IMDEA Networks Institute Publications Repository

“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale

Reyes, Irwin and Wijesekera, Primal and Reardon, Joel and Elazari Bar On, Amit and Razaghpanah, Abbas and Vallina-Rodriguez, Narseo and Egelman, Serge (2018) “Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale. In: The 18th Privacy Enhancing Technologies Symposium (PETS 2018), 24–27 July 2018, Barcelona, Spain.

[img] PDF (“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale) - Published Version
Download (5Mb)


We present a scalable dynamic analysis frame- work that allows for the automatic evaluation of the privacy behaviors of Android apps. We use our system to analyze mobile apps’ compliance with the Children’s Online Privacy Protection Act (COPPA), one of the few stringent privacy laws in the U.S. Based on our auto- mated analysis of 5,855 of the most popular free children’s apps, we found that a majority are potentially in violation of COPPA, mainly due to their use of third- party SDKs. While many of these SDKs offer configuration options to respect COPPA by disabling tracking and behavioral advertising, our data suggest that a majority of apps either do not make use of these options or incorrectly propagate them across mediation SDKs. Worse, we observed that 19% of children’s apps collect identifiers or other personally identifiable information (PII) via SDKs whose terms of service outright prohibit their use in child-directed apps. Finally, we show that efforts by Google to limit tracking through the use of a resettable advertising ID have had little success: of the 3,454 apps that share the resettable ID with advertisers, 66% transmit other, non-resettable, persistent identifiers as well, negating any intended privacy-preserving properties of the advertising ID.

Item Type: Conference or Workshop Papers (Paper)
Uncontrolled Keywords: Web tracking, measurement, user privacy, JavaScript APIs, HTTP cookies.
Depositing User: Narseo Vallina
Date Deposited: 11 Apr 2018 13:54
Last Modified: 23 Apr 2018 11:04

Actions (login required)

View Item View Item