Popular social media platforms and video streaming services pose serious risks to users’ privacy, with children and teens at greatest risk, the Federal Trade Commission concluded in a report published Thursday.

The report, which runs to more than 100 pages, details the companies’ data, advertising and recommendation systems and how they rely on information about users to sell ads. Users also had “no meaningful control over how personal information was used for AI-powered systems” on the companies’ platforms, the report said.

“While these surveillance practices are lucrative for the companies, they can compromise people’s privacy, threaten their freedoms, and expose them to a range of dangers, from identity theft to stalking,” FTC Chair Lina Khan said in a press release.

The report includes staff recommendations calling for federal privacy legislation, as well as greater efforts by companies to prioritize privacy in their data collection and recommendation systems. The report also said parents should have more control over what information is collected from children and teens.

“To protect users, especially children and teens, clear, basic protections that apply to everyone are needed,” the FTC said in the report.

The report comes as concerns about data collection, privacy and AI-powered recommendation systems have become increasingly bipartisan issues in an era of deep political divisions. Some legislation has advanced, notably the Kids Online Safety Act (KOSA) and the Children and Teens’ Online Privacy Protection Act (COPPA) 2.0, both of which passed the Senate and recently advanced in the House Committee on Energy and Commerce.

“COPPA should be the baseline, not the ceiling,” the FTC said in its recommendations.

The FTC initially ordered Amazon, Facebook and WhatsApp (now Meta), Twitter (now X), ByteDance, YouTube, Reddit, Snap, and Discord in December 2020 to provide data about how the companies collect and use their users’ personal information.

The report examined 13 platforms owned by the companies, including Twitch, Facebook, Messenger, Kids Messenger, Instagram, WhatsApp, X, TikTok, YouTube, YouTube Kids, Snapchat, Reddit and Discord.

The report found that companies engaged in “massive surveillance” by collecting and storing personal information about consumers, regardless of whether they are users of the companies’ platforms. Some companies purchased this information from data brokers, the report said.

Representatives for Amazon, X, ByteDance and Reddit did not immediately respond to requests for comment.

Kate Sheerin, Discord’s head of U.S. and Canada public policy, said the FTC report is an “important step” but also said it “conflates very different models and paints too broad a picture, which can be confusing for consumers and inaccurately portray some platforms, like Discord.”

Sheerin disputed the report’s assertion that concerns about user privacy “stem from a business model that barely differs across these nine companies.”

José Castañeda, a spokesman for Google, of which YouTube is a subsidiary, said the company does not sell people’s personal data or use sensitive information to serve ads.

“We prohibit ad personalization for users under 18, and we don’t personalize ads for people who view ‘made for kids’ content on YouTube,” Castañeda said.

Representatives for Snap and Meta declined to comment on the report.

According to the report, the privacy of children and teenagers is not sufficiently protected on these social media platforms and streaming services.

The FTC wrote that companies attempted to avoid liability under COPPA, which regulates the collection of data from children under 13, by claiming “that there are no child users on their platforms because children cannot create accounts.”

However, it is well known that children and teens spend a lot of time on social media, and the FTC wrote that companies “cannot ignore this reality.”

The report found that most companies treat teens’ accounts the same as those of adults, putting their privacy and mental health at risk, the report said.