Analysis: Brightwheel, HiMama, and other popular daycare apps lack 2FA and have privacy-compromising features like trackers not disclosed in privacy policies
Context & Ripple Effects
The EFF's findings land in the middle of a research-driven audit wave targeting apps aimed at families: weeks earlier, [[a:979789|Pixalate found most of the 1,000 most popular children's apps were sending ad-industry location data]], and years before that, school software was documented tracking students from classroom to bathroom. The daycare category was the unexamined gap — apps parents check daily and centers run their operations on.
What makes the disclosure problem pointed is the money behind these products: HiMama raised a $70M Series B led by Bain Capital on the strength of its childcare platform, meaning investor-backed growth has outpaced basic security hygiene like two-factor authentication.
First-order effects
- Parents and daycare staff using Brightwheel and HiMama face account-takeover risk today because there is no 2FA protecting accounts that carry photos, schedules, and children's identities.
- Every center relying on these apps is operating under privacy policies that misstate reality, since embedded trackers are collecting data the policies never disclose.
Second-order effects
- Bain Capital and other backers of HiMama now hold an asset whose trust proposition is under public attack, pressuring funded childcare platforms to ship 2FA and audit third-party SDKs ahead of rivals rather than after regulators force them.
- App-store gatekeepers Apple and Google — already flagged by Pixalate for children's apps leaking location data — face renewed pressure to enforce disclosure rules against family-category developers.
Third-order effects
- If the pattern holds across Pixalate's children's-app findings, Mozilla's later flagging of 18 of the top 25 period and pregnancy tracking apps, and the EFF's daycare work, researcher audits become the de facto regulator for family-facing software, with FTC-style COPPA enforcement following where disclosures fail.
- Childcare and edtech platforms may converge on security certifications and disclosed-SDK policies as procurement requirements from centers and school districts, turning privacy hygiene into a competitive moat rather than a compliance cost.
The trend: Research organizations are systematically auditing family-facing apps — childcare, children's games, reproductive health, education — exposing a gap between what these platforms collect and what they disclose, and pulling regulators toward enforcement.