Most children's apps sent data in ways COPPA restricts

The short answer

A 2018 technical study scanned thousands of popular free children's apps and found that a majority appeared to handle children's data in ways likely to breach the US rule meant to protect it, mostly through third-party advertising and analytics tools bundled inside the apps rather than through anything a parent could see by using the app. This is evidence about the technical plumbing behind free apps, not a verdict on any single app you already use.

What the evidence says

The study, by Irwin Reyes and colleagues at the International Computer Science Institute, was published in Proceedings on Privacy Enhancing Technologies in 2018. The researchers built an automated dynamic analysis system that installs and runs an app while recording exactly what data it sends, to whom, and how, then applied it to 5,855 of the most popular free children's apps on Android. Rather than reading privacy policies, the method observed actual network traffic and code behaviour while each app ran. The team found that 19% of the apps collected identifiers or other personal information through third-party software development kits, or SDKs, whose own terms of service explicitly prohibited that use in apps aimed at children. Among apps that transmitted a resettable advertising identifier, the kind a user can reset or limit, 66% also transmitted a separate, non-resettable identifier that persists regardless of a user's settings.

For context

This is a technical measurement, not a legal ruling: the researchers describe the behaviour as likely, not confirmed, to violate the Children's Online Privacy Protection Rule, which the FTC's own site describes, as retrieved on 16 September 2026, as requiring operators of child-directed apps to meet specific requirements before collecting personal information from children under 13; it is the FTC, not this study, that enforces actual violations. The pattern often traces back to how third-party SDKs are configured deep inside an app's code, sometimes without the developer fully realising what a bundled advertising tool is doing, part of why the study frames this as a scale problem rather than a story about careless developers. The study also cannot tell a parent whether a specific app still behaves the way it did when tested in 2018, since app behaviour and SDK terms both change over time.

A practical next step

For apps you are unsure about, checking whether the developer publishes a specific children's privacy policy, rather than a general one, and preferring apps with fewer embedded ad networks, are reasonable ways to reduce exposure while broader enforcement continues.

• Does this app's store listing say anything specific about data collection from children?
• Could we choose a paid or ad-free version of an app our child uses often?
• Do our device's own privacy settings limit ad tracking and identifiers by default?

The scale of this finding, thousands of apps rather than a handful, is the detail worth remembering: this describes an industry-wide pattern in how children's apps were built and monetised, not a small number of bad actors easily avoided by looking harder at one app's icon.