Over 3,300 Android apps may be violating kids\u2019 privacy, study says
Written by Tom\u00e1\u0161 Folt\u00fdn, Security Writer at ESET
Researchers find that a great portion of popular children\u2019s apps may run afoul of US privacy legislation by improperly collecting data \u2013 albeit often probably unintentionally. A response from Google to the unflattering findings wasn\u2019t long in coming.
More than 3,300 children-oriented Android apps on Google Play are possibly gathering kids\u2019 data in an improper manner, which could put the apps in violation of US child privacy legislation, a recent paper has found.
The study, called \u201cWon\u2019t Somebody Think of the Children?\u201d Examining COPPA Compliance at Scale, examined 5,855 of the most popular children-focused Android apps. It found that \u201croughly 57%\u201d of the apps \u2013 which makes out to 3,337 in number \u2013 are potentially violating the US\u2019 Children\u2019s Online Privacy Protection Act (COPPA).
COPPA protects children under 13 from invasive collection of personally identifiable information (PII). The law regulates how apps, games or websites are allowed to gather and process sensitive data from children. In so doing, it prohibits some data collection practices outright while requiring a parent\u2019s consent for others.
The 5,855 apps tested were made by 1,889 developers and have racked up 4.5 billion installs between them. They are listed in 63 different Google Play categories, obviously most of them in various \u2018games\u2019 categories.
So what exactly are the apps up to?<\/p>\n\n\n\n
The team of seven researchers hailing mainly from US and Canadian universities used an automatic testing process to detect how the apps handled data.
They found that the potential violations came in several forms. For example, 28% of the apps accessed sensitive data protected by Android permissions. Perhaps most worryingly, nearly 5% of all apps collected children\u2019s geolocation or contact information, notably the device owner\u2019s email address or phone number, without the permission of a parent.
Nearly three-fourths (73%) transmitted sensitive data over the internet, but 40% of them didn\u2019t apply reasonable security measures by failing to use Transport Layer Security (TLS), the standard for securing data in transit.
The study also identified potential non-compliance in almost 19% of the apps that collected so-called persistent identifiers (such as the device\u2019s unique IMEI number or WiFi MAC address) with third parties for prohibited purposes, notably user profiling and ad targeting. According to COPPA, these identifiers are considered personal information if they can be used to recognize a user over time and across different websites or online services.
In addition, 39% of the apps transmitted Google\u2019s advertising identifier known as AAID together with another (and immutable) identifier to the same destination, thus apparently acting in breach of the terms of service of the Google Play\u2019s Designed for Families (DFF) program.<\/p>\n\n\n\n
The researchers pinned the bulk of the blame for the data slurping on the apps\u2019 inclusion and use of third-party software development kits (SDKs). \u201cWhile many of these SDKs offer configuration options to respect COPPA by disabling tracking and behavioral advertising, our data suggest that a majority of apps either do not make use of these options or incorrectly propagate them across mediation SDKs,\u201d reads the paper.
Bearing this in mind, the researchers surmise that \u201cmany privacy violations are unintentional and caused by misunderstandings of third-party SDKs.\u201d
Over to Google
The researchers acknowledged Google\u2019s steps to ensure compliance with COPPA, but added that \u201cthere appears to not be any (or only limited) enforcement\u201d. As a result, they urged the company to be more active in its vetting process.
Meanwhile, Tom\u2019s Guide quoted a Google spokesperson as saying in response to the findings:
\u201cWe\u2019re taking the researchers\u2019 report very seriously and looking into their findings. Protecting kids and families is a top priority, and our Designed for Families program requires developers to abide by specific requirements above and beyond our standard Google Play policies. If we determine that an app violates our policies, we will take action. We always appreciate the research community\u2019s work to help make the Android<\/p>\n","protected":false},"excerpt":{"rendered":"
Over 3,300 Android apps may be violating kids\u2019 privacy, study saysWritten by Tom\u00e1\u0161 Folt\u00fdn, Security Writer at ESET Researchers find that a great portion of popular children\u2019s apps may run afoul of US privacy legislation by improperly collecting data \u2013 albeit often probably unintentionally. A response from Google to the unflattering findings wasn\u2019t long in […]<\/p>\n","protected":false},"author":2,"featured_media":7859,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_yoast_wpseo_meta-robots-noindex":"","_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_pr_autopilot_social_copy":"","_yoast_wpseo_opengraph_title":"","_yoast_wpseo_opengraph_description":"","_yoast_wpseo_opengraph_image":"","_yoast_wpseo_opengraph_image_id":0,"_yoast_wpseo_twitter_title":"","_yoast_wpseo_twitter_description":"","_yoast_wpseo_twitter_image":"","_yoast_wpseo_twitter_image_id":0,"_yoast_wpseo_primary_category":439,"_extra_hide_author_box":"1","_extra_featured_post":"","_partner_post_id":0,"footnotes":""},"categories":[439],"tags":[],"class_list":["post-7860","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","et-has-post-format-content","et_post_format-et-post-format-standard"],"yoast_head":"\n