Google Play Store allegedly littered with apps that can harvest data about children

Edward Munn April 16, 2018

Only a week after it was alleged that YouTube violated US laws that protect children’s online privacy, a study has claimed a majority of popular free children’s apps in the Google Play Store are also in breach of these rules.

Google Play Store allegedly littered with apps that can harvest data about children

READ NEXT: What is GDPR?

Based on a sample of 5,855 children’s apps, the study – a collective effort by a number of organisations including the University of British Columbia and the University of California – found that 73% of apps transmitted sensitive data over the internet and that 28% accessed sensitive data protected by Android permissions.

Some 256 (4.4%) were found to collect geolocation data, 107 shared the device owner’s email address and 10 even shared the user’s phone number.

The study’s authors claim that none of the apps in question attained “verifiable parental consent” for accessing or sharing this private information, which constitutes a violation of the Children’s Online Privacy Protection Act (COPPA) in the US.

The report continues that third-party software development kits (SDKs) are largely to blame for the high proportion of apps potentially in violation of COPPA.

“While many of these SDKs offer configuration options to respect COPPA by disabling tracking and behavioral advertising, our data suggest that a majority of apps either do not make use of these options or incorrectly propagate them across mediation SDKs.”

Furthermore, it says Google’s efforts to limit tracking by using resettable advertising IDs are largely ineffective.

“Of the 3,454 apps that share the resettable ID with advertisers, 66% transmit other, non-resettable, persistent identifiers as well, negating any intended privacy-preserving
properties of the advertising ID,” it reads.

This news will no doubt raise further concerns in relation to Google’s responsibility to protect children’s privacy. When General Data Protection Regulation (GDPR) comes into effect from next month, children under the age of 13 in the UK will need parental consent before they can share their personal data with companies.

We have approached Google for comment.