Study finds ~3,337 free apps in Google Play's Designed for Families program that may violate COPPA, a federal law aimed to protect children from online tracking
Thousands of free apps available in the Google Play store are potentially violating a major federal data-privacy law intended …
Context & Ripple Effects
This 2018 study lands at the start of a multi-year accountability arc for Google's kids-app storefront. Months later, a lawsuit accused Google, Twitter's ad business, and a popular app maker of violating children's privacy law over game-app tracking (a suit that put COPPA enforcement directly on the ad ecosystem), and by mid-2019 Google responded with new Play policies mandating developer compliance with content and ad rules (the policy tightening that followed this scrutiny).
The pattern did not end there: in 2020 Google removed three children's Android apps with 20M+ combined downloads after a nonprofit watchdog flagged their data practices (removals showing enforcement had moved from studies to takedowns), and a 2022 Pixalate analysis found most top children's apps on both stores still send location data to the ad industry (evidence the tracking pipeline outlasted the policy fixes). This study is the baseline measurement that framed everything after it.
First-order effects
- Developers of the ~3,337 flagged free apps face direct legal exposure under COPPA, since the law assigns liability to operators collecting children's data without verifiable consent.
- Google's Designed for Families program — which certifies apps as kid-safe — has its vetting credibility called into question, putting pressure on Google to audit its own badge rather than rely on developer self-attestation.
Second-order effects
- Ad networks whose SDKs are embedded in these free apps become the transmission mechanism for violations, forcing Google to regulate third-party code inside certified apps rather than just app content — the path its 2019 policy changes took.
- Free-to-developers economics come under strain: if COPPA-compliant ads pay less than behaviorally targeted ones, kid-focused developers must choose between revenue and certification, thinning the family-friendly catalog Google is trying to grow.
Third-order effects
- Enforcement gravity shifts from individual app operators to the platforms that distribute and certify them — a structure visible in Google's later takedowns and policy mandates, though Pixalate's 2022 findings suggest platform rules alone have not stopped the underlying data flows.
- Children's privacy becomes a recurring audit category for independent researchers and watchdogs, creating a standing evidence base that regulators and plaintiffs can draw on years after each study publishes.
The trend: Children's app privacy is shifting from per-app COPPA enforcement toward platform-level gatekeeping by Apple and Google, while researcher audits keep showing the ad-data pipeline persists beneath the new policies.