In recent years, the digital giants, particularly the GAFAs, have been regularly criticized for their failure to protect users' privacy. Highlight: the record $5 billion fine In 2019, the Federal Trade Commission (FTC), the US consumer protection agency, will impose a fine on Facebook.

Among the personal data collected online, some are subject to particular vigilance, such as that concerning children. In the United States, the Children's Online Privacy Protection Act (COPPA), which came into force in 2000, aims to protect the privacy of individuals under the age of 13. In particular, it defines what data is considered "sensitive" for children, such as data that can be used to identify a minor user on different devices, or to geolocate him or her. And failure to comply with the law can result in heavy penalties: in 2019, FTC fines TikTok $5.7 million Another industry heavyweight.

These examples in the media may give the impression that large companies are less respectful of user privacy than others. But is this impression justified? This is one of the questions answered by a team of five researchers, including IMT-BS researcher Vincent Lefrere, in a study entitled " Privacy, data and competition: the case of apps for young children ". The researchers included a professor from MIT, a collaboration made possible thanks to support from Carnot TSN. Their aim was to understand the factors that can influence the collection of personal data from a fragile population. Are there differences in behavior depending on the size of the development company? The developer's country of origin? Can platforms like Google's and Apple's encourage, or, on the contrary, hinder, regulation around privacy?

Over 1.5 million observations

To answer these questions, the authors of the study analyzed 27,785 children's applications, created by 11,343 developers from 127 countries. " Every two weeks, we studied the data they collected, so as to monitor changes in their behavior," adds Vincent Lefrere. Over a period of three years, the team collected more than 1.5 million observations, enabling them to draw up a relevant market overview.

Some of the applications studied have already been examined by download platforms. So, if you'd like to join the For the family" program For example, a Google developer must commit to complying with current legislation on children's privacy (COPPA or RGPD, for example). But the researchers also analyzed other applications defining themselves as "for kids", without belonging to a Google or Apple program dedicated to the family.

Big companies among the top performers

The study's first conclusion is that, contrary to certain preconceived ideas, large developers collect less personal data than small ones. " What may explain this finding is the cost associated with complying with regulations," explains the ITM-BS researcher. " A small developer wishing to comply with the rules must first learn about the laws in force in each country, then put in place measures to respect these constraints, secure the data... A task that is expensive and, in fact, more accessible to large structures than to small ones. " The full study and detailed results are available at available online (publication in English).

Researchers also believe that the programs set up by Google and Apple are proving effective. In fact, applications that are part of these programs collect, on average, less data than those that are not. " This means, for example, that parents can trust this category more when it comes to respecting their children's privacy ", deduces Vincent Lefrere.

And what about geographical differences? According to the study, developers from countries with strong privacy regulations (for example, Europe or the USA) generally collect less data. " That said, the two previous effects work regardless of the country, and even more so for those with less stringent legislation," explains the researcher. " Because, in this case, the effort required to comply with the requirements of other states, or of Google and Apple, is very high, and therefore not very accessible to small developers. On the contrary, for a European developer, it's less difficult to adapt to American regulations. "

However, all developers, whatever their country of origin, are expected to comply with the laws of all the territories in which their applications can be downloaded. In short, it's a modern-day application of the adage "No one is supposed to ignore the law". " Nevertheless, in reality, there is little control, except perhaps with the big players ", Vincent Lefrere points out. " Platforms do analyze applications, but more for security or quality reasons. When it comes to data, it's more up to the user to be vigilant. "

Protecting privacy: everyone's business

However, respect for privacy, particularly that of children, remains in everyone's interest, be they individuals, companies or public authorities. So how can we help developers of all sizes to comply with the rules? " First of all , we need to make smaller market players aware of these issues and support them, via tools and financial aid," recommends the ITM-BS researcher. " Because non-compliance with the laws is generally explained by the cost associated with compliance, rather than by unwillingness. "

The study's co-author also calls on all stakeholders to do their bit: " Google and Apple platforms could increase their surveillance. Public authorities, for their part, would also benefit from clearer laws, tighter controls, and even more tools of their own. Finally, users would do well to become more aware of how their data is used, so that they can take an informed look at a subject that concerns them directly. "

Encouraging results, but vigilance required

However, there's no question of the researcher becoming a doomsayer. " While the subject of children's personal data must be taken with the utmost seriousness, our approach is not intended to be alarmist. Indeed, on the whole, the study proves that, in the face of strong regulation, applications tend to respect children's privacy. " For the authors of the study, the idea is to maintain high standards for personal data, and to ensure that legislation evolves with technology.

"If we had to sound an alarm, it would be about the risk of unfair competition," warns Vincent Lefrere. " In a globalized market, we have to make sure that developers who don't care about privacy issues don't get the upper hand over those who do. For the good of the latter, but also of users.