Thousands of apps in Google Play Store may be illegally tracking children, study finds

[Matrix]

 

(Matt Rourke/AP)

Update: Story updated with Google's and Disney's responses.

Thousands of free, popular children's apps available on the Google Play Store could be violating child privacy laws, according to a new, large-scale study, highlighting growing criticism of Silicon Valley's data-collection efforts.

Seven researchers analyzed nearly 6,000 apps for children and found that the majority of them may be in violation of the Children's Online Privacy Protection Act (COPPA).  Thousands of the tested apps collected the personal data of children younger than 13 without a parent's permission, the study found.

“This is a market failure,” said Serge Egelman, a co-author of the study and the director of usable security and privacy research at the International Computer Science Institute at the University of California at Berkeley. “The rampant potential violations that we have uncovered points out basic enforcement work that needs to be done.”

[Facebook is now in the data-privacy spotlight. Could Google be next?]

The potential violations were abundant and came in several forms, according to the study. More than 1,000 children's apps collected identifying information from kids using tracking software whose terms explicitly forbid their use for children's apps, the study found. The researchers also said nearly half the apps fail to always use standard security measures to transmit sensitive data over the Web, suggesting a breach of reasonable data-security measures mandated by COPPA. Each of the 5,855 apps under review was installed more than 750,000 times, on average, according to the study.

Unfortunately for parents, there's little consumers can do to protect themselves since the policies and business practices of app developers and ad-tracking companies are often opaque, Egelman said. The study also points to a breakdown of so-called self-regulation by app developers that claim to abide by child privacy laws, as well as by Google, which runs the Android platform, he said.

[Controversial apps for kids make cosmetic surgery into a game]

Some of the apps in question included Disney’s “Where’s My Water?," Gameloft’s “Minion Rush” and Duolingo, a language learning app. The findings also suggested that app creators that had been certified as COPPA-compliant were no better than any of the other app developers at protecting children's privacy. The researchers used a testing platform that allowed them to see in real time how often the apps accessed sensitive information — such as location data and contact lists — on a phone and what other entities the apps shared that information with.

Disney said in a statement that the study doesn't claim to identify any actual violations. "Protecting children’s online privacy is very important to us and we are confident that our practices adhere to the law," the company said. "We have a robust COPPA compliance program, and we maintain strict data collection and use policies for Disney apps created for children and families.”

Gameloft and Duolingo did not respond to requests for comment.

The researchers note that Google has worked to enforce COPPA by requiring child app developers to certify that they comply with the law. “However, as our results show, there appears to not be any (or only limited) enforcement,” the researchers said. They added that it would not be difficult for Google to augment their research to detect the apps and the developers that may be violating child privacy laws.

Google said in a statement, “We’re taking the researchers’ report very seriously and looking into their findings."

Critics of Google's app platform say the company and other players in the digital-advertising business, such as Facebook, have profited greatly from advances in data-tracking technology, even as regulators have failed to keep up with the resulting privacy intrusions.

“Google has basically looked the other way while it was able to generate revenues off of children's apps,” said Jeffrey Chester, the executive director of the Center for Digital Democracy. “The new, alarming report is further evidence that Google is thumbing its nose at the only federal online privacy law that we have.”

The study, "'Won't Somebody Think of the Children?' Examining COPPA Compliance at Scale,” was published in the journal Proceedings on Privacy Enhancing Technologies last week.

Source