Federal Trade Commission 

Privacy Impact Assessment 

 

for: 

An FTC Video Channel on YouTube 

October 2011 
2

1 SYSTEM OVERVIEW 

 

The Federal Trade Commission’s (FTC) Division of Consumer and Business Education (DCBE) 

manages a YouTube channel featuring DCBE’s educational videos, as a way to reach consumers 

and organizations through YouTube, a website that allows people to view and share videos 

across the web by sharing links and embedding the videos on blogs and websites. YouTube also 

allows registered users to subscribe to channels, rate and comment on videos, post video 

responses, and communicate with other users on the site. 

 

The FTC YouTube channel allows DCBE to promote FTC videos to consumers and 

organizations that may not be regular visitors to the FTC.gov website. Information posted to the 

YouTube channel consists of videos that already exist on FTC.gov, business.FTC.gov and 

OnGuardOnline.gov. 

 

Through the YouTube channel, we will promote FTC videos to users who subscribe to the FTC 

channel and as an easy way for bloggers and other news sites to use our videos on their sites. In 

turn, subscribers would share, comment on, and rate our videos for their network of YouTube 

friends and others, providing a viral marketing component to our video outreach/education effort. 

They also could post video responses – comments in video form – to FTC videos. 

The FTC will not be using YouTube to collect any information about individuals and will not 

copy information from the comments posted on the FTC’s YouTube channel to incorporate into 

any of the agency’s record systems. However, the use of YouTube potentially raises other 

privacy concerns and therefore we have completed this PIA in an effort to ensure that we have 

addressed those issues as appropriate. 

Currently, the FTC’s YouTube channel is administered by a small number of FTC staff members 

in DCBE and the Office of Public Affairs (OPA). Each YouTube administrator will sign the 

agency’s Rules of Behavior for Administrators of Social Media and New Media accounts as 

required by the agency. 

 

2 INFORMATION COLLECTED AND STORED WITHIN THE SYSTEM 

 

2.1 What information is to be collected, used, disseminated, or maintained by the system? 

User access is subject to the operational requirements and controls of YouTube. While the FTC 

may have access to data maintained by YouTube, it is not requesting, storing or otherwise 

maintaining personally identifiable information from individuals accessing the FTC’s YouTube 

channel. The FTC maintains a weekly social mentions report which does highlight the general 

number of channel views, number of channel subscribers, and number of video views. This is 

information that is publicly available on the FTC’s YouTube Channel homepage. Viewers may 

elect to watch the same content on the FTC’s websites including www.ftc.gov/videos, 

www.business.ftc.gov, and www.onguardonline.gov. 

Individuals who choose to register with YouTube are required to provide a username, valid 

email, password, gender, and date of birth, and have the option to provide additional information. 
3

Individuals are not required to register on YouTube in order to watch FTC videos. Even though 

some of this information may be accessible to the FTC, depending on a YouTube user’s privacy 

settings, the FTC will not collect, use, disseminate, or maintain any of this information. 

YouTube also collects information using server log files and/or page tagging (with JavaScript) to 

create user metric reports that include aggregate information such as the number of visitors to the 

YouTube channel and the content they are viewing. These metric reports, which YouTube will 

provide to the FTC, contain aggregate information but no PII. 

 

2.2 What are the sources of the information in the system? 

 

YouTube collects PII from individuals who register with them and who may ultimately visit or 

subscribe to the FTC YouTube channel. The FTC does not, however, collect, maintain, or 

disseminate that information. 

The FTC will use YouTube to disseminate videos that are currently available on the FTC.gov, 

business.FTC.gov and OnguardOnline.gov websites. The videos consist of tips and information 

that were developed and/or compiled by DCBE specifically to educate the public. 

2.3 Why is the information being collected, used, disseminated, or maintained? 

The FTC does not collect, disseminate, or maintain PII from individuals who subscribe, or 

otherwise interact with its channel on YouTube. The FTC will view user metric reports on the 

YouTube site that include aggregate information such as the number of views a video receives, 

the top referrers of the videos, and what demographics the viewers fall into. This information, 

which does not contain any PII, will be used by DCBE staff to analyze the effectiveness and 

impact of the FTC YouTube channel. 

The FTC may read, review, or rely upon information that users make available to the public or to 

the FTC on YouTube, including comments on the channel or video pages, as authorized or 

required by law. 

 

 2.4 How is the information collected? 

 

The FTC does not collect any PII from individuals who interact with the YouTube channel. 

The web metric reports, which do not contain PII, are available on the YouTube website and 

generally can be viewed only by DCBE staff who serve as administrators of the page. 

 

2.5 How will the information be checked for accuracy and timeliness? 

 

The information and videos that the FTC disseminates through the FTC YouTube channel, 

including any PII that may be included in that public information, will be reviewed by DCBE 

staff to ensure accuracy and timeliness. Because the FTC does not collect, disseminate, or 
4

maintain PII from individuals who visit the YouTube channel, it does not check the accuracy and 

timeliness of that information. 

 

2.6 Is the system using technologies in ways that the FTC has not previously employed (e.g., 

monitoring software, Smart Cards, etc.)? If so, how does the use of this technology affect 

individuals’ privacy? 

 

The creation of a YouTube channel will not require the FTC to use new technologies. 

Administrators of the pages will be able to access them by using a standard Web browser to visit 

YouTube.com and logging in with an email address and a password. 

 

2.7 What law or regulation permits the collection of this information? 

 

The FTC will not collect, maintain, or disseminate any PII from individuals who interact with the 

YouTube channel. With respect to the information that the FTC will disseminate through the 

FTC YouTube channel, the FTC Act authorizes the FTC to prevent unfair and deceptive acts and 

practices in interstate commerce and, in furtherance of this mission, to gather, compile, and make 

information available in the public interest. See 15 U.S.C. 45, 46(a), (f). 

Federal guidance from the Office of Management and Budget (OMB), including the Open 

Government Directive, OMB M-10-06; Memorandum on Social Media, Web-Based Interactive 

Technologies, and the Paperwork Reduction Act (April 7, 2010); and Guidance for Agency Use 

of Third-Party Websites and Applications, OMB M-10-23, all promote the three principles of 

transparency, participation, and collaboration. In particular, the FTC provides the public 

opportunities to participate and engage with our agency to share their expertise and information. 

Public participation enhances the FTC’s effectiveness and improves the qualities of our 

decisions. 

2.8 Considering the type of information collected and sources of collection, what privacy 

risks were identified and how were these risks mitigated? 

The FTC will not collect, maintain, or disseminate any PII from individuals who interact with the 

YouTube channel. The FTC will use YouTube to disseminate information in the form of videos 

which already exist on FTC.gov, business.FTC.gov and OnguardOnline.gov. 

Because only a select number of DCBE staff will have administrative access to the page, and 

because the information disseminated will be well-vetted before it is posted, any risk that FTC 

information that is not appropriate for public dissemination, including PII, might be posted will 

be mitigated. 

In addition, the FTC will provide notice on the FTC’s YouTube channel that YouTube’s privacy 

policy, not the privacy policy for FTC.gov, applies to any information an individual provides. 

This notice also will provide a link to the official FTC.gov website. If the circumstances 

warrant, the FTC has the ability to delete individual comments from the page. Additionally, the 

FTC does not maintain any record of any comments that administrators delete from the page. 
5

In general, YouTube has privacy risks that are not within the control of the FTC and that the 

FTC has limited ability to mitigate. Third party advertisements, for example, may pose privacy 

risks (in the form of cookies or malware) to those individuals who click on them. The FTC’s 

terms of service with YouTube prohibit the appearance of third party advertisements on the 

FTC’s YouTube channel and video pages, however, thus eliminating those risks. 

There also is a risk that individuals who interact with the pages will reveal PII or other sensitive 

information about themselves or others in comments that they post to the page, or include links 

that may adversely affect those who click on them (such as links to malicious software or to 

websites marketing a fraudulent business opportunity). The FTC makes every effort to mitigate 

this risk by informing visitors, via a prominent disclosure on the main page of the FTC’s 

YouTube channel, that they are not at the official FTC.gov website and by informing them in the 

commenting policy that they should not include such information. Staff who administer the 

pages will have the ability to delete individual comments if circumstances warrant. This risk 

could be eliminated by turning off the comment function on the pages and not allowing 

individuals to post comments. The FTC has not opted to do that at this time because the other 

means of mitigating this risk are likely sufficient, and because allowing comments – including 

video comments – will make the channel a dramatically more effective communications tool. 

 

3 USE AND ACCESS TO DATA IN THE SYSTEM 

 

3.1 Describe how information in the system will or may be used. 

The FTC does not collect, use, disseminate, or maintain PII from individuals who subscribe, like, 

or otherwise interact with, the FTC’s videos on YouTube. 

Visitors to the FTC’s YouTube channel who have not registered with YouTube will be able to 

view and share all the videos on the channel, but will not be able to post comments or rate them. 

Visitors to FTC’s channel who have registered with YouTube will be able to post comments, 

including video comments, or rate the videos. 

Subscribers to the FTC’s YouTube channel have to be registered users of YouTube. In addition 

to being able to post comments (including video comments) or rate videos, subscribers will 

receive updates via email or their YouTube account when new FTC videos are posted. This is a 

feature registered users can opt out of on an individual basis. 

Users of YouTube will be able to see if a person is a subscriber to the FTC’s YouTube channel, 

but only if they happen upon that person’s channel and the individual has allowed for other users 

to see his/her subscriptions. The FTC may read, review, or rely upon information that users make 

available to the public or to the FTC on YouTube, including comments on the FTC’s channel 

and video pages, as authorized or required by law. 

YouTube provides channel administrators the ability to publish on the channel of the subscribers 

to the channel. However, the FTC’s YouTube page will turn this setting “off” so that neither 

administrators nor site visitors will be able to see who has subscribed to the channel. 
6

The FTC will use the YouTube channel to disseminate information in furtherance of the 

agency’s consumer education mission. This information is publicly available and includes tips 

and information in short videos. 

The FTC will view user metric reports on YouTube that include information, such as the number 

of visitors to the channel and the content they are viewing. These reports, which do not contain 

any PII, will be used by DCBE staff to analyze the effectiveness and impact of the FTC’s 

YouTube channel. 

 

3.2 Which internal entities will have access to the information? 

YouTube collects PII from individuals who register with them and who may ultimately visit or 

subscribe to the FTC’s channel. The FTC does not does not collect, disseminate, or maintain this 

information. 

FTC staff that serve as page administrators will have access to the YouTube channel. They will 

be able to edit content on the page and see the user metric reports YouTube provides as 

described in 3.1. 

 

3.3 Which external entities will have access to the information? 

 

The FTC’s YouTube channel is being used to disseminate information to the general public in 

furtherance of the FTC’s consumer education mission. The information that DCBE posts on the 

page can be accessed by anyone, whether or not they are registered YouTube users or have 

subscribed to the channel. 

YouTube users determine what information is available about them to other YouTube users and 

to the general public (i.e., external entities). The FTC does not have access to any more 

information than any member of the public about other YouTube users and does not control or 

have the ability to provide access to any user’s PII. 

 

4 NOTICE AND ACCESS FOR INDIVIDUALS 

 

4.1 How will individuals be informed about what information is collected, and how this 

information is used and disclosed? 

 

The FTC does not collect, maintain, or disseminate PII from individuals who subscribe or visit 

the YouTube channel. The FTC will use YouTube to disseminate videos that are currently 

available on FTC.gov, business.FTC.gov and OnGuardOnline.gov websites. This is publicly 

available information and includes tips and information in the form of short videos. The FTC 

will not disseminate any information that contains sensitive PII via the YouTube channel. 

Individuals who seek information about how YouTube uses their PII should review YouTube’s 

Terms and Privacy Policy. The agency’s YouTube channel will remind users to review 

YouTube’s Privacy Policy and that their policy governs on the site. 
7

 

4.2 Do individuals have the opportunity and/or right to decline to provide information? 

 

Users are not required to log-in to view videos on the agency’s YouTube channel. Additionally, 

if they do not wish to use YouTube, consumers will be informed that they are able to access the 

same FTC videos at www.ftc.gov/videos, but they will not be able to comment on them or rate 

them there. 

 

4.3 Do individuals have the right to consent to particular uses of the information? If so, how 

would an individual exercise this right? 

Not applicable. 

 

4.4 What are the procedures that allow individuals to gain access to their own information? 

Not applicable. 

A registered YouTube user must enter her email and password to log in to her page. (This 

process is controlled and managed by YouTube, not the FTC.) Once logged in, she can see and 

edit her profile information by clicking on “Account” and then “Profile Setup.” 

4.5 Discuss the privacy risks associated with the process of providing individuals access to 

their own records and how those risks are mitigated. 

Not applicable. 

To mitigate the risk of unauthorized access to individual accounts, YouTube requires registered 

users to log in using their email address and a password. 

 

5 WEBSITE PRIVACY ISSUES 

 

5.1 Describe any tracking technology used by the website and whether the technology is 

persistent or temporary (e.g., session cookie, persistent cookie, Web beacon). Currently, 

persistent tracking technology is not approved for use by the FTC (see 5.2). 

 

The FTC does not use any persistent tracking technology on its YouTube channel. YouTube 

does use session cookies and persistent cookies, as described in its privacy policy. The FTC will 

post a notice on its channel to ensure that fans and others who visit the YouTube channel 

understand that it is not the FTC’s official website and that YouTube’s privacy policy governs. 

5.2 If a persistent tracking technology is used, ensure that the proper issues are addressed. 

 

The FTC does not use any persistent tracking technology on its YouTube channel. 
8

5.3 If personal information is collected through a website, page, or online form accessible 

through the Internet, is appropriate encryption used? If not, explain. 

Not applicable. The FTC does not collect any PII through the FTC’s YouTube channel. 

5.4 Explain how the public will be notified of the Privacy Policy. 

 

The FTC will provide notice to those who visit the FTC’s YouTube channel that it is not the 

official website of FTC.gov and that YouTube’s privacy policy applies to any information an 

individual provides. This notice also will provide a link to the official FTC.gov website. 

Additionally, anyone accessing the YouTube channel from FTC.gov will see a privacy notice 

when they are leaving the site. 

 

5.5 Considering any website or Internet issues, please describe any privacy risks identified 

and how they have been mitigated. 

To ensure that only approved content is disseminated through the FTC’s YouTube channel, only 

a select group of FTC staff will have login credentials (username and password) that allow them 

to access the page and make content edits. 

5.6 If the website will collect personal information from children under 13, or be directed at 

such children, explain how it will comply with the Children’s Online Privacy Protection Act 

(COPPA). 

 

The FTC does not collect any PII, including PII of children under the age of 13, through the 

FTC’s YouTube channel. 

 

6 SECURITY OF INFORMATION IN THE SYSTEM 

 

6.1 Are all IT security requirements and procedures required by federal law being followed 

to ensure that information is appropriately secured? 

The FTC does not own or control access to YouTube. Nevertheless, as already described 

elsewhere in this PIA, the FTC has taken a number of steps to mitigate privacy risks, if any, to 

individuals who may visit YouTube to view the FTC’s channel. See e.g., Sections 2.3, 4.2, 5.1-

5.6. Individuals who seek information about YouTube’s security controls should review 

YouTube’s Privacy Policy and/or direct their inquiries to YouTube. 

6.2 Has a Certification & Accreditation been completed for the system or systems supporting 

the program? 

Not applicable. 

 

6.3 Has a risk assessment been conducted on the system? 

Not applicable. 
9

 

6.4 Does the project employ technology that may raise privacy concerns? If so, please 

discuss its implementation. 

The FTC does not own or control access to YouTube. Individuals who seek information about 

how privacy concerns are addressed in the technology employed by YouTube should review 

YouTube’s privacy policy and/or direct their inquiries to YouTube. 

6.5 What procedures are in place to determine which users may access the system and are 

they documented? 

The FTC does not own or control access to YouTube. DCBE will determine which FTC staff 

members have access to the YouTube channel for the purpose of disseminating FTC information. 

 

6.6 Describe what privacy training is provided to users either generally or specifically 

relevant to the program or system. 

All DCBE staff members with responsibility for posting FTC information to the FTC’s YouTube 

channel participate in annual privacy and data security training. Also, FTC employees who 

administer social media accounts on behalf of the agency agree in writing to follow Rules of 

Behavior mandating specific practices related to privacy and security. 

6.7 What auditing measures and technical safeguards are in place to prevent the misuse of 

data? 

Not applicable. 

 

7 DATA RETENTION 

 

7.1 For what period of time will data collected by this system be maintained? 

 

FTC’s YouTube channel content conforms to the definition of “nonrecord materials” as 

identified in 44 U.S.C. § 3301 and 36 C.F.R. § 1220.14. National Archives and Records 

Administration guidance is to destroy or delete nonrecords when they are no longer needed for 

reference. 

The FTC does not collect, maintain, or disseminate any PII from individuals who visit or 

subscribe to the FTC’s YouTube channel. As noted previously, the FTC will, however, 

disseminate information that is currently available on the FTC.gov, business.ftc.gov and the 

OnGuardOnline.gov websites via the YouTube channel. YouTube stores that information and it 

will remain on the channel until the FTC determines that it should be deleted. 

 

Individual users have the ability to delete their individual accounts. When that happens, 

YouTube will delete any comments posted by those fans on the FTC’s YouTube channel and 

video pages. This is a function of YouTube and not the FTC. The FTC may, however, delete 

individual comments from the page if circumstances warrant. 
10

 

7.2 What are the plans for destruction or disposal of the information? 

If the FTC determines that any information it has disseminated on the FTC’s YouTube channel 

should be deleted, staff in DCBE will take the appropriate steps to ensure that the information is 

removed from the page or, if appropriate, that the video(s) is deleted in its entirety. 

 

7.3 Describe any privacy risks identified in the data retention and disposal of the information, 

and describe how these risks have been mitigated. 

The FTC does not collect any PII about individuals who visit or subscribe to the FTC’s YouTube 

channel. The information that the FTC disseminates via the YouTube channel is information 

that has already been made public at FTC.gov, business.FTC.gov or OnGuardOnline.gov. It 

contains no PII and there are no identifiable privacy risks associated with its retention and 

disposal. 

 

8 PRIVACY ACT 

 

8.1 Will the data in the system be retrieved by a personal identifier? 

 

Not applicable. The FTC does not collect any PII about individuals who visit or subscribe to the 

FTC’s YouTube channel and, therefore, no PII is included in an agency system in which it is 

retrieved by a personal identifier. 

 

8.2 Is the system covered by an existing Privacy Act System of Records notice (SORN)? 

Not applicable. The FTC does not collect any PII about individuals who subscribe to the FTC’s 

YouTube channel and, therefore, there is no applicable system of records. 

 

9 PRIVACY POLICY 

 

9.1 Confirm that the collection, use, and disclosure of the information in this system has been 

reviewed to ensure consistency with the FTC’s privacy policy. 

 

Not applicable. The FTC will provide notice to those who visit or subscribe to the FTC’s 

YouTube channel that it is not the official website of FTC.gov and that YouTube’s privacy 

policy applies to any information an individual provides. This notice will also provide a link to 

the official FTC.gov website. 

The FTC privacy policy includes a table that lists the third-party services currently used by the 

FTC and provides links to the privacy policies of each third-party service provider. The table 

provides links to the FTC’s privacy impact assessment (PIA) for each service that requires a PIA.
11

10. APPROVAL AND SIGNATURE PAGE 

 

 

 Prepared for the Business Owners of the System by: 

 

 _________________________________ Date: __________ 

 Division of Consumer 

and Business Education 

 

 

 Review: 

 

 __________________________________ Date: __________ 

 Alex Tang 

Office of the General Counsel 

 

 

__________________________________ Date: __________ 

Jeffrey Nakrin 

Director, Records and Filings Office 

 

 __________________________________ Date: __________ 

 Marc Groman 

Chief Privacy Officer 

 

 

 __________________________________ Date: __________ 

 Margaret Mech 

Chief Information Security Officer 

 

 

 

 Approved: 

 

 __________________________________ Date: 

 Jeff Huskey 

Chief Information Officer