3,337 Android apps tracking kids unlawfully, violating child privacy laws
According to researchers from the International Computer Science Institute, as many as 3,337 free, children-oriented Android apps are tracking and collecting data on kids without parental permission. This is in violation of the Children's Online Privacy Protection Act (COPPA), which is a US federal law that among other things, requires apps to inform parents about data collection from users under 13 years of age.
The study took into account 5,855 children-oriented apps
The study took into account 5,855 children-oriented apps that were downloaded 750,000 times on an average. Researchers downloaded top apps from November 2016 to March 2018 and ran them for 10 minutes daily using an automated process to simulate an actual user. They tracked in real-time how often the apps accessed information like location and contact list and whom they shared it with.
Apps collected location information, contact list
Of the 5,855 apps, 281 collected contact or location data without parental permission and 1,100 unlawfully shared information with third parties. Further, about 40% of children's apps transferring collected data did not do so using "reasonable security measures." Over 1,000 of the apps collected personal information in clear violation of the Google Play Store's terms of service.
Guilty apps included popular ones like Duolingo, Minion Rush
Notably, 1,280 apps were using Facebook Login, and 92% of them weren't properly adhering to the social network's policies to limit under-13 use. Some of the tested apps include Fun Kid Racing, Disney's "Where's My Water?," Gameloft's "Minion Rush," and Duolingo, a language learning app.
In justification
Fun Kid Racing's developers, Tiny Lab Productions, said that the app is "directed for families" and not solely children because "we see that grownups and teens play our games." CEO Jonas Abromaitis claimed that the app asks for players' birth date, and if it sees that they are under 13, it doesn't collect their data. Serge Egelman, the research paper's co-author, denied the claim.
