A new article by The Washington Post discusses how App companies are using loopholes in privacy law to harvest the personal data of children. Geoffrey Fowler, a technology columnist, provides a worrying figure to detail the extent to which these companies are collecting data from the children who use their apps. According to Fowler, by the time a child is 13, online advertising firms have collected on average 72 million data points about that child.

A lot of this data collection isn’t even being conducted by the original app that the child might be using- it’s often done through a third party application that the user isn’t even aware of, and will never know the name of. These apps then learn the interests of the user (in this case a child) through the data points that they collect, which allows them to predict what the right types of products/services are to advertise to that particular child.

According to the 1998 Children’s Online Protection Act, for organisations to have to uphold certain privacy rights for children, the organisaton must have actual knowledge that a child is using their app. This is the loophole that these apps are using, as they claim that they don’t know who their users are, and therefore can get away with using children’s data and selling it on. Fowler states that the laws in the US that cover this need updating, and organisations should be made to only collect the data that they need for the purposes of their operations. Currently, many apps will make it appear that they are only collecting data for a specific use, such as collecting your location for maps, but once you have consented to the collection of your data, apps continue to collect your data and use it in multiple ways. Whilst the individual data point that is collected at the time you consent, as more and more data is collected on the user, the app can sell this data to advertising companies for vast amounts of money.

Fowler, along with Pixalate have looked at how popular children apps use their users’ data. They tracked the collection of children’s data across these apps, and what the app did with their users’ data once it had been collected. Fowler and Pixalate found that over two-thirds of the apps that were looked at on Iphones sold children’s data to advertising companies once it was collected. For Android phones, this figure was higher than on Iphones, at 79%. Fowler details the roles that Apple and Google play in facilitating this exploitation of US privacy laws. Whilst apps on stores do have an age rating for each app. The issue is that the rating has nothing to do with whether or not those apps are collecting data from children. According to US law, organisations are not allowed to collect data on children under the age of 13 without the consent of their parents. However, big companies like Apple and Google, who make billions from their app stores, have found loopholes to get around this law. App developers claim to companies like Apple and Google that they don’t know who is using their apps, or that they market it towards adults and not children. The hosts of the apps who govern what goes onto their stores then allow these apps to be put on their store. 

One solution to this issue is the possibility of having the phone itself know that a child is using it. Practically, this would work through an adult entering the age of their child when they get the phone. If the age is under 13, then the phone doesn’t allow apps to be downloaded without the explicit permission from the child’s parents. Ultimately, not enough is being done in the US to protect the data of children. With smartphones now being common amongst children, these apps that are collecting and selling children’s data will only increase. Therefore, if companies like Apple and Google aren’t going to regulate the apps that they allow on their stores to protect children’s data, there needs to be changes in privacy laws that force change, and ensure that any data collected on children under the age of 13 is done so only with the consent from their parents, and is not sold on to advertisers.

The full article by The Washington Post can be read by clicking here.