Media & Entertainment

Google removes 3 Android apps for children, with 20M+ downloads between them, over data collection violations

Comment

Image Credits: Libii (opens in a new window)

When it comes to apps, Android leads the pack with nearly 3 million apps in its official Google Play store. The sheer volume also means that sometimes iffy apps slip through the cracks.

Researchers at the International Digital Accountability Council (IDAC), a nonprofit watchdog based out of Boston, found that a trio of popular and seemingly innocent-looking apps aimed at younger users were recently found to be violating Google’s data collection policies, potentially accessing users’ Android ID and AAID (Android Advertising ID) numbers, with the data leakage potentially connected to the apps being built using SDKs from Unity, Umeng and Appodeal.

Collectively, the apps had more than 20 million downloads between them.

The three apps in question — Princess Salon​, Number Coloring and ​Cats & Cosplay — have now been removed from the Google Play app store, as you can see in the links above. Google confirmed to us that it removed the apps after IDAC brought the violations to its attention.

“We can confirm that the apps referenced in the report were removed,” said a Google spokesperson. “Whenever we find an app that violates our policies, we take action.”

The violations point to a wider concern with the three publishers’ approach to adhering to data protection policies. “The practices we observed in our research raised serious concerns about data practices within these apps,” said IDAC president Quentin Palfrey.

The incident is being highlighted at a time when a lot of attention is being focused on Google and the size of its operation. Earlier this week, the U.S. Department of Justice and 11 states sued the company, accusing it of monopolistic and anticompetitive behavior in search and search advertising.

The Justice Department has filed its antitrust lawsuit against Google

To be clear, the app violations here are not related to search, but they underscore the scale of Google’s operation, and how even small oversights can lead to tens of millions of users being affected. They also serve as a reminder of the challenges of proactively policing individual violations on such a scale, and that those challenges can land in a particularly risky area: how minors use apps.

At least in the case of two of the publishers, Creative APPS and Libii Tech (whose apps are built around the cast of characters illustrated at the top of this story), other apps are still live. And it also appears that versions of the apps are also still downloadable through APK sites (like this one). There are also versions on iOS (for example here), but IDAC’s tech team said that in an initial analysis, it didn’t immediately see analogous concerns, but will continue to monitor the situation.

The violation in this case is complex but is an example of one of the ways that users can unknowingly be tracked through apps.

Pointing to the behind-the-scenes activity and data processing that gets loaded into innocent-looking apps, IDAC highlighted three SDKs in particular used by the app developers: the Unity 3D and game engine, Umeng (an Alibaba-owned analytics provider known as the “Flurry of China” that some have described also as an adware provider) and Appodeal (another app monetization and analytics provider) — as the source of the issues.

Palfrey explained that the problem lies in how the data that the apps were able to access by way of the SDKs could be linked up with other kinds of data, such as geolocation information. “If AAID information is transmitted in tandem with a persistent identifier [such as Android ID] it’s possible for the protection measures that Google puts in place for privacy protection to be bridged,” he said.

Mine raises $9.5M to help people take control of their personal data

IDAC did not specify the violations in all of the SDKs, but noted in one example that certain versions of Unity’s SDK were collecting both the user’s AAID and Android ID simultaneously, and that could have allowed developers “to bypass privacy controls and track users over time and across devices.”

IDAC describes the AAID as “the passport for aggregating all of the data about a user in one place.” It lets advertisers target ads to users based on signals for preferences that a user might have. The AAID can be reset by users. However, if an SDK is also providing a link to a users Android ID, which is a static number, it starts to create a “bridge” to identify and track a user.

Palfrey would not get too specific on whether it could determine how much data was actually drawn as a result of the violations that it identified, but Google said that it was continuing to work on partnerships and procedures to catch similar (intentional or otherwise) bad actors.

“One example of the work we are doing here is the Families ad certification program, which we announced in 2019),” said the spokesperson. “For apps that wish to serve ads in kids and families apps, we ask them to use only ad SDKs that have self-certified compliance with kids/families policies. We also require that apps that solely target children not contain any APIs or SDKs that are not approved for use in child-directed services.”

IDAC, which was launched in April 2020 as a spin-off of the Future of Privacy Forum, has also carried out investigations into data privacy violations on fertility apps and COVID-19 trackers, and earlier this week it also published findings on data leakage from an older version of Twitter’s MoPub SDK affecting millions of users.

Data brokers track everywhere you go, but their days may be numbered

More TechCrunch

“When I heard the released demo, I was shocked, angered and in disbelief that Mr. Altman would pursue a voice that sounded so eerily similar to mine.”

Scarlett Johansson says that OpenAI approached her to use her voice

A new self-driving truck — manufactured by Volvo and loaded with autonomous vehicle tech developed by Aurora Innovation — could be on public highways as early as this summer.  The…

Aurora and Volvo unveil self-driving truck designed for a driverless future

The European venture capital firm raised its fourth fund as fund as climate tech “comes of age.”

ETF Partners raises €284M for climate startups that will be effective quickly — not 20 years down the road

Copilot, Microsoft’s brand of generative AI, will soon be far more deeply integrated into the Windows 11 experience.

Microsoft wants to make Windows an AI operating system, launches Copilot+ PCs

Hello and welcome back to TechCrunch Space. For those who haven’t heard, the first crewed launch of Boeing’s Starliner capsule has been pushed back yet again to no earlier than…

TechCrunch Space: Star(side)liner

When I attended Automate in Chicago a few weeks back, multiple people thanked me for TechCrunch’s semi-regular robotics job report. It’s always edifying to get that feedback in person. While…

These 81 robotics companies are hiring

The top vehicle safety regulator in the U.S. has launched a formal probe into an April crash involving the all-electric VinFast VF8 SUV that claimed the lives of a family…

VinFast crash that killed family of four now under federal investigation

When putting a video portal in a public park in the middle of New York City, some inappropriate behavior will likely occur. The Portal, the vision of Lithuanian artist and…

NYC-Dublin real-time video portal reopens with some fixes to prevent inappropriate behavior

Longtime New York-based seed investor, Contour Venture Partners, is making progress on its latest flagship fund after lowering its target. The firm closed on $42 million, raised from 64 backers,…

Contour Venture Partners, an early investor in Datadog and Movable Ink, lowers the target for its fifth fund

Meta’s Oversight Board has now extended its scope to include the company’s newest platform, Instagram Threads, and has begun hearing cases from Threads.

Meta’s Oversight Board takes its first Threads case

The company says it’s refocusing and prioritizing fewer initiatives that will have the biggest impact on customers and add value to the business.

SeekOut, a recruiting startup last valued at $1.2 billion, lays off 30% of its workforce

The U.K.’s self-proclaimed “world-leading” regulations for self-driving cars are now official, after the Automated Vehicles (AV) Act received royal assent — the final rubber stamp any legislation must go through…

UK’s autonomous vehicle legislation becomes law, paving the way for first driverless cars by 2026

ChatGPT, OpenAI’s text-generating AI chatbot, has taken the world by storm. What started as a tool to hyper-charge productivity through writing essays and code with short text prompts has evolved…

ChatGPT: Everything you need to know about the AI-powered chatbot

SoLo Funds CEO Travis Holoway: “Regulators seem driven by press releases when they should be motivated by true consumer protection and empowering equitable solutions.”

Fintech lender SoLo Funds is being sued again by the government over its lending practices

Hard tech startups generate a lot of buzz, but there’s a growing cohort of companies building digital tools squarely focused on making hard tech development faster, more efficient and —…

Rollup wants to be the hardware engineer’s workhorse

TechCrunch Disrupt 2024 is not just about groundbreaking innovations, insightful panels, and visionary speakers — it’s also about listening to YOU, the audience, and what you feel is top of…

Disrupt Audience Choice vote closes Friday

Google says the new SDK would help Google expand on its core mission of connecting the right audience to the right content at the right time.

Google is launching a new Android feature to drive users back into their installed apps

Jolla has taken the official wraps off the first version of its personal server-based AI assistant in the making. The reborn startup is building a privacy-focused AI device — aka…

Jolla debuts privacy-focused AI hardware

The ChatGPT mobile app’s net revenue first jumped 22% on the day of the GPT-4o launch and continued to grow in the following days.

ChatGPT’s mobile app revenue saw its biggest spike yet following GPT-4o launch

Dating app maker Bumble has acquired Geneva, an online platform built around forming real-world groups and clubs. The company said that the deal is designed to help it expand its…

Bumble buys community building app Geneva to expand further into friendships

CyberArk — one of the army of larger security companies founded out of Israel — is acquiring Venafi, a specialist in machine identity, for $1.54 billion. 

CyberArk snaps up Venafi for $1.54B to ramp up in machine-to-machine security

Founder-market fit is one of the most crucial factors in a startup’s success, and operators (someone involved in the day-to-day operations of a startup) turned founders have an almost unfair advantage…

OpenseedVC, which backs operators in Africa and Europe starting their companies, reaches first close of $10M fund

A Singapore High Court has effectively approved Pine Labs’ request to shift its operations to India.

Pine Labs gets Singapore court approval to shift base to India

The AI Safety Institute, a U.K. body that aims to assess and address risks in AI platforms, has said it will open a second location in San Francisco. 

UK opens office in San Francisco to tackle AI risk

Companies are always looking for an edge, and searching for ways to encourage their employees to innovate. One way to do that is by running an internal hackathon around a…

Why companies are turning to internal hackathons

Featured Article

I’m rooting for Melinda French Gates to fix tech’s broken ‘brilliant jerk’ culture

Women in tech still face a shocking level of mistreatment at work. Melinda French Gates is one of the few working to change that.

1 day ago
I’m rooting for Melinda French Gates to fix tech’s  broken ‘brilliant jerk’ culture

Blue Origin has successfully completed its NS-25 mission, resuming crewed flights for the first time in nearly two years. The mission brought six tourist crew members to the edge of…

Blue Origin successfully launches its first crewed mission since 2022

Creative Artists Agency (CAA), one of the top entertainment and sports talent agencies, is hoping to be at the forefront of AI protection services for celebrities in Hollywood. With many…

Hollywood agency CAA aims to help stars manage their own AI likenesses

Expedia says Rathi Murthy and Sreenivas Rachamadugu, respectively its CTO and senior vice president of core services product & engineering, are no longer employed at the travel booking company. In…

Expedia says two execs dismissed after ‘violation of company policy’

Welcome back to TechCrunch’s Week in Review. This week had two major events from OpenAI and Google. OpenAI’s spring update event saw the reveal of its new model, GPT-4o, which…

OpenAI and Google lay out their competing AI visions