YouTube Security & Privacy Scorecard
by Google · iOS
Viewing habits, interests, and device activity are collected and linked to a user's Google account to personalize ads. Multiple third-party services receive data about how the app is used. Data travels securely, but the scope of what is gathered is broad.
Best for
Watching videos without deep privacy concerns
Avoid if
You want to limit ad-tracking across platforms
Findings
- 1 critical
- 2 high
- 5 medium
- 0 low
- 8 info
1 issue identified across security and privacy analysis.
Top security issues
- App Transport Security Exceptions for Carrier Billing Endpoints
- Hardcoded HTTP URLs for YouTube Domains
- SQLite Database Protection Classes Not Verifiable
Top privacy issues
- Missing Privacy Manifest (iOS 17+ Compliance Requirement)
- Extensive Proprietary Analytics with Unknown ATT Enforcement
- Contact List Upload to Servers
Full analysis
What This Means for You
Viewing habits, interests, and device activity are collected and linked to a user's Google account to personalize ads. Multiple third-party services receive data about how the app is used. Data travels securely, but the scope of what is gathered is broad.
Recommendation: Use With Caution
Best For: Watching videos without deep privacy concerns
Avoid If: You want to limit ad-tracking across platforms
Key Findings
Data Security - 1 finding (1 medium)
Network Security - 3 findings (1 high, 1 medium, 1 info)
Code Safety - 0 findings
Privacy - 9 findings (1 critical, 1 high, 3 medium, 4 info)
Privacy Concerns
What Data is Collected
YouTube collects data tied directly to a user's Google account, including watch history, search terms, video interactions, inferred interests, and device identifiers. This information builds a detailed profile of user preferences used for ad personalization across Google's services.
Third-Party Data Sharing
The following third-party services were observed receiving data through the app:
- Firebase Core - Google analytics and diagnostics
- IGListKit - UI rendering library
- OpenCV - Image and video processing
- WebRTC - Real-time media streaming
- TensorFlow Lite - On-device machine learning for recommendations
- Lottie - Animation rendering
- Breakpad - Crash diagnostics
- Widevine CDM - Protected content playback
Understanding the Scores
| Category | Score |
|---|---|
| Security | 84/100 |
| Privacy | 64/100 |
| Data Security | 98/100 |
| Network Security | 77/100 |
| Code Safety | 100/100 |
| Data Collection | 64/100 |
| Data Sharing | 92/100 |
| User Control | 72/100 |
Positive Security Features
- No notable positive security features were identified for this version of the app.
Areas for Improvement
- The scope of data collected about viewing habits and linked to a user's Google account is broad, with limited ability to use the app without contributing to an advertising profile that extends across Google's services.
- Some network connections handling user activity could be better secured against interception by third parties on shared or public networks.
- Controls for limiting what data is collected or how long it is retained are minimal within the app itself, leaving most privacy decisions outside the user's direct reach.
About This Analysis
App Details
| Field | Value |
|---|---|
| App | com.google.ios.youtube |
| Version | 21.12.4 (Build 21.12.4) |
| Scan Date | 2026-03-27 |
| Analysis Type | Static analysis |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 70/100 |