Monday, 7 March 2016

YouTube Channels, Google Accounts, And Their Ownership (The Answer Might Come As A Surprise)

Let me state this from the outset:  Google Accounts are individual and personal affairs.  There-  that's that out of the way with.  Now-  what does that mean and how does it affect users?


1.  Google Accounts are owned by individuals, the persons who create or are given access to a Google Account.

This is a commonly overlooked fact and it is crucial in understanding the options available to users for retaining and, often more importantly, regaining access.  The clues are in the creation process where-

  • the first and last name of an individual are called for,
  • the birthdate, and not the founding/creation date, is called for, 
  • a gender is asked for, and-
  • the agreement between the user and Google is sealed with the user clicking "I agree", and not "we/the organisation agree(s)".

Note the emphasis on an individual's details required

With the last one the user basically agrees to maintain the integrity of their Google Account and to not give access to a third party, making sure to maintain security for themselves.  This, the latter, is something I will address in more detail later.


2.  YouTube channels are mere services on Google Accounts and are "owned" by those individuals who control (and, presumably, own) the Google Accounts these YouTube channels are services on.  And because Google Accounts are owned by individuals-  so are the YouTube channels thereon.  And the Blogger account.  And the Gmail.  Which brings me to-


3.  The associated email addresses are their Google Accounts' usernames.  Pretty much any email will do- Google's own Gmail service, third party online services like Yahoo and Hotmail or your own domain email service.  But, again, be aware that even a business email which is used by more than one person does not render the Google Account a group affair.  In fact academic email supplied by an educational establishment or managed mail through a company are not, in fact, owned by the individual owning the Google Account and create a near impossible situation where the owner of the Google Account does not have full and sole control of their Google Account due to an establishment having control over the email address.  What does this mean?  Read on:


4.  Case scenarios:

  • Example 1:  a student graduates and the academic establishment removes the student's email address.  This leads to the student no longer having use of their Google Account which they'd created with that email.  The only option is for them to work with the academic establishment to reinstate the email address and to see if they, between them, can change the Google Account's email address to one owned and controlled by the student.
  • Example 2:  an employee of a company/organisation sets up a Google Account with YouTube channel and other services using their company/work email address which is managed mail or through the company's Google Apps.  They leave the company/organisation and their company/work email is deleted by their former employer.  This renders the Google Account inaccessible in the same manner as the example above.  In fact-  this can also delete the entire Google Account if done (in)correctly.  This is because the email address was never actually owned by the individual setting up the Google Account and this is, in essence, a conflict of interest and not strictly in line with the agreement between the Google Account's owner/creator and Google.  Support is extremely limited and must involve the owner of the managed mail or Google Apps account.
  • Example 3:  an employee of a company/organisation sets up a Google Account with YouTube channel and other services using their personal email address or a Gmail email address, ostensibly for the company/organisation but then leaves without transferring ownership of the Google Account to another individual.  The company, who never owned/cannot own the Google Account, is left without recourse beyond contacting the owner and asking them to transfer ownership to another individual in the company.  This is, of course, at the discretion of the (legal) owner of the Google Account.  Meaning that if they refuse to hand over the Google Account, then there is little the company/organisation can do beyond claiming the content of the YouTube channel where applicable, filing a trademark infringement claim to have the channel taken down, or even taking legal action.  In the video below I look at Google Account ownership:



5.  Control/access is "nine tenth of the law" is a sweeping statement, but it pretty much sums up the basic facts.  Google Accounts can be created by individuals who agree to abide by Google's terms of service and the individual can pass on ownership of their Google Accounts to another individual if they must, or just transfer ownership of their Google Account's assets to another individual's Google Account if they need to ownership of their Google Account for themselves.  The individual secures their Google Account against third party access by any other individual in order to maintain "ownership" and this is addressed with-


6.  Access to a Google Account is the user's responsibility.  Think about it-  if you cannot remember or don't know (perhaps because you let someone else create/own what you believe is yours) your Google Account's sign in details (i.e. the email address username and password used to sign in with) then Google cannot verify you as the rightful owner except by asking you to use your Google Account's recovery options which you set for such an eventuality.  And, failing you being able to use your own recovery options-  very generic questions about the Google Account which only the owner can know.

This means that if the third party email address or the phone number placed on record are no longer valid-  they cannot, obviously, be helpful to you.  But Google cannot know that they are no longer valid because the owner didn't update them.  And Google will not override them as they are obliged by the creator/owner to maintain nominal security in the absence of something like 2-step verification which I discuss in the next section.

And the implications of the above for someone who is seeking access to something they did not create (and therefore do not actually own) is that they have no option but to ask the creator/owner for access to it.

In this video I discuss what to consider when creating a Google Account/YouTube channel for a client or third party but this can also be used to inform those who ask others to create Google Accounts for them:




7.  Retaining access and security of a Google Account is the responsibility of the individual, the owner.  Because the contract the individual agreed to is between the individual and Google and Google Accounts are a free service the gaining of access and security of an individual's Google Account is very much DIY.  This is done with the Google Account Recovery tool.

I have dealt with this topic for over six years now and it has become painfully clear that confusion over correct setting up, ownership of assets and responsibility for security has led to many Google Accounts and their assets being lost to their owners or those who mistakenly believed themselves to be owners.

The thousands of cases I have seen over the years have three common themes:

  1. It's my video/me in the video-  why does the YouTube channel's Google Account not belong to me?  To which the answer is that copyright ownership of a video on a Google Account's asset ≠ proof of ownership of the Google Account and, with it, the YouTube channel.
  2. It's my company's YouTube channel and Google Account-  why can I not be given access to the Google Account?  To which the answer is that the Google Account is owned by the creator or the person who has control, and access can only be granted where the person seeking access is given it by the owner or can successfully use the recovery options put in place by the creator/owner.
  3. It's my Google Account but the email was academic/managed mail/run via Google Apps so why is it no longer available to me?  To which the answer is-  the email is kind of a Google Account already and is, therefore, owned by the supplier of the email address itself.  So get in touch with the owner of the email service and see if they can assist you to regain control of the Google Account, something which is unfortunately not a certainty.


8.  Security of a Google Account is vital.  Making use of the offered options to secure the Google Account has become increasingly important as Google Accounts and their assets have become valuable commodities in the digital age.  A monetised YouTube channel with a good number of subscribers or a viral video or two can be worth money to a hacker, and gaining control of a Gmail Google Account can have immeasurable impact if the Gmail is used for bank accounts and other valuable online activities.

In response Google have seriously ramped up security in early 2015 to the point that sometimes even genuine owners are locked out, perhaps because they didn't make use of the option to set recovery options, or maintain those they had.

The answer here is to seriously consider 2-step verification in order to prevent this from ever being an issue.  Read through the link and consider this-  you can set up recovery email addresses, you can set up access/recovery phone and printable codes so that only you, with the device and/or codes can gain access.  And you can get a U2F security key which adds an additional layer of security.  You can even set your device up to be the trusted one so that you don't have to use your security features every time you sign in.

Now-  I used to be wary of such things, careful to not give out my personal details online and steering clear of most anything which smacks of giving someone else control of my assets but having dealt with the consequences of outdated recovery options or none set in the first place, and how difficult it is to prove to Google that this doesn't mean that the users are not genuinely the owners-  I cannot stress this enough.

  • Do not assume that the person you are sharing access to your Google Account with will not accidentally (or purposely) delete something which cannot be recovered once deleted.  Or lock you, the owner, out.  It is why Google deem Google Accounts to be owned by individuals, not groups of people.
  • Do not trust in a third party email service to be safe, if that is the email address you use for, say, your website's public email.  Not naming names but a well-known email provider suffered serious security breaches which led to the Google Accounts secured only with those emails to be vulnerable and hacked en masse a couple of years ago.
  • And do not rely on any security offered by Google if you don't also run malware/virus scans on your devices.   Remote access malware and trojans don't need to gain access-  they get in with you, as you sign in unaware of their presence.
  • Never ignore alerts from Google about your Account security.  They are always important.  By all means question them (phishing is also an issue, which might contribute to some users ignoring important alerts) but then check with the Google help fora.
  • Be vigilant and paranoid (but perhaps not quite so much where Google is concerned.  At least in regard to your assets with them) and don't use an email which is publicly known.

No comments:

Post a Comment