Do mobile applications for children respect their privacy?

Why study mobile applications specifically for children?

Grazia Cecere: A report by the NGO Common Sense shows that 98% of children under the age of 8 in the USA use a mobile device. They spend an average of 48 minutes a day on them. This is a huge number, and the digital industry has understood this. They have developed a market specifically dedicated to children. Following on from my work on the economics of privacy, I asked myself how the notion of personal data protection applied to this market. Several years ago, together with international researchers, we launched a project specifically dedicated to these issues. The project was also initiated thanks to the funding of Vincent Lefrere's thesis as part of the Futur & Ruptures program financed by the Carnot Télécom & Société numérique and the Fondation Mines-Télécom.

Are children's personal data considered differently by platforms than that of adults?

GC: First of all, children have a special status in the RGPD (General Regulation on the Protection of Personal Data) in Europe. In the United States, there is a special legislative framework: COPPA. The FTC, which deals with issues relating to the privacy of users of digital services, is also very attentive to respect for children. In terms of platforms, Google Play and the App Store have Family and Children categories respectively, which bring together applications for children. Google and Apple's stated aim is to separate these apps from those intended for teenagers or adults, and to ensure better protection of privacy by apps in these categories. To place an application in one of these categories, the developer must certify compliance with a certain number of rules.

Is this really the case? Do applications in children's categories respect privacy more than others?

GC: We have carried out research to answer this question. We collected data from Google Play on over 10,000 mobile applications for children, both in the dedicated category and outside the category. Some apps actually decide not to certify and target children by keywords. We look to see if the app collects phone number, location, usage data, if it accesses other information on the phone... And then we compare apps against each other. The results show that, on average, apps in the children's category collect less personal data and respect users' privacy more than those aimed at the same audience but outside this category. We can therefore say that, on average, the categories specifically dedicated to children offered by platforms reduce data collection. On the other hand, our study also shows that a significant proportion of apps in these categories collect sensitive data.

Do all developers play the children's privacy game?

GC: Application markets require developers to provide information on their location. Using this geographical data, we investigated whether the country of origin of an application has an influence on its level of privacy. We showed that if the developer is based in a country with strong regulations on personal data - such as the EU, the USA or Canada - he will be more respectful on average than a developer based in a country with weak regulations. What's more, developers who choose to remain anonymous are, on average, those who collect the most sensitive data.

Is this a surprising result?

GC: In a way, yes, because we expected the application market to play a role in the level of respect for personal data. This result raises the question of the extraterritoriality of the RGPD, for example. Normally, whether an app is developed in France or India, if it is placed on the European market, it must comply with the RGPD. However, we show that for countries with weak regulation, the weight of legislation on the destination market is not enough to change developers' local practices. It's important to point out that it's extremely easy - and even encouraged by platforms - to offer an app to all countries. This reinforces the need for special attention.

What does this mean for children's privacy?

GC: Developers are the owners of the data. When personal data is collected by an application, it is then sent to the developer's servers, usually in the country where the application is located. The fact that foreign developers are less privacy-conscious means that the processing of this data will probably be less respectful of this principle too.