Just because a children’s app looks innocuous doesn’t mean it’s not doing some shady stuff in the background. Google has reportedly taken action against three children’s apps in the Play Store — Princess Salon, Number Colouring and Cats & Cosplay — for allegedly violating its data collection policies, according to a report in TechCrunch.
Per the report, Google took action on the apps after researchers at the International Digital Accountability Council, a nonprofit privacy watchdog, informed it of the violations. None of the links to the apps in the Play Store currently work, which seems to support the theory that they went bye-bye for a reason. In a statement on its website, the IDAC stated that one of the problems was related to the software development kits used within the three apps: Unity, Appodeal and Umeng.
[referenced id=”1522399″ url=”https://gizmodo.com.au/2020/10/google-stadia-exec-has-a-licence-to-stupid-and-hes-not-afraid-to-use-it/” thumb=”https://gizmodo.com.au/wp-content/uploads/2020/10/23/lvhkybgiln97ul4nppqy-300×168.jpg” title=”Google Stadia Exec Says Streamers Should Be Paying Developers For Game Rights” excerpt=”Here it is, folks, the worst take on video game livestreaming that the internet has to offer.”]
The organisation affirmed that its tests had discovered that certain versions of the three SDKs used in the apps “were not in compliance with broader Google Play policies around data collection.” Although the IDAC did not list all the alleged violations in detail, it did highlight one specific problem related to certain versions of the Unity SDK.
“IDAC’s tests highlighted that certain versions of Unity’s SDK were collecting both the user’s AAID and Android ID simultaneously, which may have allowed Unity to bypass privacy controls and track users over time and across devices,” the organisation stated.
IDAC goes on to explain that this is significant because when the AAID — which is a unique, resettable ID for advertising that basically allows ad networks to create a personalised data profile of your likes and dislikes, among other things — is linked with the Android ID, it creates a “bridge” that allows companies to track users.
Android ID is another unique identifier that, unlike the AAID, cannot be reset. The privacy organisation concludes that “ID bridging” ultimately makes users’ ability to reset their AAID useless. As explained by Wired, users can choose to reset their AAID to stop the profiles ad networks have collected on them from growing even more or force the networks to create a new profile on them altogether.
According to TechCrunch, the Princess Salon, Number Colouring and Cats & Cosplay apps had more than 20 million downloads between them.
[referenced id=”1521371″ url=”https://gizmodo.com.au/2020/10/nest-secure-is-the-latest-google-device-to-be-chopped/” thumb=”https://gizmodo.com.au/wp-content/uploads/2020/10/20/kiujmpghcfipml9obwqy-300×169.jpg” title=”Nest Secure Is the Latest Google Device to Be Chopped” excerpt=”Google seems to be on a big hack-and-slash spree this year, culling products — even beloved ones — in an attempt to streamline its offerings. The tech giant is known for abandoning or restructuring certain devices, services, and apps that didn’t take off the way it hoped, but 2020 seems…”]
Gizmodo has reached out to Google to ask about the IDAC report and confirm whether it took action on these apps because of it. We’ll update this blog if we hear back.
If these apps were indeed collecting data that allowed them to track children across devices, that’s pretty upsetting. While I don’t have children, if I did, I would be pretty cranky if their games were collecting and building profiles on them. Besides being appalling, it’s also a potential violation of the Children’s Online Privacy Protection Act, a federal law that bans operators of websites and online services, including apps and social media networks, from collecting the personal information of children under 13 years old without parental consent.
[TechCrunch and IDAC]