Meta, YouTube and other sites collected more data than most users imagined, according to a new report from the Federal Trade Commission.

Credit: Cecilia Kang – The New York Times.

The Federal Trade Commission said on Thursday that it found several social media and streaming services engaged in "vast surveillance" of consumers, including minors, collecting and sharing more personal information than most users realized.

What the FTC found at nine companies

The findings come from a study of how nine companies, including Meta, YouTube and TikTok, collected and used consumer data. The sites, which mostly offer free services, profited from the data by feeding it into advertising targeted at specific users based on their demographics, according to the report. The companies also failed to protect users, especially children and teenagers.

The FTC said it began its study nearly four years ago to provide the first holistic look at the opaque business practices of some of the largest online platforms, which have built multibillion-dollar advertising businesses using consumer data. The agency said the report showed the need for federal privacy legislation and for restrictions on how companies collect and use data.

"Surveillance practices can endanger people's privacy, threaten their freedoms, and expose them to a host of harms, from identity theft to stalking," said Lina Khan, the FTC chair, in a statement.

Tech giants are under intense scrutiny over privacy abuses, and in recent years they have been blamed in part for contributing to a mental health crisis among young people and children that some social scientists and the surgeon general have linked to the unchecked use of social media and smartphones. But despite multiple proposals in Congress to more strictly protect children's privacy and safety online, nearly every legislative attempt to regulate Big Tech has failed.

The companies' efforts to police themselves have not worked either, the FTC concluded in its report. "Self-regulation has been a failure," it added.

Google, the owner of YouTube, "has the strictest privacy policy in our industry: we never sell people's personal information and we don't use sensitive information to serve ads," said José Castañeda, a Google spokesperson. He added: "We prohibit ad personalization for users under 18, and we do not personalize ads for anyone watching 'made for kids' content on YouTube."

Kate Sheerin, Discord's head of public policy for the United States and Canada, said in a statement that the FTC report "lumps very different models into one group and paints with a very broad brush." She added that Discord does not operate a formal digital advertising service.

TikTok and Meta, the owner of WhatsApp, Messenger and Facebook, did not immediately respond to requests for comment.

How the study was done and which platforms it covered

In December 2020, the agency opened an investigation into the nine companies, which operate 13 platforms. The FTC requested data from each company on operations carried out between 2019 and 2020, and then studied how the companies had collected, used and retained that data.

The study included the streaming platform Twitch, owned by Amazon, the messaging service Discord, the photo- and video-sharing app Snapchat and the discussion forum Reddit. Twitter, now rebranded as X, also provided data.

The study did not disclose results for each individual company. Twitch, Snap, Reddit and X did not immediately respond to requests for comment.

The companies have argued that they have tightened their data collection policies since the periods covered by the study. Earlier this week, Meta announced that Instagram accounts for users under 18 will be private by default in the coming weeks, meaning that only followers approved by the account holder will be able to see their posts.

What data they collected and how they used it

The FTC found that the companies voraciously consumed data about users and often bought information about people who were not users through data brokers. They also gathered information from accounts linked to other services.

Most of the companies collected users' age, gender and language. Many platforms also obtained information about education, income and marital status. The companies did not offer users simple ways to opt out of data collection and often retained sensitive information for far longer than consumers would expect, the agency said.

The companies used data to build profiles of users (often merging the information they gathered with information about habits collected on other sites) in order to show ads.

The agency also found that many of the sites claimed to restrict access for users under 13, yet many children remained on the platforms. Teenagers were also treated as adults on many of the apps, which subjected them to the same data collection as adults.

Many of the companies could not tell the FTC how much data they were collecting, according to the study.

Regulatory moves and earlier penalties

Last year, the FTC proposed changes to strengthen children's privacy regulations, and lawmakers are seeking to expand children's privacy protections for users under 18. In 2022, Ms. Khan opened a regulatory effort to create rules for companies that show advertising based on users' browsing or search history.

The agency has already brought complaints against several tech companies for privacy violations, and in late 2022 it reached a $520 million settlement with Epic Games for allegedly violating a children's privacy law and tricking consumers with unwarranted charges. That same year, the FTC fined Twitter $150 million for using users' security data for behavioral advertising.

Original source: The New York Times · Cecilia Kang