# Security & Privacy Scorecard

## YouTube

## What This Means for You

Precise GPS coordinates are attached to every request the app sends to Google's servers, including routine video playback and search, building a detailed location history tied to your account.

## Recommendation: Acceptable with Awareness

Precise GPS coordinates are sent with every API request, creating a detailed location history. While browser component and cryptographic protections are solid, privacy-conscious users should carefully review location permissions.

**Best For:** General users comfortable with Google's data collection practices who prioritize a full-featured video experience

## Key Findings

**Data Security** - 1 finding (1 low)

**Network Security** - 1 finding (1 low)

**Code Safety** - 4 findings (1 low, 3 info)

**Privacy** - 5 findings (2 low, 3 info)

## Privacy Concerns

### What Data is Collected

- Personal information: Google account email, display name, account identifiers
- Device information: device ID, phone state, advertising ID for cross-app tracking
- Location data: precise GPS coordinates (latitude, longitude, accuracy, timestamp) attached to all server requests when location permission is granted
- Usage data: video watch history, search queries, subscriptions, app interactions

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Firebase Analytics (Google) - behavioral analytics and usage reporting
- Firebase Cloud Messaging (Google) - push notification delivery using device identifiers
- Google Mobile Measurement - ad attribution and conversion measurement
- Privacy Sandbox Ad Services (Google) - advertising attribution, open to all installed apps on your device
- Cronet / Google network stack - network telemetry tied to carrier and connectivity diagnostics

## Understanding the Scores

**Security:** 92/100
**Privacy:** 84/100

### Security Breakdown

- **Data Security:** 93/100 - Account information is included in automatic device backups; no session materials are stored
- **Network Security:** 88/100 - Primary traffic is encrypted; a broad unencrypted traffic permission exists for local network device communication
- **Code Safety:** 97/100 - Strong protections throughout; one OAuth redirect path uses an unverified custom scheme as the active default

### Privacy Breakdown

- **Data Collection:** 85/100 - Extensive collection including precise location sent on all requests, contacts, microphone, and camera
- **Data Sharing:** 87/100 - Most data stays within Google's ecosystem; advertising attribution framework is open to all apps on device
- **User Control:** 85/100 - Google Consent Mode v2 provides ad personalization controls; location collection scope is broad and not scoped to features that need it

## Positive Security Features

- Signing keys are stored in hardware-backed secure storage on your device, where they cannot be extracted even with physical device access
- All browser display components in the app disable local file access and protect your consent taps against overlay interference
- Core YouTube links are protected with verified ownership, preventing other apps from intercepting YouTube navigation
- Google Consent Mode v2 gives you control over whether ads are personalized based on your activity
- No known security issues were identified across any of the 28 third-party libraries included in this build

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Location Data Scope**
   Precise GPS coordinates should be sent only for features that genuinely require location context, such as local content recommendations, rather than attached to every server request including routine video playback and search.

2. **Advertising Attribution Openness**
   The advertising attribution configuration allows all other apps installed on your device to interact with YouTube's attribution context. Restricting this to a named list of trusted apps would reduce unintended exposure.

### Security Enhancements

1. **OAuth Redirect Path Hardening**
   The active sign-in redirect path uses a custom app scheme that lacks ownership verification. Enabling the verified HTTPS redirect path as the default would prevent the disambiguation dialog from appearing on Android 12 and newer.

2. **Unencrypted Traffic Scope**
   The current configuration permits unencrypted traffic broadly for any domain not explicitly listed. Scoping the unencrypted permission to only the specific local network addresses used for Cast device communication would eliminate the broader permission.

## Technical Context

**App Type:** Video streaming and content platform, high data collection sensitivity
**Classes Analyzed:** 47,927
**Third-Party Services:** 28 identified (22 Google first-party, 6 third-party)
**Context Tags:** video, location, camera, ads, contacts, social

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Google LLC
**Version:** 21.11.487 (build 1561061176)
**Analysis Date:** 2026-04-11
**Package:** com.google.android.youtube

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 21.11.487 analyzed on 2026-04-11
- May not reflect server-side security controls
- Cannot detect all runtime behaviors