A report titled "Won’t Somebody Think of the Children? Examining COPPA Compliance at Scale" revealed that nearly 60% of the most popular Android apps targeted at children and families were potentially violating the federal law that requires companies to protect children under 13.
Released by researchers affiliated with the International Computer Science Institute (ICSI), the report claimed that the world's most popular app marketplace is hosting thousands of apps that are improperly tracking children.
Based on our automated analysis of 5,855 of the most popular free children’s apps, we found that a majority are potentially in violation of COPPA, mainly due to their use of third-party SDKs. While many of these SDKs offer configuration options to respect COPPA by disabling tracking and behavioral advertising, our data suggest that a majority of apps either do not make use of these options or incorrectly propagate them across mediation SDKs. Worse, we observed that 19% of children’s apps collect identifiers or other personally identifiable information (PII) via SDKs whose terms of service outright prohibit their use in child-directed apps. Finally, we show that efforts by Google to limit tracking through the use of a resettable advertising ID have had little success: of the 3,454 apps that share the resettable ID with advertisers, 66% transmit other, non-resettable, persistent identifiers as well, negating any intended privacy-preserving properties of the advertising ID.
The report comes at a time when the industry is under scrutiny for their data collection and protection practices. However, while Facebook has time and again failed to protect user data, Google - another company obsessed with user data - has rarely graced the front pages for data misuses or privacy scandals. But amid the growing focus on user privacy, this is the second incident targeting Google this month. Only last week the company came under fire when it was revealed that YouTube was potentially violating the same law by "actively packaging under-13 content for advertisers" and then enabling them to track these users.
In its response, Google has said that it is looking into the latest report.
"We’re taking the researchers’ report very seriously and looking into their findings,” a Google spokesperson said. “Protecting kids and families is a top priority, and our Designed for Families program requires developers to abide by specific requirements above and beyond our standard Google Play policies."
"We always appreciate the research community’s work to help make the Android ecosystem safer," the company added. Google has promised that if the company determines that an app violates its policies, it will take action.
- The complete research can be accessed here (PDF).
