YouTube Ad Blocker Discovery Believed to Violate EU Privacy Law

Most ad-blocking browser extensions look for certain file paths and file names (like those in Easylist ad-blocking) that are called within a page, and remove them from the version of the page that is rendered in your browser.

For example, a JavaScript program called “clever_ads.js” (the name of the script generated by the Clever Ads advertising service, which embeds ads on your page) will be identified by the ad blocker and removed, along with any content you may create. usually load. In YouTube’s case, the ad API returned JSON files, which ad blockers would modify.

There are several ways to determine if a user is blocking ads, most of which involve some JavaScript program that checks a given page for evidence that ad content has been removed. A common approach is to have your ad load script also include a JavaScript variable or an HTML element that can be checked.

Of course, ad blockers can check and remove anti-adblocker scripts as well, and that’s what happens in the case of blocking tools, such as Adblock Plus and uBlock Origin, which always offer additional filters to download and add to the blocker so that it can’t remove the latest scripts.

But as its anti-adblocker scripts are added to the filter list, YouTube releases updated versions of those scripts. So now there is an ongoing arms race, organized by the website “Is YouTube Anti-Adblock Fixed”, which monitors whether the uBlock Origin browser plugin successfully bypasses YouTube adblock detection or not by comparing the list of YouTube anti scripts -adblocker. IDs is a list of text IDs blocked by the plugin.

Basically, the EU says that random websites are not allowed to browse your stuff without permission. That’s what most people agree on. Google itself prohibits Android app developers from using the QUERY_ALL_PACKAGES permission, describing user-installed apps as “personal and sensitive information.”

The question facing the DPC is whether YouTube’s adblock scripts are offensive enough to qualify: Is downloading and running a JavaScript program the same as downloading and storing a cookie?

It seems that YouTube intends to argue that it is not being played, and insists that it only wants to identify whether the ads have been played and they are not. When WIRED asked the company if it was using or testing server-side ad blocker detection, YouTube’s Lawton said it currently detects ad blockers on YouTube and not on users’ devices. That doesn’t match our awareness or that of ad blocker developers, since the JavaScript detection routine on the website must be run by the browser to work.

Lawton says YouTube “will certainly cooperate fully with any questions or inquiries from the DPC.”

The Office of the Irish Data Protection Commissioner did not comment on the matter, but Hanff says the DPC has assured him it is investigating the case.