“We may share the number of diaper changes”: A Privacy and Security Analysis of Mobile Child Care Applications

Abstract

Mobile child care management applications can help child care facilities, preschools, and kindergartens to save time and money by allowing their employees to speed up everyday child care tasks using mobile devices. Such apps often allow child care workers to communicate with parents or guardians, sharing their children’s most private data (e. g., activities, photos, location, developmental aspects, and sometimes even medical information). To offer these services, child care apps require access to very sensitive data of minors that should never be shared over insecure channels and are subject to restrictive privacy laws. This work analyzes the privacy and security of 42 Android child care applications and their cloud-backends using a combination of static and dynamic analysis frameworks, configuration scanners, and inspecting their privacy policies. The results of our analysis show that while children do not use these apps, they can leak sensitive data about them. Alarming are the findings that many third-party (tracking) services are embedded in the applications and that adversaries can access personal data by abusing vulnerabilities in the applications. We hope our work will raise awareness about the privacy risks introduced by these applications and that regulatory authorities will focus more on these risks in the future.

Assessing the Security and Privacy of Baby Monitor Apps

“…Since we did not attempt to reverse-engineer encoding or obfuscation attempts of data transmission, which we were unable to interpret, we did not consider those data in our evaluation. However, we identified multiple privacy leaks, which aligns with the results of previous research exploring mobile applications for mHealth or childcare [11,15].…”

“…In line with previous studies exploring the privacy of mobile applications containing sensitive data, such as COVID-19 contact tracing apps [22], mHealth apps [11], or childcare apps [15], we utilized several measures to evaluate the privacy implications of baby monitoring apps. Adapting from the different methodologies of previous work, we carried out the following steps to assess the privacy impact of each baby monitor app:…”

“…Another study examines childcare mobile apps, showing that their privacy policies may not be clear about data practices. Additionally, some of the solutions examined rely on insecure cloud storage for the collected data [15], threatening the privacy of children's data.…”

Wisdom of the Masses? Users and Educators Contrasting Perspectives on the Data Privacy and Safety of Early Years’ Apps

“…This is even more troubling in light of parental erratic behaviour regarding apps and digital resources their children consume. Becoming a digital citizen in such a context is highly problematic, for the youngest people never control or decide the type of data circulated to third parties that might be used in the future (Gruber et al, 2022).…”