“Won’t Somebody Think of the Children?” Examining COPPA Compliance at Scale

Abstract

We present a scalable dynamic analysis framework that allows for the automatic evaluation of the privacy behaviors of Android apps. We use our system to analyze mobile apps’ compliance with the Children’s Online Privacy Protection Act (COPPA), one of the few stringent privacy laws in the U.S. Based on our automated analysis of 5,855 of the most popular free children’s apps, we found that a majority are potentially in violation of COPPA, mainly due to their use of thirdparty SDKs. While many of these SDKs offer configuration options to respect COPPA by disabling tracking and behavioral advertising, our data suggest that a majority of apps either do not make use of these options or incorrectly propagate them across mediation SDKs. Worse, we observed that 19% of children’s apps collect identifiers or other personally identifiable information (PII) via SDKs whose terms of service outright prohibit their use in child-directed apps. Finally, we show that efforts by Google to limit tracking through the use of a resettable advertising ID have had little success: of the 3,454 apps that share the resettable ID with advertisers, 66% transmit other, non-resettable, persistent identifiers as well, negating any intended privacy-preserving properties of the advertising ID.

Security and Privacy Analyses of Internet of Things Children’s Toys

“…By doing so, it provides a glimpse into how IoT toy developers' practices can fail to match their own privacy promises or adhere to federal regulations. These results corroborate the findings of Reyes et al [18] that many Android applications targeted toward children are potentially in violation of COPPA.…”

No boundaries: data exfiltration by third parties embedded on web pages

“…More recent studies include detection of PII leakage to third parties in mobile apps [11][12][13], in enterprise network traffic [14], PII leakage in contact forms [15], and data leakage due to browser extensions [16]. In our paper we discover PII exfiltration by tracking scripts that misuse login managers (Section 4), social APIs (Section 5) and session replay scripts (Section 6).…”

“…Starov et al apply differential testing, that is, varying the PII entered into the system and detecting the resulting changes in information flows [15]. Brookman et al [17], Starov et al [16], Ren et al [21] and Reyes et al [13] test combinations of encodings and/or hashes, which is most similar to the approach we take in Section 3.4.…”

CanaryTrap: Detecting Data Misuse by Third-Party Apps on Online Social Networks

“…A large body of prior work has focused on detecting leakage of user data on the client-side (e.g., mobile apps, web browsers) to online trackers and advertisers [37, 38, 44, 46, 47, 49, 60-63, 69, 72]. First, some prior work has focused on detecting data leakage in mobile apps through network traffic analysis [60][61][62][63]69]. For example, Ren et al [61] showed that more than 50% of the 100 most popular mobile apps leak personally identifiable information (PII).…”