Research shows that a quarter of children's apps on the Google Play Store violate privacy rules

A recent study by Comparitech revealed that many children's apps on the Google Play online store platform violate the age-appropriate design framework set forth by the Commissioner's Office. UK Information (ICO).

The ICO Rule Framework, which went into effect in September 2020, sets out 15 standards that online services must follow to protect children's privacy and online data. The Code applies to any service that can be accessed by young people under the age of 18 in the UK, even if the service is not specifically targeted at you. In addition, the ICO also requires online services to conduct data protection impact assessments and provide transparent and appropriate privacy policies for children.

Research shows that a quarter of children's apps on the Google Play Store violate privacy rules Picture 1

Comparitech research shows that nearly 25% of apps reviewed have privacy policies that violate the ICO code of conduct, such as collecting personal data without the right policies or consent, sharing data data with third parties without transparency, or claims not to target children despite being located in a dedicated kids apps area on the Google Play Store. The most common violation is collecting IP addresses or other permanent identifiers from children without a clear and comprehensive section on children's data protection in the app's privacy policy. IP addresses are considered personal data by the ICO and the EU General Data Protection Regulation (GDPR).

Comparitech's study included a total of 402 apps that appeared on the Google Play children's tab, and assessed whether they were compliant with the ICO rules. As follows:

1. 96 apps (23.9%) have privacy policies that violate ICO rules.
2. These apps have more than 383 million downloads by users, and have earned the "expert-approved" badge from Google Play.
3. 22 apps (5.5%) claim not to be directed to children despite being in a dedicated kids section, and have a PEGI rating of 3 (suitable for all ages).
4. 46 apps (11.4%) collect personal data without a policy specifically for children, or are not clear, understandable, or unclear about the method of data collection or sharing third party share.
5. 16 apps (4%) collected data without parental permission or without appropriate protocols.
6. 12 apps (3%) do not collect data themselves, but cooperate with third parties that are capable of collecting data.

Comparitech's findings suggest there may be flaws in the Google Play Store's app review process, and the platform's own enforcement of policies.

David Pac

Update 27 February 2023