data sniffing. The significantly more limited range of videos is a disadvantage. Anyone who would like to provide pupils with their own videos or videos that can be downloaded from YouTube under free licenses via a privacy-friendly video platform for streaming is best advised with the network of PeerTube instances, but should also be prepared to contact the provider of the selected instance to support with regular donations.

Alternatively, a PeerTube instance can also be operated by itself or, better, by a contracted service provider. The media pedagogy practice blog describes in the very good article PeerTube as a YouTube replacement, how this works and what to look out for in order not to come into conflict with data protection or copyright.11Weingärtner IT Services is an example of a provider of peer tube hosting. For less than 100 € / year, you can rent up to 100 GB of storage for videos at the lowest tariff, unlimited streaming.

The association Teckids e.V. has been providing schools with their own peer tube instance since March 2021, which can be used freely. It can be reached at EduVid Tubus.12Registration on the instance is required.

Vimeo

Vimeo is definitely not such an alternative in the free version, as numerous third-party services run in the background13These include: social media trackers from LinkedIn and Facebook, as well as cross-site tracking cookies from various Google services, Facebook, LinkedIn, Twitter, Microsoft. It should be checked whether the paid version is better to use from the point of view of data protection.

Use via Google Classroom / G Suite for Education

Schools using G Suite for Education or Google Classroom have an advantage over other schools. Once students access YouTube through their school Google Account, they will not see any ads. Google also assures educational institutions with a G Suite for Education instance that no user profiles will be created to display advertising. What initially sounds very good from a data protection point of view, however, has a catch. G Suite for Education is a service from Google / Alphabet and regarding the data protection compliance of the platform, the opinions of the supervisory authorities, ministries of education and specialist lawyers differ.14The topic is not to be discussed further here. The possibility is only mentioned for the sake of completeness.

Provision via own server

Schools always have the option of providing self-created videos and videos with free licenses that come from other sources on their own server for the pupils of their own school. A separate server can be located in the school building or it can be rented. In the latter case, it is necessary to conclude an order processing contract with the hoster. Depending on the competence, server performance and internet connection of the server, the provided videos can be offered for download or streaming. However, it must then be ensured that the group of users remains limited to school users in order not to exceed the server capacities and data volumes. As the operator of the server, the school is also responsible for compliance with copyright law and can be held liable for violations.

Use of the media portals of the countries

The media portals of the federal states, in NRW the platform EDMOND NRW, are a preferred solution from a data protection point of view. The disadvantage is that no self-produced videos are recorded here and the limited selection of titles. There are also publicly available titles on many topics in the program, such as school television productions. The other titles available for each school depend on the financial strength of the municipalities that have to pay for the licenses.

That's what supervisory authorities say

In its activity report for 2020 (p. 40f), the Bremen supervisory authority also commented on the topic of YouTube in connection with teaching:

“We were told on various occasions that content provided on the US video portal YouTube was used by teachers as part of distance teaching. For example, pupils were sent a link to a video published there and given them the task of calling it up as part of their domestic task processing (from a private device) and then answering questions about the video in writing. This is not permitted under data protection law even if the tasks are not compulsory and the use is via the itslearning web-based learning platform used in the state of Bremen. When using the YouTube platform, various personal user data is processed by it. A need for use in the form described is not evident. An additional problem in this context is the transmission of the collected data to the United States of America. "

It can be assumed that the other supervisory authorities will also evaluate the issue in the same way.

As of 04/2021