Apps

The US Federal Trade Commission has released a short report [PDF]  on Mobile Apps for Kids: Disclosures Still Not Making the Grade that considers the privacy disclosures and practices of apps for children in the Apple App and Google Play and stores.

The report covers the FTC’s second survey of kids’ mobile apps, the first having been undertaken last year. In the 2011 survey the FTC noted "little progress toward giving parents the information they need to determine what data is being collected from their children, how it is being shared, or who will have access to it". Progress since that study has been slow. The FTC comments that

many of the apps surveyed included interactive features, such as connecting to social media, and sent information from the mobile device to ad networks, analytics companies, or other third parties, without disclosing these practices to parents. 

More directly, FTC  Chair  Jon Leibowitz commented that although

we think most companies have the best intentions when it comes to protecting kids’ privacy, we haven’t seen any progress when it comes to making sure parents have the information they need to make informed choices about apps for their kids. In fact, our study shows that kids' apps siphon an alarming amount of information from mobile devices without disclosing this fact to parents. All of the companies in the mobile app space, especially the gatekeepers of the app stores, need to do a better job. We'll do another survey in the future and we will expect to see improvement.

The latest survey found that:

• Parents are not being provided with information about what data an app collects, who will have access to that data, and how it will be used. 
• Only 20% of the apps staff reviewed disclosed any information about the app’s privacy practices. 
•  Many apps (nearly 60% of the apps surveyed) are transmitting information from a user's device back to the app developer or, more commonly, to an advertising network, analytics company, or other third party. 
•  A relatively small number of third parties received information from a large number of apps. This means the third parties that receive information from multiple apps could potentially develop detailed profiles of the children based on their behavior in different apps. 
• Many apps contain interactive features – such as advertising, links to social media, or the ability to purchase goods within an app – without disclosing those features to parents prior to download. 
• 58% of the apps reviewed contained advertising within the app, while only 15% disclosed the presence of advertising prior to download. 
• 22% of the apps contained links to social networking services, while only nine percent disclosed that fact. 
• 17% of the apps reviewed allow kids to make purchases for virtual goods within the app, with prices ranging from 99 cents to $29.99. Although both stores provided certain indicators when an app contained in-app purchasing capabilities, these indicators were not always prominent and, even if noticed, could be difficult for many parents to understand.

The report reflects examination by FTC staff  of  hundreds of apps for children, including disclosures and links on each app’s promo  page in the app store, on the app developer’s website, and within the app. It indicates that

most apps failed to provide any information about the data collected through the app, let alone the type of data collected, the purpose of the collection, and who would obtain access to the data. Even more troubling, the results showed that many of the apps shared certain information with third parties – such as device ID, geolocation, or phone number – without disclosing that fact to parents. Further, a number of apps contained interactive features – such as advertising, the ability to make in-app purchases, and links to social media – without disclosing these features to parents prior to download. 

The FTC has urged all entities in the mobile app industry (inc app stores, developers and third parties providing services within the apps) to accelerate efforts to ensure that parents have the key information they need to make decisions about the apps they download for their children. It also urges implementation of recommendations in the FTC's recent Privacy Report such as:

• incorporating privacy protections into the design of mobile products and services; 
• offering parents easy-to-understand choices about the data collection and sharing through kids’ apps; and 
• providing greater transparency about how data is collected, used, and shared through kids’ apps. 

In a nice example of proactive policing, which could be emulated by the OAIC in Australia, the FTC indicates that it is "launching non-public investigations to determine whether certain entities in the mobile app marketplace are violating the Children’s Online Privacy Protection Act or engaging in unfair or deceptive practices in violation of the Federal Trade Commission Act".