Well, I'm no computer expert. I just have my theories and messed around with some things. Technically it should be illegal for anyone to open your mic or camera without your consent. But if you remember what Snowden shared you know the possibility is there. Backdoors into routers have been a thing for sometime, PRISM, etc. WebRTC is a somewhat newer thing being build into browsers and apps. They are on by default for functionality. This allows outside access your mic and cam. I dont know much about it, I just turn it off. For IOT devices that rely on apps its not as easy to see all the details. User settings only show so much. Someone would have to reverse engineer or understand the code to really know. I guess you can check connections for out going IP addresses and do look ups to see. Also, in your browser if youre using uMatrix you can see what technologies/websites w/e the parent website is connecting you to. Google is knee deep in nearly everything. Facebook embeds itself in your systems as much as it can, at least it did when I used it years ago.

There was a video I saw where someone took 2 android phones. Put one in airplane mode and the other normal, walked around a busy part of town and then dumped the data on incoming and outgoing packets. The phone in airplane mode actually sent more data than the one connected to the cell towers. I dont recall the tech side of it too well, but it was something like hundreds of connections being made all giving bits user info.

This thing with youtube is probably them just trying to monetize more clicks. Forcing you to store a cookie or if you log in, for data mining. Again I'm no techie, Im just a guy with a computer.