1 in 2 popular apps collect data: an in-depth analysis of data collection in children’s Android apps
Children are spending hours on their smartphones, whether playing mobile games or making use of educational apps. While the latter holds some merit, this also leaves parents facing the challenge of protecting their children’s data from unauthorized use and invasive data processing practices.
Data misuse by app developers and insufficient parental control can leave children exposed not only to predatory marketing techniques but also to criminal activity, including a particularly concerning trend in online crime involving the identity theft of minors (which can go undetected until the child turns 18).1
Legal and regulatory gaps, combined with weak enforcement, also contribute to these dangers, making it imperative for parents to carefully monitor and evaluate the data-safety and privacy practices of the apps their children use.
Distinguishing which apps are safe can be difficult, however, with the Google Play Store offering no way to filter out apps that collect data. What’s more, 90% of Americans admit that they don’t fully understand privacy policies, according to a Pew Research survey.2
To help better understand the privacy implications of children using child-targeted Android apps, Incogni’s research team collected the 10 most popular apps from 59 countries, identified 74 unique apps, most of which were games, and examined their data-safety sections on the Google Play Store.
Key insights:
- 34 out of 74 investigated apps collect at least some user data.
- 11 of the 34 apps that collect data collect 7 or more data points from their users, with the most frequent being location, email addresses, purchase history, and app interactions.
- Regarding the 103 data points collected across these 11 apps, developers disclosed a total of 235 purposes, 82 of which are for analytics, 47 for app functionality, 34 for fraud prevention, and 17 for advertising or marketing.
- Almost all of the data-collecting apps encrypt data and claim to be committed to following the Google Play Families Policy. However, only 62% of data-collecting apps allow users to request that their data be deleted.
- By location, apps popular in Oceania collect and share the highest number of data points, with New Zealand users giving out the most data points in the region, at an average of 5.3.
- Apps popular in Europe collect an average of 5 data points, with apps collecting the most data in four countries: Finland, Ireland, Poland, and Portugal.
- The least data-hungry apps were noted in Pakistan, where developers claimed to collect no user data, and Algeria, where apps collect 0.2 data points on average.
- North America is the third most data-hungry region, with popular apps collecting an average of 4.1 and sharing 0.2 data points. In the region, apps popular in America collect more data than other neighboring countries, collecting 4.9 data points (almost double Mexico’s 2.6).
Overview of most data-hungry apps
On average, all the investigated apps collected 2.6 data points from their users and shared 0.8 data points with third parties—a notable difference from other apps previously investigated by Incogni. What’s more concerning is that, out of 74 investigated apps, 34 collect some user data, and 21 share it. The 34 apps that collect data do so from an average of 5.7 data categories (out of a total of 14) and share from an average of 2.8.
Some apps stood out as particularly data-hungry. Namely, we identified 11 apps that collect 7 or more data points, with 5 of those collecting 10 or more. Together, these 11 apps account for 55% of all the data points collected by the investigated apps.
Of these 11 apps, 4 collect their users’ approximate location, 8 collect email addresses, 2 collect photos, and 8 collect purchase histories.
3 of these 11 apps share at least one of the collected data points for advertising purposes. WildCraft: Animal Sim Online discloses that they share users’ approximate location for advertising or marketing purposes.
For the 60 total data points collected across these 11 apps, developers disclosed a total of 235 purposes, 82 of which are for analytics, 47 for app functionality, and 34 for fraud prevention. Notably, 17 data points are collected for the purposes of advertising or marketing.
Overview of the most data-sharing apps
Something to keep in mind when interacting with an application is that the data it collects may go beyond the developer. A lot of the data apps collect ends up reaching third parties.
To understand this better, we looked at how the most popular apps for children share user data with third parties. The Google Play Store includes information not only about what data developers collect and share but also for what purposes they do so.
Therefore, another subset of apps we identified was those that share the most data with third parties. Among the 74 apps investigated, we found that 7 share 4 or more data points. The number of data points shared by these 7 apps accounts for 54% of all data shared by the apps we investigated.
5 of these generous apps share users’ device or other IDs, 2 share purchase history, and 1 even shares payment information.
To understand why this data is shared, we also looked at the purposes of these data points. All 5 instances of a user’s approximate location and both instances of their purchase history being shared had the purpose of advertising or marketing ascribed to them. Notably, all 7 of the most generous apps shared user device or other IDs for the purposes of marketing.
Curiously, an app not among the top 7 most generous, Pokémon Quest, shares 3 data points, while claiming that they don’t collect any in their data security section on the Play Store.
Optional data
We found that almost 14% of the data points collected by popular children’s apps are optional among several of the apps, meaning that people can exercise some control over how much of their children’s data they are giving up. Only 10 out of the 34 data-collecting apps give their users this option.
Among the top 11 most data-hungry apps, an average of 14% of the data they collect is optional, with 6 of these 11 apps collecting at least one optional data point. The data point these apps most frequently give users the option not to give up is their email address.
On the other hand, none of the shared data is optional. This means that none of the 21 data-sharing apps give users the choice to not share their information with third parties.
Data-safety best practices
When publishing an app on the Google Play Store, developers have to provide information about how they handle user data. In the Security practices section of the apps’ pages on Google Play, users can find information such as whether their data is encrypted, whether they can request their data be deleted, and if the developer is committed to the Google Play Families Policy.3
We consider apps that answer “yes” to each of these questions to be following the best data-safety and security practices. In this regard, our researchers only evaluated apps that collect at least some user data, as those that claim not to collect any would provide their users no benefit by following these best practices.
94% of data-collecting apps encrypt data and claim to be committed to following the Google Play Families Policy. However, only 62% of data-collecting apps allow users to request their data be deleted. An even lower proportion, only 56% of data-collecting apps, claim to do all three and, therefore, follow best data privacy and safety practices.
Of the 11 apps that collect 7 or more data points, only 1 does not follow all best data-safety practices, with Baby Panda’s Kids Play not allowing users to request their data be deleted.
More notably, of the 7 apps that share 4 or more data points, 4 do not follow best data practices. Three of these apps do not allow users to request that their data be deleted.
Countries
When we compared the most popular apps by country, we were able to clearly identify some regions and countries where significantly more data was collected and shared.
Hover over or tap the countries for more information.
Apps popular in Oceania had the highest average number of data points collected per app at 5.3. However, there were only two countries in our dataset that were ascribed to this region: Australia and New Zealand. Apps popular with Australian users collect an average of 5.2 data points and share 0.4. Apps popular among New Zealanders collect an average of 5.4 and share 0.4 data points, making it the country in the region where children’s apps collect the most data.
The region with the second most data-collecting apps is Europe, where 5.1 data points are collected and 0.6 are shared by popular apps, on average. We also identified countries with the most data-collecting apps overall within Europe. These being Finland and Ireland, collecting 6.7 and 6.2 data points, on average, respectively. The popular apps in Finland share an average of 0.9 data points, while those in Ireland share 0.4.
North America follows as the third most data-hungry region, with popular apps collecting an average of 4.1 data points and sharing 0.2. Apps popular among American users collect more data than other investigated countries in the region at 4.9 data points, followed by Canada at 4.7. Notably, American apps also share 0.4 data points on average, while other countries in North America share 0.2 or fewer. Mexico stands out in the region, with its most popular apps collecting 2.7 data points, almost half of those in the United States.
In Asia, the most popular apps collect 3.2 data points, on average, and share 0.4. Apps popular in this region had the biggest disparities in data collection between countries. Apps popular in Taiwan collect the most data at 6.1 data points, which is almost double the average and almost 2 data points higher than the Philippines, which came in second at 4.4 data points collected. Notably, apps popular in India come in fifth overall, in terms of how much data they share, at 0.9 data points. An outlier among all regions combined, apps popular in Pakistan claimed to collect no user data—the only country in which this was the case.
In South America, we found that popular apps collect an average of 2.9 and share 0.1 data points. Apps popular with Chileans collect the most data in the region at 3.7 and share 0.2, followed by Peru, where apps collect 3.3 and share 0.1. The region contains two countries—Columbia and Ecuador—where popular apps share no data with third parties.
Lastly, apps popular in African countries collect the fewest data points from their users at 1.3 data points on average and share 0.1. In fact, 3 of the 4 countries we investigated in the region share no data. Apps popular in South Africa collect the most data points, 2.6 on average, but do not share any of it. They are followed by apps popular in Egypt, which collect 1.6 data points and share 0.4
Conclusion
While it may not be possible or even necessary to restrict access to all apps targeted at children, especially with the rise of online study since the beginning of COVID-19, it is essential for parents to choose the apps their children use carefully.
More than half of the apps we analyzed were found to collect data, with only around half of those following the best data-safety and privacy practices. Aside from exploitative advertising, this may also leave children facing dark patterns designed to keep them engaged and even more serious dangers, such as child identity theft in cases where data sharing may lead to dangerous leaks.
This vulnerability is why laws and regulations, such as the General Data Protection Regulation (GDPR), require internet-based services to obtain parental consent for any data processing that involves a child.
However, addressing this problem requires further collaborative efforts, not only from parents but also from regulators and tech companies alike. These efforts should be aimed at establishing and enforcing robust standards that prioritize children’s online safety and privacy, emphasizing parental education, industry self-regulation, and tailored legal frameworks in the digital landscape.
Methodology
We found apps popular in 59 countries using the rankings provided by Appmagic.rocks.2 For each country, we noted the top 10 most popular free apps in the Kids category, having selected 2023 as the timeframe. Taking into consideration the overlap of popular apps between countries, we narrowed down 74 of the most popular children’s apps overall. App names and their rankings were noted on November 27, 2023.
We then collected information from the data-safety sections of the Google Play Store pages of the identified apps. The information was aggregated on a country and regional level for analysis. Data collection from the Google Play Store took place on November 28, 2023.
Notes on data:
Despite having the option to look up apps popular in China (in Appmagic.rocks), Incogni’s researchers found that no data was available for it in the Kids category, and thus the country is excluded from the analysis. Furthermore, some of the collected links led to the Apple App Store—those apps were excluded from the analysis.
The data used in this research is available here: Public dataset.
Sources
- New York Department of State. “What You Should Know About Child Identity Theft.” Accessed December 8, 2023. https://dos.ny.gov/what-you-should-know-about-child-identity-theft#:~:text=Child%20identity%20theft%20occurs%20when,not%20verify%20age%20of%20applicants.
- Pew Research Center. “Americans and Privacy: Concerned, Confused, and Feeling Lack of Control Over Their Personal Information.” Last modified November 15, 2019. https://www.pewresearch.org/internet/2019/11/15/americans-and-privacy-concerned-confused-and-feeling-lack-of-control-over-their-personal-information.
- Google. “Google Play Families Policies.” Play Console Help. Accessed December 8, 2023. https://support.google.com/googleplay/android-developer/answer/9893335?hl=en.
- AppMagic. “Top Apps.” Accessed December 8, 2023. https://appmagic.rocks/top-charts/apps?store=1&tag=3&category=227&aggregation=year&date=2023-01-01.
Visuals
We welcome the reuse of our images as long as proper attribution is given to Incogni. The charts, graphs, and tables used in this research can be seamlessly embedded in your website. Use the menu at the top right of the visual when you hover over it with your mouse. When embedded, these visuals maintain their interactivity and preserve their original quality.
