Hundreds of the most popular children's smartphone and tablet apps are collecting or sharing personal information - including geolocation, phone numbers and device identification - with third parties, without notifying parents or asking for permission.
Many contain undisclosed advertising, links to social networking services and in-app purchasing. One parent told Fairfax Media his 12-year-old son was tricked into spending more than $40 for virtual coins by a "free" app, DragonVale, which he discovered only when the credit card statement arrived.
The Australian Privacy Commissioner, Timothy Pilgrim, said he was "very concerned" following the release of a US Federal Trade Commission study on children's apps this month, which reported that hundreds of the most popular educational and gaming mobile apps failed to provide parents with basic information about their data collection practices.
Illustration: Matt Golding.
The US report said the apps often transmit the precise location and unique serial code of a mobile device as well as the phone number and other personal details to app developers, marketers and advertising networks. This information could be then used to find, contact or track children across different apps or websites using "rich sets of data or 'profiles' of individuals" without their parents' knowledge or consent.
The report did not name apps but several apps, including SpongeBob Diner Dash and popular free kids game Mobbles, have since been temporarily pulled from app stores because of complaints. A spokesman for the Attorney-General, Nicola Roxon, said apps breaching the privacy of children would be "completely unacceptable" and she would ask the Privacy Commissioner to "consider using his enforcement and investigative powers to see if any action can be taken". "This is a timely reminder in the lead-up to Christmas that it's important for parents to monitor their children's use of technology," he said.
Of the 400 Apple App Store and Google Android apps reviewed by the US FTC, only one in five disclosed any information about their data collection practices.
But unlike in the US, where the Children's Online Privacy Protection Act requires website operators and app developers to get parents' permission before collecting and sharing names, addresses, phone numbers and other personal information obtained from children under 13, there are no such laws in Australia, Mr Pilgrim said. The US law was expanded last week to cover the latest technologies including geolocation data, "persistent identifiers", photos, video and apps.
New technology features such as voice and facial recognition are expected to make the data collection issues more problematic.
The Commonwealth Consumer Affairs Advisory Council is conducting an inquiry into apps, which the Assistant Treasurer, David Bradbury, said would look at issues such as whether "the marketing of these games could mislead consumers, including children, into making further purchases without knowing they will incur real costs".
The inquiry is open for submissions until January 31.
Marty Janes, the chief executive of Otium Interactions in Miranda, makes the Find the Kidz app that allows parents to track children on their smartphone.
He does not collect personal data with his app, but is concerned about the amount of information collected and shared in relation to children.
Because people did not want to pay even small amounts for apps, developers who provided apps for free needed to recoup costs through advertising and in-app purchases.
"A lot of apps these days require you to register your personal details before you may start using the services of the app," he said. "Obviously this data is most likely being captured in order to be able to target market the user."
MARSHALL is just two years old but already knows his way around an iPad. What’s more, it is his iPad.
‘‘I got it for him because I travel a lot. Any parent could appreciate how much easier that is,’’ his mother, Karla Courtney, said.
The Pyrmont digital publisher said her son used his iPad for apps, books, music and videos, and she found it a useful aid when teaching her son Spanish. He also had about 40 children’s games.
But she worried that, as he got older, she would have less control over the apps he used.
“This does concern me,” she said of the tracking done by children’s apps.
She added that she avoided free apps with advertisements because those were the most likely to transmit personal information to third parties and bombard kids with brand messages.
“I would rather pay for the app because, when you don’t pay, you know you’re the product,” Ms Courtney said.
Her favourite children’s apps were Duck Duck Moose and Timbuktu, a kid’s magazine.
“I have never looked at the data usage policies on the paid apps I use and would be keen to know what they are as I am sure many parents would.”
The Office of the Australian Information Commissioner was developing guidance for local app developers, which would encourage obtaining informed consent by providing users with simple and accessible privacy information.
The Australian Privacy Commissioner, Timothy Pilgrim, urged parents to read privacy statements about what information was collected and shared by an app, and make use of privacy settings.