The study's authors used an automated analysis on apps that agreed to abide by COPPA as part of their inclusion in the Designed for Families program, but it found that 28 percent of them still accessed sensitive data and 73 percent of them transmitted sensitive data over the Internet. Each of the 5,855 apps under review was installed more than 750,000 times, on average, according to the study.
Released by researchers affiliated with the International Computer Science Institute (ICSI), the report claimed that the world's most popular app marketplace is hosting thousands of apps that are improperly tracking children.
The researchers found that five per cent of the apps in the study collected user location and contact data without first looking for parental consent, while 1,100 apps shared sensitive information to third-party services, despite terms of service prohibiting such data collection over concerns it would lead to targeted advertising.
The reason for uncertainty regarding the exact numbers is because there is no concrete, widely agreed upon criteria for determining what apps are for children.
COPPA regulates how mobile apps, games, and websites are allowed to collect and process personal information from children under the age of 13, in an effort to protect minors from giving away their personal data before they fully understand the implications of it.
Worse, researchers point out that around a fifth of all the tested apps used an SDK that specifically prohibited developers from using its library in child-directed apps, due to the nature of its data collection.
Geolocation data not only reveals where individuals live, but can also help infer socioeconomic scenarios, everyday habits, and health conditions, among others. It's not entirely clear developers, particularly those in other countries, were even aware of COPPA, and some of the configurations and standards are relatively obscure or left on by default. "We observed that 81 of their 82 apps that we tested shared Global Positioning System coordinates with advertisers", the researchers stated in the report.
In an attempt to not be suspended from Google's services, Unlockd has taken out an injunction against the online advertising giant in the UK High Court and is threatening to report the company for uncompetitive behaviour to various competition regulators including the Australian Competition and Consumer Commission, the US Federal Trade Commission and the European Commissioner for Competition. In 2016, the ad network InMobi was fined United States dollars 1 million for gathering the location of users - including children - without proper consent.
The researchers published the study, "Won't Somebody Think of the Children?" But they said "as our results show, there appears to not be any (or only limited) enforcement".