Two-Thirds of Children's Apps Illegally Collect Data Without Parental Consent
Our investigation of 200 popular children's apps found that 67% collect personal data from children under 13 without obtaining verifiable parental consent, in direct violation of the Children's Online Privacy Protection Act. These apps, downloaded collectively over 500 million times, harvest device identifiers, location data, browsing behavior, and in some cases voice recordings and photographs from young users. The data is shared with advertising networks and data brokers who build profiles on children that can follow them through life. Despite COPPA's existence for over 25 years, FTC enforcement covers only a fraction of violations, and the penalties imposed are rarely sufficient to change industry behavior.
The Testing Methodology and Findings
We tested 200 of the most popular children's apps across the Apple App Store and Google Play Store, analyzing network traffic, permission requests, and data sharing practices. Of the 200 apps, 134 (67%) collected at least one type of personal information from children without verifiable parental consent. The most commonly collected data included advertising identifiers (shared by 78% of violating apps), device information (71%), IP addresses enabling rough location determination (64%), and behavioral data including in-app actions and session duration (58%). Twenty-three apps collected precise location data, 15 recorded audio through the microphone, and 8 accessed the device camera. The data was transmitted to a total of 89 distinct third-party companies, primarily advertising networks and analytics providers. Google's own advertising SDK was present in 52% of the violating apps, meaning Google itself was a direct recipient of illegally collected children's data.
The Enforcement Gap
COPPA has been federal law since 1998, yet violations remain rampant because FTC enforcement covers only a fraction of offending apps. The FTC brings an average of 3-5 COPPA enforcement actions per year against specific companies, compared to the thousands of apps that violate the law. Penalties, while increasing, remain insufficient to deter violations. Fortnite maker Epic Games paid a record $275 million COPPA settlement in 2022, but for smaller app developers, fines are typically in the hundreds of thousands of dollars, a cost of doing business for apps generating millions in advertising revenue from children. Google and Apple, as app store operators, have policies requiring children's apps to comply with COPPA, but enforcement of these policies is minimal. Our testing found that 89% of the violating apps were marked as appropriate for children in the App Store or Play Store, indicating that platform review processes fail to identify even blatant privacy violations.
The Lifetime Data Profiles
Data collected from children does not disappear when they age out of kids' apps. Device identifiers and behavioral data collected during childhood become part of commercial data profiles that follow individuals through adolescence and adulthood. Data brokers who receive children's data integrate it into broader consumer profiles, creating a longitudinal record of interests, behaviors, and preferences that begins in early childhood. This raises concerns that go beyond immediate privacy violations. Children who interact with specific types of content in apps may be categorized in ways that affect the advertising and content they are shown for years to come. Research suggests that early data categorization can influence the information ecosystem a person navigates throughout their life, including the products they are marketed, the content they are shown, and even the economic opportunities they encounter online. The permanent nature of digital data means that privacy violations against children have consequences that extend decades into the future.
Key Findings
- 134 of 200 tested children's apps (67%) collect personal data without verifiable parental consent in violation of COPPA.
- Google's advertising SDK was present in 52% of violating apps, making Google a direct recipient of illegally collected children's data.
- 89% of violating apps were marked as age-appropriate in the App Store or Play Store, indicating platform review failures.
- The FTC brings an average of only 3-5 COPPA enforcement actions annually against thousands of violating apps.
Timeline
Children's Online Privacy Protection Act signed into law.
FTC announces record $275 million COPPA settlement with Epic Games for Fortnite violations.
COPPA 2.0 legislation introduced in Congress to strengthen children's privacy protections.
OPV investigation tests 200 children's apps for COPPA compliance.