Hacker News Reader

Since selling PII is a common practice in the US industry, I believe the onus is reversed, they need to prove that they delete/keep-private.

Yep, that's my reasoning too.

Given how YouTube makes money from advertising, I suspect it's more profitable for them to keep the data to themselves and use it for targeting. I would not be surprised if they also share it with Adsense & other Alphabet entities (and presumably with government agencies), but am doubtful beyond that.

Not that this is much better than directly selling to third parties.

This sort of thing is common enough that simply establishing means, motive and opportunity are convincing to me. If not yet then soon. You can't hope for a smoking gun every time.

Give it a couple years for the inevitable data breach to leak all the details