Google, Facebook skim most data from apps for kids: study

Google and Facebook receive more than half of all data collected from children’s apps, a study by data privacy services company Arrka has found.

Google is the leading recipient, collecting 33% of the data collected from such apps, followed by Facebook at 22%, as per the study that covered 60 children’s Android applications across nine categories including games, edtech, school, coding, and childcare.

“On one hand, we have been seeing the increased focus on children’s privacy worldwide with several regulations kicking in over the last year. On the other, we have been seeing – with alarm – the kind of personal data of children being processed around us, without any guardrails per se,” said Shivangi Nadkarni, cofounder and CEO of Arrka.


The study also identified a large number of smaller data recipients such as AppsFlyer and AppLovin — each contributing around 2% of the overall trackers identified — that together received 38% of data.

Further, 85% of the surveyed apps had accessed at least one “dangerous permission”, or permission for collecting highly sensitive data, the misuse of which can cause harm to children.

For instance, 73% had access to stored files, 46% to microphone, 43% to camera, 38% to phone details, 27% to contacts, 23% to exact location.

Edtech, childcare and coding apps accessed the highest number of such dangerous permissions. About two-thirds of childcare and edtech apps access children’s exact location and 100% of edtech and coding apps have access to the camera.

As many as 80% of the children’s apps had analytics trackers embedded and 54% had advertising trackers. Gaming, edtech and coding apps had the highest number of trackers.

The number of Indian apps having age-gating mechanisms, such as identifying user’s date of birth and restricting access to certain features based on age, is significantly lower than that of global apps, the report found.

“This is an important aspect of DPDPA (Digital Personal Data Protection Act) compliance, given the requirements around children’s data. We observed that Indian apps have a long way to go in this aspect,” it said.

The Act, passed in August last year, has provisions to prevent the misuse of data in ways that could have a detrimental impact on children’s wellbeing.

Only 35% of Indian apps collect the user’s date of birth, compared to 60% and 55% of US and EU apps, respectively. About 13% restrict access to certain features based on age, compared to 63% and 80% of US and EU apps, respectively.

“The children’s apps in India also lag in other aspects of transparency like not having a dedicated section for parents in the privacy policy or not having a separate privacy policy for children,” the report said.

Only 38% of Indian children’s apps had a dedicated section for parents in their privacy policy, compared to 83% for similar apps from Europe and 67% for US apps. About 35% had a separate privacy policy for children, compared to over half of US and EU apps.

The study reported that a significantly lower number of Indian apps ask users to sign in using social media accounts compared to their global counterparts. Notably, while Indian apps access permissions like exact location and contact list significantly more than EU and US apps, their access related to microphones or cameras is comparable or lower than the latter.