Apple and Google challenged by parents’ rights coalition on youth privacy protections

Apple and Google challenged by parents’ rights coalition on youth privacy protections

A nonprofit organization has filed a formal complaint with the Federal Trade Commission, claiming Google’s business practices around children and teenagers violates U.S. privacy laws and constitutes unfair and deceptive practices.

The complaint, filed by the Digital Childhood Institute, lays out five core claims against the tech giant: that it “knowingly” markets adult-themed or age-restricted apps as safe for children, facilitates “exploitative” contracts between children and app developers in Google’s Play Store, “widespread” violations of the Children’s Online Privacy Protection Act (COPPA), billing for in-app purchases made by children without parental consent and decoupling parental control of child accounts after the age of 13.

Those core charges are nearly identical to a similar FTC complaint filed by the nonprofit against Apple this past August, but in a letter to the commission, the group claims that Google has unique flaws worth highlighting.

“For example, Google uses no human moderation in its initial rating of apps, relying instead on an automated survey by the International Age Rating Coalition (IARC) that takes only minutes to complete,” the nonprofit wrote in an unsigned letter.

The complaint further alleges that Google’s failure to police the Play Store violates a 2014 consent decree with the FTC. It cites research by the Canadian Centre for Child Protection in 2022 that the Play Store “markets apps such as Threesome, Kinkoo, and Hinge as appropriate for 17-year-olds, even though the developers of those apps stated in their terms of service that the user needed to be 18 to use the app.”

According to an Oct. 15 blog post by the Digital Childhood Alliance, a lobbying group that includes the Digital Childhood Institute and dozens of similar organizations, both Apple and Google have agreed to change their internal tools to “verify users’ ages, require parental consent before minors can download or purchase apps, and share limited, privacy-preserving age data with developers” in three states that have since passed age verification laws. The group is now pushing for nationwide adoption across all 50 states.

“Parents will finally have a real say before their children agree to complex contracts with trillion-dollar companies and enter digital spaces built for adults,” the blog stated.  

Google did not respond to a request for comment on the complaint.

A newer crop of online safety groups

Nonprofits like the Digital Childhood Institute are part of a newer, conservative-leaning crop of child safety and privacy groups that have sprung up over the past decade. Their work often criticizes  technology and social media companies for contributing to rising mental health problems among youth, including depression, anxiety and self-harm, and their policy proposals  aim to give parents and users protections around data privacy and consent.

The Digital Childhood Institute was founded by Melissa McKay, a mother of five from Utah. She said she started the group in 2017 after hearing “disturbing stories about children being exploited on smartphones” and describing  online app stores as “entirely unregulated” and “like the Wild West.” McKay recounted setting up a test child account and was “flooded with direct messages from predators within minutes of posting a simple cartoon selfie.”

“Their age ratings were deceptive, and parental controls were riddled with loopholes,” McKay wrote in August. “Social media apps, rated safe for 12-year-olds, were anything but safe. Hardcore porn was easily accessible to kids of all ages.”

McKay has helped shape online age verification laws, including those passed in Utah that serve as national models for parent rights groups. She also contributed to a May bill from Sen. Mike Lee, R-Utah, that would require parental consent and control for all online accounts operated by “minors,” a term that could include users 18 years or older, depending on state laws.

One of the biggest differences between these newer child safety groups and older privacy groups is around the role of parental consent and control. While the DCI and other conservative groups argue that parents fill a crucial role in curating the content their children watch and engage in, academic privacy scholars have long noted that laws like COPPA blur the concepts of parental control and child privacy in problematic ways.

Those concerns were spelled out nearly 25 years ago by scholars like Anita Allen, a privacy expert, attorney and longtime professor at the University of Pennsylvania Law School. In a 2001 Texas Law Review article published a year after COPPA’s passage, Allen wrote that the law is both “Internet privacy law, governing the commercial sector and the market for information” and “also family law, governing young families in the combined interests of child welfare and parental autonomy.”

But while consumer privacy advocates “generally accept the paternalism implicit” in some child privacy laws around educational and medical records, laws like COPPA are “more controversial” because they create a tension between the rights of parents and children when it comes to accessing information.

“COPPA places parents and the government between children and the World Wide Web-the single most powerful source of knowledge and vehicle of communication of all time,” Allen wrote.

Another key difference from traditional privacy groups is that these organizations combine digital privacy policy and conservative cultural beliefs, such as the view that exposing children to same-sex or transgender-related content is harmful.The Digital Childhood Institute was one of numerous groups that attended an FTC workshop this past summer titled “The Attention Economy: How Big Tech Firms Exploit Children and Hurt Families.”

McKay spoke on a panel about age verification laws as “the future of the Internet,” and according to Georgetown privacy researchers Meg Leta Jones, Abby Rochman and Celeste Valentino, the FTC complaints filed against Apple and Google were “directly responsive” to the agenda set at the workshop.

Other legislation promoted at the workshop included the Kids Online Safety Act (KOSA) sponsored by Sen. Marsha Blackburn, R-Tenn., which would allow parents to sue tech companies that don’t adequately shield children from harmful online content. In a 2023 video, Blackburn touted KOSA while saying that “protecting minor children from the transgender in this culture” was one of the top priorities of conservative lawmakers.

In May, Blackburn reintroduced a version of KOSA that is co-sponsored by Senate Majority Leader John Thune, R-S.D., Senate Minority Leader Chuck Schumer, D-N.Y., and Sen. Richard Blumenthal, D-Conn. Blackburn’s release also cited the endorsement of dozens of parents rights groups and parents of suicidal teens alongside conservative think tanks like the Heritage Foundation and American Compass. 

As the Brookings Institution’s Nicol Turner Lee and Brooke Tanner noted in July, this approach differs from traditional online privacy groups like the Electronic Frontier Foundation and the American Civil Liberties Union, which tend to focus on mostly technical and policy solutions that maximize individual privacy for users.

“This shift in focus — from protecting minors from addictive content to shielding them from areas steeped in ideological differences — is a more recent injection into the broader debate,” Turner Lee and Tanner wrote.

Written by Derek B. Johnson

Derek B. Johnson is a reporter at CyberScoop, where his beat includes cybersecurity, elections and the federal government. Prior to that, he has provided award-winning coverage of cybersecurity news across the public and private sectors for various publications since 2017. Derek has a bachelor’s degree in print journalism from Hofstra University in New York and a master’s degree in public policy from George Mason University in Virginia.



Source link

About Cybernoz

Security researcher and threat analyst with expertise in malware analysis and incident response.