2+2
February 2012 | Federal Trade Commission
Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

This report is available on the internet at http://www.ftc.gov/os/2012/02/120216mobile_apps_kids.pdf.

The online version of this report contains live hyperlinks.
Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Contents

FTC Staff Report......................................................................................................... 1

Overview ............................................................................................................. 1

Recommendations ............................................................................................... 3

Methodology........................................................................................................ 4

 I. Range of Apps Offered.............................................................................. 5

 II. Data Collection and Sharing Practices....................................................... 10

Conclusion ........................................................................................................... 17

Endnotes.............................................................................................................. 18

Appendix .................................................................................................................. A1
1

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

FTC Staff Report

Overview1

The market for mobile applications has experienced explosive growth over the past 

three and a half years. When Apple’s iTunes App Store and Google’s Android Market first 

launched in 2008, smartphone users could choose from about 600 apps.2 Today, there are more 

than 500,000 apps in the Apple App store3 and 380,000 apps in the Android Market,4 which 

consumers can access from a variety of mobile devices, including smartphones and tablets. 

Consumers have downloaded these apps more than 28 billion times,5 and young children and 

teens are increasingly embracing smartphone technology for entertainment and educational 

purposes.6 As consumers increasingly rely on their mobile devices for multiple activities, the 

quantity and diversity of mobile apps continue to expand.

This rapidly growing market provides enormous opportunities and benefits for app 

users of all ages, but raises questions about users’ privacy, especially when the users are 

children and teens. Mobile apps can capture a broad range of user information from the device 

automatically – including the user’s precise geolocation, phone number, list of contacts, call 

logs, unique device identifiers, and other information stored on the mobile device – and can 

share this data with a large number of possible recipients. These capabilities can provide 

beneficial services to consumers – for example, access to maps and directions, and the ability 

to play interactive games with other users – but they also can be used by apps to collect 

detailed personal information in a manner parents cannot detect.

Protecting children’s privacy is one of the Commission’s top priorities. In order to better 

understand and evaluate the emerging app market and the products and services it offers 

to children, Federal Trade Commission staff designed and conducted a survey of the apps 

offered for children in the two largest U.S. app stores, the Android Market and the Apple App 

store. Staff focused in particular on the types of apps offered to children; the age range of the 

intended audience; the disclosures provided to users about the apps’ data collection and sharing 

practices; the availability of interactive features, such as connecting with social media; and the 

app store ratings and parental controls offered for these systems. This report highlights the lack 

of information available to parents prior to downloading mobile apps for their children, and 

calls on industry to provide greater transparency about their data practices.7
2

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Staff searched the app stores using the word “kids,” and examined hundreds of pages 

promoting apps, which ranged from alphabet and word games, math and number games, and 

memory games to books and stories, flash cards, and puzzles. Most of the apps’ descriptions 

specifically indicated that the apps were intended for use by children, and some promoted 

use by children of certain ages, stating, for example, “teach young children, ages 2 to 5.” 

Prices ranged from free to $9.99, but most apps were $0.99 or less, and free apps were 

overwhelmingly the most frequently downloaded.

While staff encountered a diverse pool of apps for kids created by hundreds of different 

developers, staff found little, if any, information in the app marketplaces about the data 

collection and sharing practices of these apps. Staff found almost no relevant language 

regarding app data collection or sharing on the Apple app promotion pages,8 and minimal 

information (beyond the general “permission” statements required on the Android operating 

system9) on just three of the Android promotion pages. In most instances, staff was unable to 

determine from the promotion pages whether the apps collected any data at all, let alone the 

type of data collected, the purpose of the collection, and who collected or obtained access to 

the data.

As part of its mission to protect children, the Commission vigorously enforces the 

Children’s Online Privacy Protection Act (“COPPA”) and the FTC’s implementing Rule, 

which require operators of online services (including interactive mobile apps) directed to 

children under age 13 to provide notice and obtain parental consent before collecting items 

of “personal information” from children.10 Since collecting the data for this survey, the FTC 

settled its first COPPA enforcement action against a mobile app developer11 and issued a 

Notice of Proposed Rulemaking to amend the Commission’s COPPA Rule.12 Those initiatives, 

along with this report, are a warning call to industry that it must do more to provide parents 

with easily accessible, basic information about the mobile apps that their children use.

Most of the apps in the study appear to be intended for children’s use, and many may, 

in fact, be “directed to children” within the meaning of COPPA.13 This survey focused on the 

disclosures provided to users regarding their data practices; it did not test whether the selected 

apps actually collected, used, or disclosed personal information from children. Over the next 

six months, staff will conduct an additional review to determine whether there are COPPA 

violations and whether enforcement is appropriate.14 Staff also will evaluate whether the 

industry is moving forward to address the disclosure issues raised in this report.
3

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Recommendations

FTC staff believes that all members of the kids app ecosystem – the app stores, 

developers, and third parties providing services within the apps – should play an active role 

in providing key information to parents who download apps. The mobile app marketplace 

is growing at a tremendous speed, and many consumer protections, including privacy and 

privacy disclosures, have not kept pace with this development. Parents need easy access to 

basic information so they can make informed decisions about the apps they allow their children 

to use.15

App developers should provide this information through simple and short disclosures 

or icons that are easy to find and understand on the small screen of a mobile device. Parents 

should be able to learn what information an app collects, how the information will be used, and 

with whom the information will be shared.16 App developers also should alert parents if the app 

connects with any social media, or allows targeted advertising to occur through the app. Third 

parties that collect user information through apps also should disclose their privacy practices, 

whether through a link on the app promotion page, the developers’ disclosures, or another 

easily accessible method.

The app stores also should do more to help parents and kids. The two major app stores 

provide the basic architecture for communicating information about the kids apps they offer, 

such as pricing and category information. However, the app stores should provide a more 

consistent way for developers to display information regarding their app’s data collection 

practices and interactive features. For example, app stores could provide a designated space 

for developers to disclose this information. The app stores also could provide standardized 

icons to signal features, such as a connection with social media services. Although the app 

store developer agreements require developers to disclose the information their apps collect, 

the app stores do not appear to enforce these requirements.17 This lack of enforcement provides 

little incentive to app developers to provide such disclosures and leaves parents without the 

information they need. As gatekeepers of the app marketplace, the app stores should do more. 

This recommendation applies not just to Apple and Google, but also to other companies that 

provide a marketplace for kids mobile apps.

Additional work is needed to identify the best means and place for conveying data 

practices in plain language and in easily accessible ways on the small screens of mobile 

devices. Staff encourages industry members, privacy groups, academics, and others to develop 

and test new ways to provide information to parents – for example, by standardizing language, 
4

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

creating icons, or using a layered approach. To this end, the Commission currently is engaged 

in a project to update its existing business guidance, “Dot Com Disclosures,” about online 

advertising disclosures.18 As part of this project, the agency will host a public workshop 

in 2012 to gain input from interested parties, including industry representatives, consumer 

groups, and consumer disclosure experts. One of the topics that will be addressed is mobile 

privacy disclosures, including how they can be short, effective, and accessible to consumers on 

small screens. Staff anticipates that the workshop discussion will spur further development in 

this area.

Methodology

In July 2011, FTC staff searched on the desktop version of Apple’s App Store and the 

browser-based version of the Android Market for the term “kids.”19 The search yielded over 

8,000 results in the Apple App Store and over 3,600 in the Android Market. Staff collected the 

app promotion pages for the first 480 results returned by each app store,20 for a total of 960 

apps. Both app stores provide a promotion page for each app offered, which typically lists the 

name of the app developer directly under the app title and includes a textual description of the 

app. The app promotion page also displays information such as the app’s price, publication 

date, app store category, content maturity rating, user feedback ratings, number of user 

feedback ratings, screenshot previews, developer contact information, and, in many instances, 

a link to a developer website.21

Staff then conducted a closer review of the promotion pages for 200 Android apps and 

200 Apple apps chosen randomly from each pool of the 480 “kids” results. Staff examined the 

information listed on the app store promotion page and the first page (“landing” page) of the 

associated developer’s website. On the app store promotion page, staff looked for language 

and terms in the app description in order to sort the apps by type and intended audience. Staff 

also looked to see if the app linked to any social media, allowed users to make purchases (“inapp” purchases), included advertising, displayed developer contact information, and provided 

information about the app’s data collection practices. On the landing page of the developer 

website, staff looked for additional information about the app, as well as contact and data 

collection information for the developer.22

Staff notes two additional points with respect to the methodology. First, staff did not 

download any of the apps surveyed, and did not test the apps’ information collection, use, 

or disclosure practices. Rather, staff reviewed the information that a consumer easily could 

access either from the app store or from the developer’s website prior to downloading the app. 
5

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Information provided to parents after downloading an app is, in staff’s view, less useful in the 

parent’s decision-making since, by then, the child may already be using the app and the parent 

already could have been charged a fee.23

Second, staff reviewed only the app store pages made available to desktop computer 

visitors, which allowed staff to electronically collect and preserve the app promotion pages 

at a specific moment in time. Staff recognizes that there are a few differences between the 

content offered through the desktop interface and the content offered through the mobile device 

interface, but does not believe these differences are material or change the conclusions of this 

report.24

I. Range of Apps Offered

Staff found a wide range of kids apps offered at low prices by hundreds of developers.

Types of Apps for Kids

To get a sense of the types of apps available for kids, staff categorized each of the 

400 apps based on language contained in the app name or description.25 For example, a 

multiplication flash card app would fall into the “educational,” “math,” and “flash cards” 

categories. Staff found that education, games, math, spelling, and animals were the most 

popular app categories. The percentage of apps found by subject category is listed in Table 1.

Table 1: Categories of “Kids” Apps

Apple App Store Android Market

Category % of Apps % of Apps

Educational 51.0% 50.0%

Game 49.5% 41.0%

Animal-related 22.0% 23.0%

Alphabet/Spelling/Words 20.5% 17.0%

Math/Numbers 20.0% 16.5%

Matching 16.0% 9.5%

Memory 14.0% 15.5%

Book/Story 12.5% 6.5%

Coloring 9.0% 17.0%

Musical 7.0% 6.0%

Puzzle 6.5% 8.0%

Learning a language 6.5% 11.0%

Flash Cards 3.5% 3.5%

Photo-related 2.5% 4.0%

Quiz/Test 1.5% 3.5%

Jokes 1.0% 1.0%

Other26 8.5% 14.5%

n=200 n=200
6

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Intended Audience

Staff also reviewed the app descriptions for cues to the intended audience, looking for 

both general and specific age groups. Almost all of the apps reviewed appeared to be intended 

for use by kids, and many provided specific age ranges. Staff looked for words in app names 

or descriptions suggesting that the apps were recommended for, or were appropriate for, 

certain general groups, such as “infants,” “toddlers,” “preschoolers,” “children,” “kids,” 

“parents” and “teachers.”27 Table 2 lists the percentage of apps on each platform promoted for 

use by certain age groups.

Table 2: Intended Audience – General Age Groups

Apple App Store Android Market Combined

General Age Group % of Apps % of Apps % of Apps

Infant/Toddler 11.5% 4.0%

89.75%

Child 56.0% 40.5%

Kid 63.5% 76.5%

Preschool 7.5% 10.5%

Elementary School 1.5% 1.5%

Parent 17.5% 20.0%

Teacher 3.5% 2.5% 24.25%

Adult 7.5% 2.5%

Family 6.0% 4.5% 5.25%

Everyone 5.0% 1.0% 3.00%

No Indication 8.0% 2.0% 5.00%

n=200 n=200 n=400

Most of the app promotion pages suggested that the apps were for kids (or some subset 

of kids, such as infants) as shown in Table 2. Twenty-four percent of the 400 app descriptions 

contained language suggesting that the apps were intended for use by an adult, such as a parent 

or teacher, but most of those apps indicated they were for use by kids too. While 5% (twenty) 

of the 400 app descriptions did not include language suggesting any intended audience, all 

but two of these apps appeared to include content that kids may enjoy, such as games like 

checkers, table tennis, and basketball. Overall, staff estimates that about 95% of the 400 apps 

reviewed in detail were apps intended for kids’ use.28

Twenty three percent of the 400 apps specified a particular age range or school grade 

level. For these apps, staff recorded the recommended age ranges, converting any grade levels 

to ages.29 Over 50% of the apps that listed an age or grade range listed a range beginning at 2 

years old or younger; over 80% listed a range beginning at age four or younger; and over 90% 
7

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

specified an age range starting at 6 years old or younger.30 Conversely, over 75% of the apps 

that specified an age range specified one ending at 12 years old or younger, and roughly 45% 

specified an age range ending at 6 years old or younger. Table 3 lists the number of apps for 

specified age ranges.

Table 3: Intended Audience – Specific Age Ranges

Maximum recommended age % of apps with 

this min. age 3-4 5-6 7-8 9-12 13+

Minimum 

recommended age

0-2 9 27 6 2 11 60%

3-4 1 8 5 9 25%

5-6 4 1 1 1 8%

7-8 3 2 5%

13 1 1%

% of apps with this max. age 10% 35% 20% 11% 24% n=91

Most Kids Apps Are Inexpensive

While prices ranged from free to $9.99, most of the 960 app store promotion pages listed 

a price of $0.99 or less. Indeed, 77% of the apps in the survey listed an install price of $0.99 

or less, and 48% were free.31 Free apps appeared to be the most frequently downloaded.

The Android Market provides a “download range” and a “feedback” field on the 

promotion page of each app. The “download range” is an estimate of the number of times a 

particular app has been downloaded (such as “100 – 500” or “10,000 – 50,000”) while the 

“feedback” field reveals the number of app users that have provided comments or feedback 

regarding their experience with the app. Staff used the download ranges to estimate the 

relative popularity of apps in each price category.32 Using this indicator, staff found that the 

free Android apps accounted for 99% of all downloads in the Android survey results, even 

though they accounted for only 62% of the apps returned by the “kids” search. Staff then 

compared these findings to the results obtained by using the “feedback” information to infer 

app popularity. As shown in Table 4, the “feedback” method closely tracked the “download” 

method.
8

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Table 4: Android Market Price and Popularity

Price % of Apps % of Downloads33 % of Feedback Ratings

Free 61.7% 99.43% 97.64%

$0.01 to $0.99 14.0% 0.13% 0.19%

$1 to $1.99 9.2% 0.09% 0.27%

$2 to $2.99 2.9% 0.23% 1.43%

$3 to $3.99 1.6% 0.09% 0.37%

$4.00+ 1.6% 0.01% 0.03%

Foreign 9.0% 0.02% 0.07%

n=480

Apple’s App Store does not provide download ranges for its apps, but it does display 

the number of users that have provided feedback for each app. As with Android, staff used 

the number of feedback ratings to infer the relative popularity of the Apple apps. Staff found 

that free Apple apps appeared to be more popular than paid apps, accounting for 68% of all 

“ratings,” even though they only accounted for 35% of the search results (see Table 5).

Table 5: Apple App Store Prices and Popularity

Price % of Apps % of 

Ratings

Free 34.80% 68.29%

$0.99 43.95% 22.08%

$1.99 14.58% 9.15%

$2.99 3.75% 0.19%

$3.99 1.04% 0.10%

$4.99 1.88% 0.19%

n=480

Number of Developers

Staff found that hundreds of developers were responsible for the apps in the study. Staff 

encountered 441 unique developers in this study, only twelve of which had apps on both 

platforms. Table 6 presents the number of developers responsible for the apps in the search 

results.
9

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Table 6: Number of Apps Per Developer and Popularity Indicators

Apple App Store Android Market

# of 

Apps Per 

Developer

# of 

Developers

% All 

Apps

% 

Feedback 

Ratings

# of 

Developers

% All 

Apps

% of 

Downloads

1 142 29.6% 49.8% 150 31.3% 50.2%

2 43 17.9% 18.8% 48 20.0% 9.7%

3 11 6.9% 6.0% 11 6.9% 2.2%

4 5 4.2% 4.4% 6 5.0% 9.1%

5-9 13 17.7% 19.8% 14 16.9% 7.3%

10+ 5 23.8% 1.1% 5 20.0% 21.4%

n=480 n=480

Only a handful of app developers were responsible for more than 10 apps in our 

sample. Developers with one app in our sample were popular, accounting for about 50% of 

all downloads/feedback ratings, even though they were responsible for only about 30% of 

the apps. In contrast, those developers with more than 10 apps in our sample accounted for 

about 1% of the feedback ratings for Apple, (and 20% of the downloads for Android) despite 

accounting for about 20% of all of the apps in the survey. This finding illustrates the broad and 

diverse nature of the mobile app marketplace.

Contact Information

Many of the developers provided some type of contact information directly on their 

app’s promotion page, or linked to a developer website that contained contact information. 

Staff found that 13% of the 400 kids apps listed an email address somewhere on the promotion 

page.34 Eighty-one percent of the 400 app promotion pages linked to a functioning Englishlanguage developer website, a number of which provided contact information.35 Sixty-five 

percent (of the 400) linked to a functioning developer website whose landing page contained 

either some form of contact information or a link to contact information.36 Within this group, 

23% (of the 400) linked to a developer website that listed an email address on the landing 

page, 8% linked to a landing page providing a phone number, 6% linked to a landing page 

with a mailing address, 2% provided all three types of contact information on the landing 

page, and 38% linked to a landing page containing a link that appeared to lead to contact 

information.37
10

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

II.Data Collection and Sharing Practices

The survey findings regarding data collection and sharing were of greatest concern to 

FTC staff. Indeed, across the wide range of “kids” apps examined in the survey, staff found 

very little information about the data collection or sharing practices of these apps. Apple’s and 

Google’s mobile operating systems and app stores provide limited notice to users regarding app 

capabilities, and leave the bulk of disclosure to individual app developers. In most instances, 

staff was unable to determine from the information on the app store page or the developer’s 

landing page whether an app collected any data, let alone the type of data collected, the 

purpose for such collection, and who collected or obtained access to such data.38 This is 

troubling given the ability of mobile apps to access users’ information on devices automatically 

and to transmit this information invisibly to a wide variety of entities.

The Mobile App Stores and Operating Systems

Apple’s iOS and Google’s Android operating systems offer powerful capabilities to the 

mobile applications that run on them.39 For example, they enable mobile apps to determine the 

user’s precise geolocation and communicate with other devices via the Internet. For mobile 

gaming apps, these systems may allow a child to identify and connect with others playing 

the same game nearby. The operating systems also may provide apps with access to sensitive 

information such as a user’s call logs, contacts, and unique device identifiers, or enable the app 

to use the phone service on the mobile device to make or answer calls or send text messages. 

Depending on the type of service the app provides and how the app has been configured, 

this broad access to data may or may not be necessary to provide the service and may occur 

without the user’s knowledge.

 The app stores and operating systems take different approaches to managing the 

information and capabilities that apps may access. Android requires its apps to declare 

any potentially sensitive capabilities on a “permissions” screen, which displays just before 

installing the app.40 While helpful, these disclosures do not explain clearly (or provide an easy 

means for consumers to learn) why an app has the permissions it does, what the app does 

with such access, or whether the app shares any information with third parties. Providing 

clear and accessible information is especially important in the kids app space, where any data 

accessed and collected would likely be from a mobile device used by a child, and could reveal 

information that a parent may not want shared with unknown third parties, such as a child’s 

precise geolocation or phone number. Faced with concerns about what data an app may or 

may not collect, a parent may be forced to choose between downloading the app, and running 
11

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

the risk that the child’s sensitive information will be shared with unknown third parties, or not 

downloading the app, and depriving the child of an enjoyable game or activity.

Of the 182 Android apps indicating they were intended for use by kids, only 24% 

specified that the app required “no special permissions to run” – i.e., that a child could use 

the app without the app accessing any information or capabilities from the mobile device. 

Conversely, 76% indicated that the app required at least one “permission” to run. In fact, 

staff found that over half of the Android app promotion pages listed a “permission” for “full 

Internet access,” meaning that the “permission” enables the app to access and receive a wide 

variety of content while the app is running.41 Table 7 lists the percentage of Android apps that 

contained some of the more potentially sensitive permissions.42

Table 7: Android Market “Kids” Apps Permissions

Permission

% of 

Apps

% of 

Free Apps

% of 

Paid Apps

Network communication: full Internet access 60.99% 78.81% 28.13%

Phone calls: read phone state and identity43 20.88% 29.66% 4.69%

Modify/delete SD card44 15.93% 16.95% 14.06%

Your location - 8.24% 11.02% 3.13%

Fine (GPS) location

Coarse (network-based) location

Both fine and coarse location

6.04%

5.49%

3.30%

7.63%

7.63%

4.24%

3.13%

1.56%

1.56%

Hardware controls: take pictures and videos 3.85% 4.24% 3.13%

Services that cost you money: directly call phone numbers 2.20% 3.39% 0.00%

Modify global system settings 2.75% 3.39% 1.56%

Hardware controls: record audio 1.65% 2.54% 0.00%

Your personal information: read sensitive log data 0.55% 0.85% 0.00%

No special permissions 24.18% 13.56% 43.75%

n=182 n=118 n=64

In contrast to Android’s “permissions” approach, Apple states that it relies on an app 

review process in which it screens and approves apps before permitting them to be offered 

in Apple’s app store.45 Because Apple’s App Store does not require its apps to display 

“permissions” to users prior to download, staff could not measure the degree to which the 

Apple kids apps were capable of accessing device information.46 Apple states that it reviews 

every application “in order to protect consumer privacy” and “safeguard children from 

inappropriate content,”47 and that “any App that targets minors for data collection will be 

rejected.”48 The details of this screening process are not clear.

Location information is treated differently from other information by each system but 

follows essentially an “on/off” model. Both operating systems can signal the user when an 
12

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

app requests the user’s location by displaying a specific icon.49 Both systems also provide a 

global setting that allows users to turn off their devices’ location capabilities.50 As described 

above, Android’s operating system requires developers to declare a “permission” for access 

to location information. After an app is downloaded, Apple’s operating system provides: 1) a 

notice the first time that an app attempts to acquire the user’s location; and 2) an on/off switch 

in the device’s settings allowing users to permit an app to access their location information 

on an app-by-app basis.51 These additional protections offered by Apple apply only to an app 

requesting location information.

Beyond the basic technological models, both app stores require developers by agreement 

to disclose the information their apps collect,52 though neither store specifies how or where 

such information should be provided. Both stores’ privacy policies also state that the privacy 

policies of the app developers control the practices of a mobile app offered in the app stores.53

Under this model, the information provided by developers is critical for transparency. 

Nevertheless, as described below, such information is rarely provided.

Disclosure of App Data Collection and Sharing

Staff’s review of both the app store promotion pages and developer websites of the 400 

closely examined apps in the survey revealed very little information about the apps’ data 

practices.

Indeed, the Apple app promotion pages that staff examined provided almost no 

information on individual developers’ data collection and sharing practices. Similarly, the 

Android app promotion pages that staff examined provided little information other than the 

mandatory “permissions.” Only three (1.5%) of the 200 Android apps even attempted to 

convey information about the purpose for the “permissions.” These three apps made the 

following disclosures (respectively) on their promotion pages:

● “Needs Location permission for Ads. If you prefer, get the AD FREE version.”

● “Permissions are required by the Ad networks, which keep the app free.”

● “All requested permissions are for ads only.”

All three statements put the user on notice that the app provides information to an ad 

network, but do not identify what information is collected, by whom, how it is used, and 

whether it is shared with others.

Staff also looked for information about the apps’ data collection and sharing practices 

on the landing pages of the developers’ websites.54 As with the app promotion pages, staff 
13

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

found very little information. Sixteen percent of the 400 kids app promotion pages linked to a 

developer landing page that contained or linked to disclosure information. Within this group, 

13% (of the 400) linked to a landing page that displayed a link labeled “privacy policy,” and 

the remaining 3% linked to developer sites that provided links to some other disclosures. 

These other disclosures had labels such as “terms of use,” “terms and conditions,” “terms of 

service,” “Legal Notices,” and “disclaimers.” 55 Out of the entire set of 400 app promotion 

pages examined, only two (0.5%) linked to a developer landing page that disclosed information 

about data collection and sharing on the landing page itself.

Disclosure of Additional Interactive Features

Staff also examined the app store promotion pages for features that may serve as a 

platform for data collection, such as the ability to make purchases within the app, connect 

with social media, and serve targeted advertising. These features often are provided to the app 

developer by various third parties, who may gain access to kids’ data as a result.

In-App Purchase Mechanism

Some developers offer app users the ability to purchase additional content via an in-app 

purchase mechanism. For example, a storybook application may come with a single story, 

but then allow the app user to purchase additional stories without having to leave the app. The 

ability of children to purchase items within mobile applications has been a subject of concern in 

media reports and by members of Congress, as parents may not know about such capabilities 

prior to download.56

Staff found that 11.0% of the 200 Apple App Store promotion pages, and 0.5% of the 

200 Android pages indicated that the app had some form of in-app purchase mechanism. 

While Apple includes a box disclosing “Top In-App Purchases” on the promotion page for 

apps with in-app purchase mechanisms, Android appears to require only those developers that 

use Android’s own in-app purchasing mechanism to display a permission discussed above.57

In light of the significant concerns raised by in-app purchase capabilities in apps for children, 

staff is evaluating what types of protections should apply to these capabilities. It is clear, 

however, that confusing and hard-to-find disclosures do not give parents the control that they 

need in this area.

Staff believes that parents need consistent, easily accessible, and recognizable disclosures 

regarding in-app purchase capabilities so that they can make informed decisions about whether 

to allow their children to use apps with such capabilities.
14

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Social Network Integration and Other Social Features

Staff found that 5% of the 400 app promotion pages indicated that the app was 

integrated with a social network – that is, a user could access a social network, and thus share 

information, through the app. Staff found that 3.5% of the 400 promotion pages indicated 

integration with Facebook, 2% with Twitter, and 2% with various other social networks.58

Because the app stores do not appear to require disclosure of these social features on the 

promotion page, it is likely that the survey numbers understate the prevalence of social 

functionality. In addition, some apps have their own internal sharing functions – for example, 

automatically sharing game results, usernames, and other information with unknown users on 

the app’s scoreboard or news feed. Staff believes that the presence of social features within an 

app is highly relevant to parents selecting apps for their children, and that such functionality 

should be disclosed prior to download.

In-App Advertising

The existence of advertising within an app may be significant to parents for several 

reasons. First, parents may want to limit the data collected by advertisers and ad networks 

about their children.59 Second, even if the advertising is not based on any information collected 

by the user, parents may want to limit their children’s exposure to ads. Finally, ads running 

inside an app may incorporate various capabilities allowing the user to do things like directly 

call phone numbers or visit websites appearing in the ad, and parents may not want these 

options available to their children.

Staff found that about 7% of the 400 app store promotion pages indicated that the app 

contained advertising. As above, this number is likely to understate the number of apps 

containing advertising because app stores do not appear to require developers to disclose 

in-app advertising on their promotion pages, and because advertising is a common way to 

monetize apps.60 Some of the disclosures appeared to be designed to warn parents about the 

potential exposure of their children to ads. For example, one promotion page indicated that 

the app would only display ads during the initial download, when parents would be the likely 

audience. Other statements attempted to address the information collection aspect of targeted 

in-app advertising. As previously discussed, three of the Android apps attempted to explain 

(though fairly cryptically) that a permission to access certain information was related to in-app 

advertising.
15

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Still others included language addressing the “click-to” functionality often found 

within advertisements – for example, stating that the developer had moved the placement 

of banner ads to the top of the screen within the app in order “to avoid accidental clicks by 

the little fingers.” Some app developers appeared to be offering certain protections to users 

as a selling-point in the competitive app market. For example, several app promotion pages 

included language indicating that the app was “ad free,” and one disclosed that, “[f]or security 

reasons,” the app switched the device to “airplane mode” when in use in order to “protect you 

[sic] children from any risk.”

The presence of these statements to parents and other users suggests that certain 

developers are aware of parents’ concerns and are taking some steps to respond. However, 

parents need clear, easy-to-read, and consistent disclosures regarding the advertising that 

their children may view on apps, especially when that advertising is personalized based on the 

child’s in-app activities. And to the extent that third parties providing the advertising (or other 

interactive features) gain access to kids’ data in providing these services, they also must ensure 

that their data practices are disclosed to parents in a clear and meaningful way.

App Rating Systems and Parental Controls

Both app stores and operating systems offer rating systems and controls that can 

provide parents with useful tools to manage their children’s access to and use of mobile apps. 

The systems allow parents to restrict access to mobile content and features, and can limit 

the collection of data from the mobile device, such as limiting the sharing of geolocation 

information. These systems are not designed, however, to provide specific information about 

the data collected and shared by apps.61

Rating Systems62

The Apple App Store and the Android Market assign various content ratings to the apps 

they offer indicating a recommended level of maturity. Some of the parent controls rely on 

these content ratings to screen out inappropriate material.63 Apple’s and Android’s content 

ratings are unique to the particular app store, and the methods for evaluating content and 

assigning ratings rely largely on the app developer to supply the initial rating.64

Apple’s content ratings consist of four different age indicators (“4+,” “9+,” “12+,” 

and “17+”) that are assigned to apps as part of Apple’s approval process. Prior to submitting 

an app to Apple for approval, app developers must fill out a ratings matrix.65 The matrix 

requires the developer to select the frequency (e.g., “none,” “infrequent/mild,” or “frequent/
16

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

intense”) of different types of content (“Cartoon or Fantasy Violence,” “Sexual Content or 

Nudity,” “Profanity or Crude Humor,” etc.), and assigns a rating based on the developer’s 

input.66 Staff did not evaluate the appropriateness of any of the ratings assigned, but notes that 

nearly all of the Apple apps reviewed in this survey contained the lowest content rating of 

“4+.” See Table 8.

Table 8: Content Ratings for Apple App Store “Kids” Apps

Apple Content Rating Apple App Store

“4+” 97.5%

“9+” 1.5%

“12+” 1.0%

“17+” 0%

n=200

Content ratings in the Android Market also are largely determined by the app developer, 

and consist of four different maturity indicators (“Everyone,” “Low maturity,” “Medium 

maturity,” and “High maturity”).67 Android’s ratings do not map directly to specific ages 

but, like Apple’s, are tied to violent or mature content. Android provides content-based 

guidelines to developers, and requires that maturity ratings be tied to the app’s functionality.68

For example, the guidelines state that “Apps rated ‘Everyone’ must not ask users for their 

location.” 69 As shown in Table 9, an overwhelming majority of the Android apps reviewed 

by staff contained the lowest content rating of “Everyone.” A number of the Android apps 

involved in this survey did not contain a maturity rating because they pre-dated Android’s 

introduction of the content rating requirement in November 2010. Twenty-two such apps 

appeared in staff’s review and are not included in the percentages presented in Table 9.

Table 9: Content Ratings for Android Market “Kids” Apps70

Android Content Rating Android Market

“Everyone” 83%

“Low maturity” 12%

“Medium maturity” 2%

“High maturity” 2%

n=178

Parental Controls

Both app stores provide various controls allowing parents to restrict which apps may be 

downloaded onto their children’s mobile devices, based on app content ratings.71 In addition, 

Apple’s mobile operating system incorporates controls that allow parents to password-protect 
17

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

access to a number of specific applications, such as Apple’s Internet browser (Safari), the 

online video website YouTube, the iTunes App Store itself, the device’s camera application, as 

well as some device capabilities, such as location sharing and in-app purchase mechanisms.72

Although the Android operating system does not have such built-in parental controls, a number 

of available apps allow parents to password-protect access to various content and device 

capabilities.73

On both systems, parents can set the device settings to limit the flow of some information 

– for example, blocking GPS location sharing or setting the device on “airplane mode” in 

order to restrict the interactive features of an app. However, a parent needs to set these limits 

each time the child uses an app, and taking such actions may adversely limit desirable app 

functionality.74 Further, while these types of controls may help parents manage the use of the 

device by their children, they do not provide information about the data practices associated 

with the apps that run on them. Thus, parents may be forced to choose between allowing their 

child to use an app, with all the unknown risks associated with such use, and cutting off their 

child’s use of the app altogether. With better information about the data practices of these 

apps, parents can make informed decisions about which apps their children can use safely, and 

which apps parents wish to avoid.

Conclusion

The mobile apps marketplace is a constantly evolving new media that offers parents many 

new options for entertaining and educating their children. Staff’s survey shows, however, that 

parents generally cannot determine, before downloading an app, whether the app poses risks 

related to the collection, use, and sharing of their children’s personal information. Although 

the two major U.S. mobile app stores provide some information and controls governing apps, 

all members of the mobile app ecosystem – the app stores, the developers, and the third 

parties providing services within the apps – must do more to ensure that parents have access to 

clear, concise and timely information about the apps they download for their children. Parents 

should be able to learn, before downloading an app for their children, what data will be 

collected, how the data will be used, and who will obtain access to the data. Armed with such 

information, parents can make knowledgeable decisions about the apps they choose for their 

children, and embrace these technologies with more confidence. Staff is committed to working 

with all stakeholders on these issues, and also plans to continue its vigorous enforcement of 

the COPPA statute and Rule. Staff hopes that this report will spur greater transparency and 

meaningful disclosure about the data collection practices in apps for children.
18

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Endnotes

1. The primary authors of this FTC staff survey and report are Patricia Poss and Andrew Hasty of the FTC’s 

Bureau of Consumer Protection. They received valuable assistance from Andrew Bristow, a Princeton 

student on temporary staff at the FTC, and staff from throughout the Bureau of Consumer Protection. Robert 

Letzler and Michael Shores of the Bureau of Economics provided valuable assistance with presentation of the 

empirical results.

2. Apple offered 552 apps at launch in July 2008. Michael Arrington, iPhone App Store Has Launched 

(Updated), TechCrunch (July 10, 2008), http://techcrunch.com/2008/07/10/app-store-launches-upgradeitunes-now/. Google’s Android Market offered 50 apps when it launched in October 2008. Dean Takahashi,

Google Releases Details on Android Market Launch, VentureBeat (Oct. 22, 2008), http://venturebeat.

com/2008/10/22/google-releases-details-on-android-market-launch/.

3. Press Release, Apple, Apple’s Mac App Store Downloads Top 100 Million (Dec. 12, 2011), http://www.

apple.com/pr/library/2011/12/12Apples-Mac-App-Store-Downloads-Top-100-Million.html.

4. Google Android Market, Distimo, http://www.distimo.com/appstores/app-store/19-Google_Android_

Market (last updated Dec. 30, 2011).

5. See Press Release, Apple, Apple’s Mac App Store, supra note 3 (more than 18 billion downloads from Apple 

App Store); Eric Chu, 10 Billion Android Market Downloads and Counting (Dec. 6, 2011), http://androiddevelopers.blogspot.com/2011/12/10-billion-android-market-downloads-and.html.

6. Common Sense Media reported that half (52%) of all children in the United States have access to a 

smartphone (41%), a video iPod (21%), or an iPad or other tablet device (8%). Common Sense Media, Zero 

to Eight: Children’s Media Use in America 9 (Fall 2011), available at www.commonsensemedia.org/sites/

default/files/research/zerotoeightfinal2011.pdf. Another study indicated that two-thirds of the children ages 

4-7 stated they had used an iPhone, often one owned by a family member and handed back to them while 

riding in an automobile. Cynthia Chiong & Carly Shuler, Joan Ganz Cooney Center, Learning: Is there an 

App for that? 15 (Nov. 2010), available at www.joanganzcooneycenter.org/upload_kits/learningapps_

final_110410.pdf. In addition, recent research states that “In the third quarter of 2011, teens age 13-17 used 

an average of 320 MB of data per month on their phones, increasing 256 percent over last year and growing 

at a rate faster than any other age group.” New Mobile Obsession: U.S. Teens Triple Data Usage, Nielsen 

(Dec. 15, 2011), http://blog.nielsen.com/nielsenwire/online_mobile/new-mobile-obsession-u-s-teenstriple-data-usage/.

7. These recommendations are consistent with the FTC staff’s preliminary privacy report that called on 

companies to be more transparent as to their data collection practices and encouraged companies to offer 

short, easy-to-read disclosures (or icons) that consumers are likely to see, read, and understand. See 

FTC Preliminary Staff Report, Protecting Consumer Privacy in an Era of Rapid Change: A Proposed 

Framework for Businesses and Policymakers 69-71 (Dec. 1, 2010), available at http://ftc.gov/

os/2010/12/101201privacyreport.pdf.

8. A promotion page is the screen in the app store where a developer provides certain basic information about 

its app.

9. As discussed further below, “permissions” are phrases describing an app’s capabilities that appear on the 

mobile screen prior to downloading an app in the Android app store.

10. The Commission’s COPPA Rule was promulgated pursuant to the Children’s Online Privacy Protection Act 

of 1998, 15 U.S.C. §§ 6501-6506. The text of the COPPA Rule can be found at 16 C.F.R. Part 312.

11. United States v. W3 Innovations, LLC, No. CV-11-03958 (N.D. Cal. Sept. 8, 2011) (FTC consent order with 

developer of child-directed mobile apps for alleged violations of the COPPA Rule), available at http://ftc.

gov/os/caselist/1023251/110908w3order.pdf.

12. Children’s Online Privacy Protection Rule, 76 Fed. Reg. 59,804 (proposed Sept. 27, 2011) (stating that 

“online services” currently covered by the COPPA Rule “includes mobile applications that allow children 

to play network-connected games, engage in social networking activities, purchase goods or services online, 
19

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

receive behaviorally targeted advertisements, or interact with other content or services.”), available at 

http://www.gpo.gov/fdsys/pkg/FR-2011-09-27/pdf/2011-24314.pdf.

13. See 16 C.F.R. § 312.2 (defining “[w]ebsite or online service directed to children”).

14. FTC investigations are nonpublic until the Commission takes a public action such as issuing a complaint or 

announcing a settlement.

15. A number of organizations have issued guidance for app developers. See Press Release, Future of Privacy 

Forum, FPF and CDT Release Best Practices for Mobile Apps Developers (Dec. 21, 2011), http://www.

applicationprivacy.org/?p=1947; Press Release, Mobile Marketing Association, Mobile Marketing 

Association Releases New Privacy Policy Guidelines for Mobile Apps for Public Comment (Oct. 17, 2011), 

http://mmaglobal.com/news/mobile-marketing-association-releases-new-privacy-policy-guidelinesmobile-apps-public-comment; Privacy Choice, PrivacyChoice Challenges Developers to “Get Their Apps in 

Gear” (Oct. 18, 2011), available at http://blog.privacychoice.org/2011/10/18/get-your-apps-in-gear/.

16. If the app is directed to children and in fact collects information from children, the app must provide a notice 

and obtain parental consent prior to collection pursuant to COPPA. See 16 C.F.R. § 312.3. In addition, 

Commission staff has stated more generally that when companies collect sensitive information about children 

and precise geolocation data, companies should seek affirmative express consent before the data is collected 

or shared. See FTC Preliminary Staff Report, supra note 7, at 61.

17. See Best Practices for Mobile Applications Developers, Future of Privacy Forum, 3, http://www.

futureofprivacy.org/wp-content/uploads/Apps-Best-Practices-v-beta.pdf (last visited Jan. 24, 2012) 

(citing section 3.3.10 of the iOS Developer Program License Agreement, stating that “Developers must 

provide clear and complete information to users regarding collection, use and disclosure of user or device 

data.”); Android Market Developer Distribution Agreement, 4.3, http://www.android.com/us/developerdistribution-agreement.html (last visited Oct. 31, 2011) (“If the users provide you with, or your Product 

accesses or uses, user names, passwords, or other login information or personal information, you must make 

the users aware that the information will be available to your Product, and you must provide legally adequate 

privacy notice and protection for those users.”); see also Scott Thurm & Yukari Iwatani Kane, Your Apps are 

Watching You, Wall St. J., Dec. 18, 2010, available at http://online.wsj.com/article/SB100014240527487

04694004576020083703574602.html (reporting that numerous Apple and Android applications transmitted 

user information, and numerous apps did not provide privacy policies on their websites or inside the apps at 

the time of testing).

18. See Press Release, FTC, FTC Seeks Input to Revising its Guidance to Business About Disclosures in Online 

Advertising (May 26, 2011), available at http://www.ftc.gov/opa/2011/05/dotcom.shtm.

19. The report focuses on the information available to parents selecting apps for children, who would in most 

instances be under 13 years of age. Parents of teens, however, may have similar concerns about the collection 

of information from apps their older children use.

20. Staff does not know what factors the app stores use to determine the rank order of the apps returned from 

their search functions. The apps appeared relevant to the search term “kids.”

21. The Android Market also provides an estimated range of the number of times an app has been downloaded 

and a list of “permissions” associated with every app.

22. As shown in the tables below, some of the findings in the survey are based on an analysis of the 960 apps 

while others are based on the more detailed analysis of the subset of 400 apps.

23. Most apps are not expensive but all sales are final in the Apple App store (see iTunes Store Terms and 

Conditions, http://www.apple.com/legal/itunes/us/terms.html#GIFTS (last visited Jan. 17, 2012)) and 

refunds for apps obtained through the Android Market must be made within 15 minutes from download (see 

Returning Apps, Android Market Help Articles, http://support.google.com/androidmarket/bin/answer.

py?hl=en&answer=134336 (last visited Jan. 17, 2012)).

24. See Appendix, pages A2-A3 for additional information about the differences; see also 

Armando Rodriquez, PC World, “Web-based Android Market Looks Good” (Feb. 2, 2011), 

http://www.pcworld.com/article/218532/webbased_android_market_looks_gocd.html (“Essentially it is 
20

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

the same information you would get from browsing the Market on your phone only in a much nicer-looking 

package.”).

25. See Appendix, page A3-A4 for more information about how staff categorized the apps.

26. The “Other” category mostly included apps offering parenting guides, and children’s television or movie 

recommendations. Staff also encountered three apps for parents to use to monitor their child’s geolocation.

27. See Appendix, page A3-A4 for additional information.

28. In total, 5% of the 400 apps closely reviewed by staff were likely not intended to be used by kids, based on 

the apps’ descriptions. Except where noted, staff did not remove these apps from the analysis in this report. 

See Appendix, page A7.

29. Staff converted the grade kindergarten to the age 5, first grade to the age 6, second grade to the age 7, etc.

30. A recent study looking at the paid apps in the Apple App Store’s Education category found 58% of the 

apps were for toddlers and preschool age children. Carly Shuler, Joan Ganz Cooney Center, iLearn II: 

An Analysis of the Education Category of Apple’s App Store, 13-14 (Jan. 2012), available at http://

joanganzcooneycenter.org/Reports-33.html.

31. Developers do not receive compensation from the app stores when a user downloads a free app. Developers 

can still make money from such apps, however. As discussed below, one of the common business models is 

to partner with a mobile ad network that will pay a developer to include code in the app software that allows 

the ad network to serve ads.

32. Several apps in the study appeared to be quite popular. One Android app appeared to have been downloaded 

between 5,000,000 and 10,000,000 times; six Android apps showed 1,000,000 to 5,000,000 downloads; five 

Android apps showed 500,000 to 1,000,000 downloads; and 19 Android apps showed that they had been 

downloaded 100,000 to 500,000 times.

33. The percentages reported were calculated using the lower values of the download ranges. See Appendix, page 

A4 for more information about the download calculation.

34. Currently, both the mobile and desktop versions of the Android Market include an email contact on the 

app promotion pages. At the time staff collected the information for this report, however, only the mobile 

version of the Android Market included this information. Therefore, the 13% figure would likely be higher 

if staff had captured the mobile version of the app promotion pages, or if staff were to repeat the information 

collection today. See Appendix, page A2.

35. Staff used an English language configured browser to visit developer websites, but nevertheless encountered 

five foreign language websites.

36. Because staff only reviewed the landing page of the associated websites, there may have been apps that 

included contact information on subsequent pages of the associated site. See Appendix, page A4-A5.

37. These percentages do not add up to the 65% total because the landing pages contained different combinations 

of contact information.

38. As noted, staff encountered a significant number of apps for very young children. These children are unlikely 

to be able to type sensitive personal information into the mobile device. Nevertheless, the app may collect 

and share information about the device and/or child, such as the device’s location or phone number, or other 

information stored on the device by the user.

39. See Press Release, Future of Privacy Forum, supra note 15 (“Application developers can access a 

considerably broader range of information about users than traditional web developers”); Lookout Mobile 

Security, App Genome Report (Feb. 2011), available at www.mylookout.com/appgenome/ (finding that 

28% of the free apps in the Android Market and 34% of the free apps in the Apple App Store have the 

capability to access user location information, and 7.5% of the free apps in the Android Market and 11% of 

the free apps in the Apple App Store have the capability to access user contacts); Thurm & Kane, supra note 

17 (documenting the data collection that occurred through many popular smartphone apps).

40. See, e.g., Consumer Privacy and Protection in the Mobile Marketplace: Hearing before the Subcomm. 

on Consumer Protection, Product Safety and Insurance of the S. Comm. on Commerce, Science and 
21

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Transportation. 112th Cong. 6-7 (May 10, 2011) (prepared statement of Alan Davidson, Director of Public 

Policy, Google Inc.), available at http://commerce.senate.gov/public/?a=Files.Serve&File_id=517bc26fab89-4339-ad0f-441879598ed1 (the user may choose to trust the application by completing the installation or 

the user may choose to cancel the installation).

41. Android provides consumers with a very technical description of this permission stating that it allows “an 

application to create network sockets.” See Appendix, page A5.

42. For purposes of Table 7, staff removed any apps determined by staff not to be for kids.

43. “Phone calls: read phone state and identity” allows the app to determine if the mobile device is currently 

making a telephone call – presumably so that it can avoid interrupting the call. It can also determine the 

mobile device’s telephone number. A more descriptive list of the Android operating system permissions found 

in this survey is provided on pages A5-A6 of the Appendix.

44. “Modify/delete SD card” means the app would have the ability to save and erase data on the mobile device’s 

memory card. See Appendix, pages A5-A6.

45. See Apple Answers the FCC’s Questions, Apple Inc. (Aug. 21, 2009), available at http://www.apple.com/

hotnews/apple-answers-fcc-questions (stating that it provides guidelines to developers that are used in 

considering whether to approve applications, and describing Apple’s review process).

46. At least one survey of free apps in the Apple App Store and the Android Market, however, found little 

difference between the two stores in the prevalence of access to sensitive data. Lookout Mobile Security, 

supra note 39, Figs 9-10; see also Thurm & Kane, supra note 17, (documenting the data collection that 

occurred through many popular smartphone apps).

47. Apple Answers the FCC’s Questions, supra note 45.

48. See Consumer Privacy and Protection in the Mobile Marketplace: Hearing before the Subcomm. on Consumer 

Protection, Product Safety and Insurance of the S. Comm. on Commerce, Science and Transportation, 112th 

Cong. 3 (May 19, 2011) (prepared statement of Catherine Novelli, Vice President, Worldwide Government 

Affairs, Apple Inc.), available at http://commerce.senate.gov/public/?a=Files.Serve&File_id=4e365814-

c929-4785-9d39-596052ab3a7d (stating “we make it very clear in our App Store Review Guidelines that any 

App that targets minors for data collection will be rejected.”).

49. See Statement of Catherine Novelli, supra note 48, at 4-5 (“An arrow icon alerts iOS 4 users that an 

application is using or has recently used location-based information”); Understanding the LocationListener 

in Android, DoityourselfAndroid.com (Dec. 25, 2010) http://blog.doityourselfandroid.com/2010/12/25/

understanding-locationlistener-android/ (discussing the GPS icon on Android and stating that “No GPS 

icon will be shown in the title bar, unless a certain application (like Google Maps) triggers it to request a 

location.”).

50. See Statement of Catherine Novelli, supra note 48, at 4; Statement of Alan Davidson, supra note 40, at 5-6.

51. See Statement of Catherine Novelli, supra note 48, at 4.

52. See Best Practices for Mobile Applications Developers, Future of Privacy Forum, 3, http://www.

futureofprivacy.org/wp-content/uploads/Apps-Best-Practices-v-beta.pdf (last visited Jan. 24, 2012) 

(citing section 3.3.10 of the iOS Developer Program License Agreement, stating that “Developers must 

provide clear and complete information to users regarding collection, use and disclosure of user or device 

data.”); Android Market Developer Distribution Agreement, 4.3, http://www.android.com/us/developerdistribution-agreement.html (last visited Oct. 31, 2011) (“If the users provide you with, or your Product 

accesses or uses, user names, passwords, or other login information or personal information, you must make 

the users aware that the information will be available to your Product, and you must provide legally adequate 

privacy notice and protection for those users.”).

53. Apple Privacy Policy, http://www.apple.com/privacy (last visited Jan. 17, 2012) (“Information collected by 

third parties, which may include such things as location data or contact details, is governed by their privacy 

practices. We encourage you to learn about the privacy practices of those third parties.”); Android Privacy 

Policy, http://www.android.com/privacy.html (last visited Jan. 17, 2012) (“Information collected by the 

third party application provider is governed by their privacy policies.”).
22

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

54. The desktop version of the Apple App Store provides standardized locations on each app’s preview page 

for placing links to the developer’s website, a support site, and an application license agreement. Staff only 

reviewed the developer website link. See Appendix, pages A4-A5.

55. As noted in the FTC staff’s preliminary privacy report, consumers are unlikely to read disclosures buried in 

privacy policies or “terms of service” agreements because they are not easily accessible and are invariably 

long, legalistic, and difficult to understand. These concerns are heightened in the mobile space, where 

consumers are interacting with very small screens. The privacy report encouraged companies to offer short, 

easy-to-read, “just in time” disclosures (or icons) that consumers are likely to see, read, and understand. See 

FTC Preliminary Staff Report, supra note 7, at 69-71.

56. See Cecilia Kang, Lawmakers urge FTC to investigate free kids games on iPhone, Washington Post, 

Feb. 8, 2011, available at http://www.washingtonpost.com/wp-dyn/content/article/2011/02/08/

AR2011020805721.html.

57. See Administering In-app Billing, Android Developers Guide, http://developer.android.com/guide/market/

billing/billing_integrate.html (last visited Jan. 17, 2012).

58. A few applications indicated integration with more than one social network.

59. In-app advertising typically involves a relationship between the app developer and an ad network, where the 

ad network pays the developer to incorporate the ad network’s code into the developer’s application. When 

the app is running, the ad software allows the ad network to send ads to the user’s device. Depending on 

how the ad network software is configured, the ad network may collect information from the user to provide 

targeted ads. See Thurm & Kane, supra note 17 (“[M]any ad networks offer software ‘kits’ that automatically 

insert ads into an app. The kits track where users spend time inside the app.”); see generally Google Ads 

for Mobile FAQ, http://code.google.com/mobile/afma_ads/kb/ (last visited Jan. 17, 2012) (describing the 

integration of ad software for targeted advertising); iAd, http://developer.apple.com/iad/ (last visited Jan. 

17, 2012) (describing the integration of ad features in iOS).

60. See Jolie O’Dell, The Rise of Mobile In-App Ads (July 16, 2011), http://mashable.com/2011/07/16/in-appads/ (43% of the app developers used in-app advertising in 2011).

61. Other organizations review mobile apps and provide ratings and recommendations to help parents select 

content appropriate apps for kids. See, e.g., Common Sense Media, Best apps: Our recommendations for 

families, http://www.commonsensemedia.org/mobile-app-lists (last visited Jan. 17, 2012).

62. While reviewing the app promotion pages in the survey, staff did not encounter any references to the age and 

content ratings found on many computer and video games, which are assigned by the Entertainment Software 

Rating Board (ESRB). Staff also notes that the ESRB and the wireless trade association CTIA have recently 

created a new mobile app rating system that uses its traditional icons to inform users. See Press Release, 

ESRB, CTIA-The Wireless Association and ESRB Announce Mobile Application Rating System (Nov. 29, 

2011), available at http://www.esrb.org/about/news/downloads/CTIA_ESRB_Release_11.29.11.pdf. Like 

the Apple and Android rating systems, this new ratings system considers whether the app contains violence, 

language, or sexual content. It also considers whether the app has a minimum age requirement, allows the 

exchange of user-generated content, or enables users to share their location with other app users. However, 

this system also relies on developer provided information. Apple and Google are not currently participating 

in this initiative. See Kevin Fitchard, Apple, Google Absent From ESRB’s New Mobile App Rating System,

Gigaom (Nov. 29, 2011), http://gigaom.com/2011/11/29/apple-google-absent-from-esrbs-new-mobileapp-rating-system/.

63. See, e.g., Statement of Catherine Novelli, supra note 48, at 2; iTunes: Using Parental Controls, Apple, 

http://support.apple.com/kb/ht1904 (last modified Sept. 23, 2011). The Android Market allows users 

to filter apps displayed in the market based on app content ratings. Application Content Ratings, Android 

Market, http://support.google.com/androidmarket/bin/answer.py?hl=en&answer=1075738 (last visited 

Jan. 17, 2012).

64. See Apple, iTunes Connect Developer Guide, Version 7.2 52-53 (Oct. 17, 2011), available at https://

itunesconnect.apple.com/docs/iTunesConnect_DeveloperGuide.pdf; Statement of Alan Davidson, supra 

note 40, at 7.
23

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

65. See iTunes Connect Developer Guide, supra note 64, at 52.

66. Id.

67. Rating Your Application Content for Android Market, Android Market for Developer, http://support.google.

com/androidmarket/developer/bin/answer.py?hl=en&answer=188189 (last visited Jan. 17, 2012).

68. Id.

69. Id.

70. Staff did not evaluate the appropriateness of the Android ratings, but noticed that four of the Android “kids” 

apps listed a “medium maturity” rating, and four others listed a “high maturity” rating. Upon further review 

of these app descriptions, only five of these eight apps appeared to be intended for a child to use. These five 

apps consisted of three flashcard games, one painting game, and one “animal sounds” game. Based on the 

information available, staff could not determine why these five apps had such high maturity ratings.

71. See Apple, iOS: Understanding Restrictions, available at http://support.apple.com/kb/ht4213 (last modified 

Oct. 24, 2011); Kids and Media, Parental Controls for Android (Dec. 5, 2011), www.kidsandmedia.org/

parent-controls-for-android/; see also Application Content Ratings, Android Market, supra note 63.

72. See Apple, iOS: Understanding Restrictions, supra note 71.

73. See Kids and Media, Parental controls for Android, supra note 71; iKid Apps, How to Setup Parental 

Controls on Android (July 22, 2011) available at http://www.ikidapps.com/2011/07/how-to-setup-parentalcontrols-on-android.html.

74. For example, a child may not be able to access higher levels of a game or additional content if the internet 

connection has been blocked.
A1

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Appendix 

Methodology

This section provides additional information about the data collected and reviewed in the 

attached FTC Staff Report on Kids Apps.

Apple Data Collection

On July 14, 2011, staff used a desktop computer with the Windows 7 operating system to 

locate and copy the app store promotion pages for 960 mobile applications using the following 

steps. Staff first searched on the term “kids” in the desktop version of Apple’s iTunes app 

store and noted that each app had its own nine-digit unique identifier number and its own app 

store promotion page describing the app. The app store promotion page for each app was 

viewable by typing in the specific web address within the itunes.apple.com website, which 

contained the unique app identifier number, into the Internet Explorer browser on the desktop 

computer. Thus, staff could locate the unique web address for each app store promotion 

page using the following convention “http://itunes.apple.com/us/app/id[9-digit-unique-appidentification-number]?mt=8.” Staff then used software to visit and copy the browser-viewable 

app promotion pages for the first 480 apps returned by the “kids” search in the Apple app 

store.

Android Data Collection

On July 14, 2011, staff used the same desktop computer with the Internet Explorer 

browser to access the desktop version of the Android Market, available at https://market.

android.com. Staff searched on the term “kids” and noted that each app had its own unique 

identifier and its own app store promotion page describing the app. Like Apple, the Android 

Market app promotion page for each app was viewable by typing in the specific web address 

within the market.android.com website, which contained the unique app identifier, into 

the browser. Staff could locate the unique web address for each app store promotion page 

using the following convention, “https://market.android.com/details?id=[unique-appid]&feature=search_result.” Staff then used software to visit and copy the app promotion 

pages for the first 480 Android Market apps returned by the “kids” search.

Data Extraction

Staff saved each app store promotion page as a .txt file and as an .html file. Staff 

identified the relevant fields, such as price, developer, and number of ratings, found within the 
A2

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

copied app promotion pages and extracted that data into an electronic database. This automated 

extraction was the source of all of the n=480 tables in the report.

Reviewing the Random Sample of App Store Promotion Pages

Staff completed a review of 400 randomly selected app store promotion pages. For each 

of the pools of the 480 app promotion pages, staff used a random number generator to select 

200 unique numbers and created a separate database that contained only the 200 app store 

promotion pages that corresponded with the 200 randomly selected numbers. Reviewers were 

instructed to examine the electronically captured app promotion pages (that had been saved 

as .html files), and to answer a series of questions about things like app topic, age range, and 

disclosures related to their review of the app promotion page using the database form. The 

specific instructions related to this review are detailed below. Once staff completed the review, 

two additional reviewers rated the sample, and found almost complete agreement between 

the first and second review, suggesting that the application of staff’s criteria was relatively 

unambiguous.

Reviewers were also instructed to click on the website address listed on the app 

promotion page in the field for “[developer’s] website.” Staff then saved and reviewed the 

resulting webpage (the “landing page” of the developer’s website), and entered the answers to 

a series of questions using the database form. Tables containing calculations that list “n=200” 

specify that the calculations were obtained from one of the two random samples.1

App Store Desktop Interface v. Mobile Device Interface

Staff collected the information in this report only from the content offered in the desktop 

interface of the two app stores. There are two relevant differences between this content and 

the content available through the mobile device interface, but staff does not believe these 

differences change the conclusions of this report.

App store promotion pages viewed in the Android Market using a mobile device include 

a field that displays a developer email address. At the time staff collected the information for 

the survey, this field was not found on the desktop version of the Android Market, and, thus, 

was not captured in the survey. Therefore, more email addresses were likely available for the 

Android apps in this survey than staff collected.

1. The specific random sample used is identified by the column heading under which the “n=200” specification 

is found.
A3

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Similarly, app store promotion pages viewed in the desktop version of Apple’s App 

Store included a field that displayed a web address labeled “[Developer Name] Support,” 

even though this field was not found in promotion pages viewed from an iPhone. As noted 

in the report, staff did not review these additional web addresses and does not know if they 

contained additional contact information or disclosure information. Staff did note that 61% of 

the promotion pages listed the same address for both the developer’s website and the support 

website.

Categorizing Apps based on Type

Staff categorized the apps in the random sample based on a number of categories 

according to words found within the app descriptions and titles. The following is a list 

of the categories and any additional words used to classify an app into the categories: 

Educational (“learn,” “teach,” or any variation of the word “educate”); Game (“play”); 

Animal-related (“animal,” “creatures,” or the names or icons of different types of animals); 

Alphabet/Spelling/Words (“letters”); Math/Numbers (“arithmetic,” “counting,” “addition,” 

“subtraction,” “multiplication,” or “division”); Matching (“match,” or “find 2 of the same”); 

Memory; Book/Story (“chapters”); Coloring (“paint” or “draw”); Musical (“music” or 

“song”); Puzzle; Learning a language2; Flash Cards; Photo-related (“photo” or “picture”); 

Quiz/Test; Jokes; and other. Apps could fall into more than one category. For example, 

a matching game that involved pictures of animals would be categorized under “Game,” 

“Matching,” and “Animal-related.”

Categorizing Apps based on Intended User

Staff categorized the 400 apps in the random sample based on whether the app title 

or description identified any one of the following groups as an audience for whom the app 

was intended or recommended: Infant; Toddler; Child; Kid; Teen; Adult; Parent; Teacher; 

Family; Mature; Everyone; Preschool; Elementary; Middle School; High School; Age 

Range; Grade Range; Other; and No Indication. Grade and age range information have been 

presented separately from the qualitative categories in the report. Simply containing one of 

these audience groups in the app title or description was not sufficient to trigger an intended 

use category. The app title or description had to indicate in some way that the app was for 

one or more of these groups’ use. For example, one of the promotion pages described an app 

containing recipes for child-friendly meals. Although the description included the term “child,” 

2. This category only included apps that had the word “learn” plus a language in the title or description.
A4

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

the app was intended for use by parents or caretakers to make meals for children and therefore 

was not included in the “child” category.

Price Level Popularity

To estimate price level popularity for the Android apps in the survey, staff summed the 

lower bound of the download range for each app within a given price level. Next, staff divided 

these price level sums by the sum of the lower bound of the download ranges for all 480 

Android apps. Using this method, staff found that the free Android apps returned by the “kids” 

search, which accounted for 62% of the search results, accounted for 99% of all downloads. 

Table 7 of the report contains the results obtained using the lower bound method.

Staff then repeated its calculations using the upper bound and midpoint of each download 

range. Staff found that the results returned by each method were nearly indistinguishable from 

the results obtained using the lower bound of the download ranges.

Both the Android Market and the Apple App Store display the number of users that have 

provided feedback for a particular app. Staff used this feature to estimate price level popularity 

for the Apple apps, and as a second estimate of app popularity for the Android apps, by 

repeating the calculations described above substituting the number of feedbacks for downloads.

Developer Websites

Both the Apple App Store and the Android Market provide a specified field on the app 

store promotion page for developers to list their website. Although some app store promotion 

pages additionally listed web addresses in other places (such as the text of the app description), 

staff restricted its review to the landing page of the developer website address listed in the 

developer web address field. Staff found that a sizeable number of the website addresses listed 

in the developer web address field did not lead to relevant or functioning websites.

Of the 400 randomly selected “kids” app promotion pages reviewed by staff, 43 (11%) 

did not list a web address in the specified field for developer website; 17 (4%) listed a web 

address that staff was unable to examine; and 10 (3%) listed a web address that either led 

back to the app promotion page, or was not related to the app or developer in any apparent 

way. Staff was unable to examine websites when they encountered problems including: error 

messages (such as “site not found” or “site under construction” messages); never-ending 

redirects; “access forbidden” messages; and one Facebook page that required the visitor to be 

logged into Facebook in order to access the webpage. In addition, 5 (1%) of the web addresses 

led to websites that were entirely in a foreign language (even though staff used an English 
A5

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

language browser and browsed US app stores), and therefore were not counted. In the end, 

324 (81%) of the 400 “kids” app promotion pages listed a web address in the specified field 

that led to a functioning and relevant English language webpage.

Web Addresses in the Standardized Locations in the Apple App Store

The Apple App Store desktop version provides developers with standardized locations on 

each app’s promotion page for placing links to the developer’s website, a support site, and an 

application license agreement. Most Apple app store promotion pages in the survey contained 

a link to a developer website (469 out of 480, or 97.7%), and all of the pages contained a link 

to a support website. A few contained a link to an application license agreement (6 out of 480, 

or 1.3%). As stated above, 61% of the promotion pages listed the same address for both the 

developer’s website and the support website. Staff did not look at the remaining 39%; it is 

possible that more of the pages linked to additional privacy disclosures or developer contact 

information.

Other Websites

Reviewers also noted any web addresses listed on the app promotion pages outside of 

the app store standardized locations. While a number of developers used their app description 

space on the page to encourage readers to like them on Facebook, or follow them on Twitter, 

only 8% of the 400 app promotion pages reviewed by staff provided an address to an additional 

website.

Android Permissions Language

Below is a list of the Android disclosures identified in Table 7 of the report, taken 

verbatim from the app promotion pages encountered in this survey. While each disclosure is 

reported in its entirety, the list is not exhaustive of those used in the Android Market or found 

in the samples associated with this report.

● “Network communication > full Internet access > Allows an application to create 

network sockets.”

● “Phone calls > read phone state and identity > Allows the application to access the 

phone features of the device. An application with this permission can determine the phone 

number and serial number of this phone, whether a call is active, the number that call is 

connected to and the like.”

● “Modify/delete SD card contents > Allows an application to write to the USB storage. 

Allows an application to write to the SD card.”
A6

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

● “Your location > coarse (network-based) location > Access coarse location sources 

such as the cellular network database to determine an approximate device location, where 

available. Malicious applications can use this to determine approximately where you are.”

● “Your location > fine (GPS) location > Access fine location sources such as the Global 

Positioning System on the device, where available. Malicious applications can use this to 

determine where you are, and may consume additional battery power.”

● “Hardware controls > take pictures and videos > Allows application to take pictures 

and videos with the camera. This allows the application at any time to collect images the 

camera is seeing.”

● “Services that cost you money > directly call phone numbers > Allows the application 

to call phone numbers without your intervention. Malicious applications may cause 

unexpected calls on your phone bill. Note that this does not allow the application to call 

emergency numbers.”

● “System tools > modify global system settings > Allows an application to modify the 

system’s settings data. Malicious applications can corrupt your system’s configuration.”

● “Hardware controls > record audio > Allows application to access the audio record 

path.”

● “Your personal information > read sensitive log data > Allows an application to read 

from the system’s various log files. This allows it to discover general information about 

what you are doing with the device, potentially including personal or private information.”

Implications of Methodology and Interpretation of Results

Survey designs inevitably make tradeoffs; presenting evidence in ways that shed the most 

light on some questions necessarily leave other issues unaddressed. Searching the app stores 

using the word “kids” is a transparent methodology that works in both app stores and generates 

a diverse and relevant set of results; however, it is important to bear in mind the following 

implications of the survey design:

The first 480 apps returned by each query3 were given both equal importance and equal 

likelihood of inclusion in the random sample. This means that the report’s findings relate 

to overall performance from the field of apps for kids, rather than giving extra weight to 

those with more downloads.

3. Searches on the Android Market only yield 480 accessible results. Staff considered all 480 Android Market 

results, and truncated the results from the Apple App Store to 480 in order to make the samples comparable.
A7

Mobile Apps for Kids: Current Privacy Disclosures are Dis appointing

Staff did not remove the small handful of apps from the random sample that may not 

be intended for kids. However, these non-kid apps are rare enough that excluding them 

would not significantly change the report’s findings.

The algorithms responsible for returning search results differ between the Android 

Market and the Apple App Store, which likely rely on keywords and other information to 

render search results.4 Staff is not privy to the precise formulas, and using other search 

terms or selecting apps in different ways might generate somewhat different results.

These issues suggest exercising caution in claiming that the percentages found in the 

report extend to samples of apps beyond that used by this report. However, none of these 

issues change the conclusion that kids’ app promotion pages that make few disclosures are 

widespread and easy to find.

4. For this reason, it is not surprising that only 61.5% of the Apple app promotion pages and 72.5% of the 

Android app promotion pages indicated they were intended to be used by “kids.”