Even ‘Child-Friendly’ Apps Routinely Share Data

A study recently published in JAMA Pediatrics reported that about two-thirds of apps played by a cohort of young children transmitted user information to third parties for advertising purposes. Though the study focused on entertainment apps used by healthy preschoolers, the findings that federal privacy rules for apps are not being enforced should serve as a red flag for mental health professionals who treat children.

Under the Children’s Online Privacy Protection Act (COPPA), platforms and creators of digital products must obtain verifiable consent from parents before collecting and sharing personally identifiable information from children under age 13 from a phone or other device. Many apps used by children can circumvent COPPA regulations by claiming they are meant for a general audience, but Jenny Radesky, M.D., a professor of pediatrics at the University of Michigan Medical School, found that even apps billed as “child friendly” run afoul of COPPA.

Radesky and colleagues assessed data from an ongoing longitudinal study of how mobile media use affects development and behavior in preschool-aged children. As part of that study, parents were instructed to download a passive sensing app onto in their devices, which logged when and for how long apps were being used over a nine-day period. Radesky’s analysis included 124 preschoolers who used Android devices (her team’s transmission testing software is Android based); together this group of children used 451 apps.

Of the apps tested by the preschoolers, 303 (67%) transmitted some information (such as device location or device serial number) to one or more third parties. While apps designated as “Designed for Families (DFF)” by Google were better, they were far from perfect; 56% of DFF apps still transmitted some data, compared with 73% of non-DFF apps.

Radesky told Psychiatric News that the data transmitted on younger children’s app activities typically include such information as how often they use the app, how often they make in-app purchases, and how often they answer things correctly or wrong. “As children get older, however, they start sharing more personal items about themselves through games or social media, which increases the sensitivity of the transmitted information,” she said.

The data gleaned from mental health apps may be even more personal. “These apps promise to help you manage your health condition or motivate behavior change, but that involves inputting very private information,” she said. “I worry that children’s psychological vulnerabilities—say, anxiety or body image concerns—are passively manifested in some online behaviors, such as which videos they watch.” Third parties acquiring data from apps might exploit such behavior for advertising gains—such as selling diet products.

Data suggest many mental health apps share data with third parties in a similar manner to entertainment apps, said John Torous, M.D. He is the director of digital psychiatry at Beth Israel Deaconess Medical Center in Boston and a member of APA’s App Advisor Expert Panel.

In 2019, Torous and colleagues published a study showing that nearly 90% of the top-ranked free apps for depression or smoking cessation transmitted data to analytics or advertising services by Facebook or Google. Less than half of these apps fully disclosed this information in their privacy policy.

“When discussing apps with families, I always go with the basic assumption that the child’s data will be transmitted somewhere, and that becomes part of the risk-benefit analysis when we decide if a certain app might be helpful in therapy,” said Meredith Gansner, M.D., a child and adolescent psychiatrist at Boston area’s Cambridge Health Alliance and an instructor at Harvard Medical School. “It’s akin to the side effects of a medication, although in this case we are not sure of the outcome since we don’t exactly know what the companies are doing with the user data. That uncertainty is actually the scary part.”

Still, as an attending psychiatrist at a safety-net health system, Gansner knows that apps can be a valuable tool for families with fewer resources, so she does not dismiss apps as an option for any child, regardless of age.

Radesky said that in general, she has stopped recommending commercially available apps (including pediatric mental health apps such as behavior trackers or visual timers for children with autism spectrum disorder) in her clinical practice.

Before recommending apps to patients, she recommends physicians first vet data transmission details as best they can. “This information is intentionally obscured for consumers, so even a thorough reading of an app’s privacy policy won’t give you all the answers.”

She said physicians at large hospitals or academic centers might check whether their information technology personnel would offer to vet potential apps. Physicians and parents can also find children’s app reviews on advocacy sites such as Common Sense Media or databases from digital privacy watchdogs; for instance, researchers at the University of California, Berkeley, recently set up a website called AppCensus that tests what type of data is being shared by a variety of apps, including mental health apps.

Another option is APA’s new App Advisor tool. Torous said that an independent reviewer recently evaluated several app evaluation models and found that APA’s tool offers a robust assessment of privacy risks compared with others. ■

“Data Collection Practices of Mobile Applications Played by Preschool-Aged Children” is posted here.

“Assessment of the Data Sharing and Privacy Practices of Smartphone Apps for Depression and Smoking Cessation” is posted here.