Thousands of child-directed Android apps and games are potentially violating US law on the collection and sharing of data on those under 13, research has revealed.
A study conducted on 5,885 child-directed Android apps from the US Play Store, which are included in Google’s Designed for Families programme, found that well over half of the apps potentially violated the US Children’s Online Privacy Protection Act (Coppa).
“We identified several concerning violations and trends,” wrote the authors of the Proceedings on Privacy Enhancing Technologies, led by researchers at the International Computer Science Institute at the University of California, Berkeley. “Overall, roughly 57% of the 5,855 child-directed apps that we analysed are potentially violating Coppa.”
Among the apps, 4.8% had “clear violations when apps share location or contact information without consent”, 40% shared personal information without applying reasonable security measures, 18% shared persistent identifiers with their parties for prohibited purposes such as ad targeting, and 39% showed “ ignorance or disregard for contractual obligations aimed at protecting children’s privacy”.
The researchers found that 28% of the apps accessed sensitive data protected by Android permissions and that 73% of the tested apps transmitted sensitive data over the internet.
“While accessing a sensitive resource or sharing it over the internet does not necessarily mean that an app is in violation of Coppa, none of these apps attained verifiable parental consent: if the [automated testing] was able to trigger the functionality, then a child would as well,” the researchers wrote.
“This is an incredibly important study that clears demonstrates that many apps for children are violating Coppa at a massive scale,” said Josh Golin, executive director of the Campaign for Commercial Free Childhood. “Many kids’ apps are sharing personal information with third parties who do data-driven personalised marketing, the very thing Coppa was supposed to guard against.”
The researchers said that Google had taken steps to help enforce Coppa compliance, with the Designed for Families programme that provides developers of children’s apps with information on the law and requires certification that apps comply. But they said “as our results show, there appears to not be any (or only limited) enforcement”.
While the researchers surmised that it is likely that “many privacy violations are unintentional and caused by misunderstandings of third-party Software Development Kitss” that are used to build the apps, they urged Google to do more active vetting process of apps for Coppa compliance.
The researchers also analysed whether apps with potential Coppa violations were part of the US Federal Trade Commission’s (FTC) Safe Harbor programme, under which developers submit their apps for certification that they are Coppa-compliant. They found that few apps are actually certified under Safe Harbor and of those that are “potential violations are prevalent”.
“Based on our data, it is not clear that industry self-regulation has resulted in higher privacy standards; some of our data suggest the opposite. Thus, industry self-regulation appears to be ineffective,” the researchers wrote.
Golin said: “It’s also clear that self-regulation efforts – both Google’s attempts to ensure Coppa compliance at the app store level and the Safe Harbor certification programme – are failing families. As has been demonstrated time and time again, self-regulation is no substitute for sustained government enforcement.”
Jeffrey Chester, executive director for the Center for Digital Democracy, said: “For years, the FTC has failed to address how both Google and Facebook routinely undermine consumer privacy.”
“However, the FTC has just been through [an] earthquake-like wake up call, given the revelations that Facebook allowed companies like Cambridge Analytica to seize data on 87 million people … Parents are confronted with a nearly impossible task. Given the dominance of the Google App platform and the interest young children have in apps, it’s not practical for a parent to have to spend time trying to decipher the complex connections that drive the ad supported App industry.
“That’s why we hope the FTC has finally awoken from its long digital privacy slumber.”
A Google spokesperson said: “We’re taking the researchers’ report very seriously and looking into their findings. Protecting kids and families is a top priority, and our Designed for Families programme requires developers to abide by specific requirements above and beyond our standard Google Play policies.
“If we determine that an app violates our policies, we will take action. We always appreciate the research community’s work to help make the Android ecosystem safer.”
- YouTube illegally collects data on children, say child protection groups
- Android phone makers skip Google security updates without telling users – study
