Most apps children have on smartphones or tablets have been downloaded for free. But then how do these companies survive? Well, even though you do not pay for them with money, that does not mean that you are not paying for these apps. In exchange for the apps, you offer data that can be economically explored and your attention to the advertisements within the app.

If this is the case, it is important that all these factors are well explained: what data the app collects and processes, for what purpose they are used, with whom they are shared, how they are protected against malicious third-parties, if there are and what kind of advertising is shown in the app. The basis for this demand is simple: in order to be clear about where we entering, the minimal expectation is transparency about what the apps are doing.

So this is the topic we will examine in the third post of the series Children’s Apps SPECIAL.

Our Findings

1. All apps inform, to some extent, which data is collected and what they do with it, but the format and the quality of the information are quite varied.

In this topic, the privacy policies that negatively got our attention were the ones of the Brazilian developer ZeroUm, responsible for the super popular apps Galinha Pintadinha: Músicas e Jogos para Crianças, Patati Patatá and Os Pequerruchos, which only says that the apps collect “your information”, without giving more clues about what this means; and the one of the Once upon a tower app, that does not inform the purpose of the data collection and limits itself to saying that it does not process sensitive data, thus it does not even discuss what it does to other data.

Among the others, the majority of the consulted apps specify to some extent the data they collect [1]. Some separate between “personal data”, “sensitive data”, “nonpersonal data”, “aggregated data”, all terms of the art that have any juridical implication. Other companies opt to directly inform which data is this: the ones people inform, the ones that are automatically generated while using the app, the ones which are obtained from the device (such as unique identification and geolocation), etc.

Along with this information, we have clarifications about what is made with the data: eleven [2] of them catalogue in detail the several uses that involve the collected data, such as developing new services, showing advertising, protecting the developer and the users, investigate and prevent potentially illegal activities or that violate the terms of use, solve problems related to the use of the app, and send responses to the users’ demands.

2. Few apps address issues about the data security in detail

Cases of cybernetic attacks, theft, and leaking of data have become more and more frequent: WannaCry, Equifax and Petya are only some of the examples. These attacks stirred the debate about the security policies adopted by companies that hold our data. What measures do they use to prevent that our data, and of our children, do not fall into the wrong hands?

Six apps (Snack vs. Block, PlayKids: Aprender Brincando, Pou, Slither.io, Meu Talking Tom, Jogos Boutique Princesa Tailor) simply do not deal with security measures in their privacy policies. Of the other apps, only 3 (Football Strike, O Show da Luna! Jogos e Vídeos and Toca Kitchen Monsters) described the measures they adopt. Furthermore, 7 apps (Super Mario Run, Perguntados, Toca Kitchen Monsters, Duolingo, O Show da Luna! Jogos e Vídeos, Sweet Baby Girl Doll House – Play, Care & Bed Time and Creche Sweet Baby Girl 4) admit that, despite adopting security measures, no security structure is “impenetrable”.

3. Most apps get silent about the possibility of deleting data

Out of the 20 selected apps, 9 do not deal with the deleting of user data (Snack vs. Block, Once upon a tower, Galinha Pintadinha: Músicas e Jogos para crianças, Patati Patatá, Os Pequerruchos, Pou, 8 Ball Pool, O Show da Luna! Jogos e Vídeos, and Jogos Boutique Princesa Tailor). According to the Brazilian Internet Civil Rights Framework, the definitive deletion of personal data is an assured right upon the end of the relation between the user and the internet application (art. 7, X). [3].

4. The exploitation of usage data, use of cookies, and data sharing are industry standards, even for children’s apps.

Out of the 20 analyzed apps, 16 affirm to collect usage data [4]. This is information about the way in which the user utilizes the app, such as their usage habits, preferences, and which functionalities are or not used. This information reveals their behavioral patterns, interests, and demands within the app’s functionality.

Most of the times, this information is shared with third-parties. Indeed, most apps we consulted admits to sharing information with advertisers, aggregate data analyzing companies or companies “of the same family”. The only exception is Jogos Boutique Princesa Tailor, that affirms it does not share user data with no one. The privacy policy of the Brazilian developer ZeroUm (dos apps Galinha Pintadinha: Músicas e Jogos para crianças, Patati Patatá e Os Pequerruchos) simply gets silent about this issue: it does not say anything about which data, with whom, and for what they are shared. It is worth reminding that this is an important aspect to consider so that users are informed about the possibility of these companies combining data and, together, enable the construction of detailed digital profiles of the users.

Another tool used for the collection of this type of data are cookies, text files which have as their main function the storing of user preferences. 13 analyzed apps (Super Mario Run, Perguntados, Football Strike, PlayKids: Aprender Brincando, Toca Kitchen Monsters, Pou, Meu Talking Tom, 8 Ball Pool, Duolingo, O Show da Luna! Jogos e Vídeos, Sweet Baby Girl Doll House – Play, Care & Bed Time, Creche Sweet Baby Girl 4 and Jogos Boutique Princesa Tailor) expressly admit to the use of cookies. The privacy policy of the Brazilian developer ZeroUm, who is behind the apps Galinha Pintadinha: Músicas e Jogos para crianças, Patati Patatá does not address this subject.

The usage data and information stored in the cookies say a lot about the behavior and the interests of the users. This data can be useful, for instance, for personalizing services and functionalities offered by an app. They are also valuable for directed advertising. When keeping a behavior log through the user’s visited pages, geolocation log, and terms researched on research mechanisms, the advertisers know more about the users’ profile and can customize ads for them, directing their products to potential costumers.

Check out below the privacy policies of all the apps that were part of this research clicking on the respective links:

[1] Super Mario Run, Perguntados, Football Strike, Playkids: Aprender Brincando, Toca Kitchen Monsters, Subway Surfers, Pou, slither.io, Meu Talking Tom, 8 Ball Pool, Duolingo, O Show da Luna! Jogos e Vídeos e Jogos Boutique Princesa Tailor, Once upon a tower, Sweet Baby Girl Doll House – Play, Care & Bed Time e Creche Sweet Baby Girl 4, Snake vs. Block.

[2] Snack vs. Block, Super Mario Run, Perguntados, Football Strike, PlayKids: Aprender Brincando, 6Pou, slither.io, 8 Ball Pool, O Show da Luna! Jogos e Vídeos, Sweet Baby Girl Doll House – Play, Care & Bed Time, Creche Sweet Baby Girl 4.

[3] “Art. 7. The access to the internet is essential to the exercise of citizenship, and the following rights are assured to the user: (…) X – the definitive deletion of personal data that they provided to a determined internet application, upon their request, facing the end of the relation between the parties, with the exception of the hypotheses of mandatory storage of logs provisioned in this Law; (…)”.

[4] Snack vs. Block, Super Mario Run, Football Strike, PlayKids: Aprender Brincando, Toca Kitchen Monsters, Subway Surfers, Pou, Meu Talking Tom, 8 Ball Pool, Duolingo, Galinha Pintadinha: Músicas e Jogos para crianças, Patati Patatá, Os Pequerruchos, Jogos Boutique Princesa Tailor, Sweet Baby Girl Doll House – Play, Care & Bed Time e Creche Sweet Baby Girl 4. Galinha Pintadinha: Músicas e Jogos para crianças, Patati Patatá and Os Pequerruchos do not expressly do it, but talk about identifying which of their products can interest the user.

[5] Infographic inspired by the FTC Report. Mobile Apps for Kids: Disclosures Still Not Making The Grade. December 2012, p. 14.

Team responsible for the project: Francisco Brito Cruz (francisco@internetlab.org.br), Jacqueline de Souza Abreu (jacqueline@internetlab.org.br) and Maria Luciano (maria.luciano@internetlab.org.br). With the collaboration of Dennys Antonialli and Pedro Lima.

Translation: Ana Luiza Araujo