Most kids' apps, websites collect and share personal information

Most apps and websites for children collect personal information such as photos and addresses, and many say they may share that information with third parties, an annual global privacy survey suggests.

Privacy advocates are concerned about children's online privacy because of the potential for young people to be lured by online predators or bullied over information they disclose online. 

The third annual privacy sweep by enforcement organizations in 21 countries, including federal and provincial agencies in Canada, examined 1,494 apps and websites such as games, educational and social media websites, and apps, and sites hosted by children-friendly organizations like museums and zoos that either:

• Targeted children specifically.
• Didn't target kids specifically but are popular among children.

The study Global Privacy Enforcement Network found:

• 67 per cent of websites and apps surveyed collected personal information such as names, photos, addresses and phone numbers or via a chat function. Some of the worst offenders were music websites such as taylorswift.com and justinbiebermusic.com.
• 51 per cent indicated they may disclose personal information to a third party.
• 71 per cent had no simple way to delete account information.
• 58 per cent sometimes directed children to other sites, often via contests or ads, including some that were inappropriate for children, such as those promoting dating websites and alcoholic beverages.

Different agencies used various criteria for choosing apps and websites to survey.

The Office of the Privacy Commissioner Canada, which looked at 172 of the sites and apps, relied on the website and app ranking service Alexa as well as app review sites such as bestappsforkids.com, parenting.com, and Common Sense Media.

• Social media privacy being taught in high school
• Parents struggle to monitor children's online encounters
• Social media websites ignoring privacy laws, privacy commissioner says

The apps and websites evaluated by OPC employees and their children during the sweep from May 11 to 15 included many based in Canada.

"Too many developers are collecting particularly sensitive personal information such as photos, videos and the location of children, and often allowing it to be posted publicly, when there are clearly ways to avoid it," said Privacy Commissioner Daniel Therrien in a statement.

He suggested that so many websites indicated they might disclose personal information to third parties because that information was used for the purposes of advertising.

He questioned the appropriateness of tracking children for such purposes.

In a blog post, the OPC criticized Santasvillage.ca, the site for the Bracebridge, Ont., amusement park, for asking children for their full names and email addresses in exchange for an easy way to "get on Santa's nice list" — and an email marketing list.

Just 24 per cent of apps and websites surveyed got parents involved, such as by sending them an email when their child signed up. And only 14 per cent had a dashboard where parents could adjust security and privacy settings.

Hot or not?

Some sites were better than others – Therrien said a small number of apps and websites didn't collect any personal information at all, "demonstrating it is possible."

Some had protective features such as pre-set usernames to stop children from using their own names on the Harry Potter fan site pottermore.com . Both family.ca and Lego.com rejected message board posts that appeared to disclose name, age and location information. But others, such as Moviestar Planet, a social networking app targeted at children, let users post such personal information, along with selfies with titles like "hot or not?"

In general, apps and websites specifically targeted at children were much better than those that were popular with children – those conducting the survey said they felt comfortable allowing children to use 77 per cent of the targeted websites and apps, but only 46 per cent of the less targeted ones.

Some sites popular with children that collected or posted large amounts of personal information included music fan sites such as justinbieber.com and teen social networking site gurl.com.

The apps and websites surveyed by the Office of the Privacy Commissioner of Canada were a little less likely to collect personal information and were more likely to have a way to permanently delete account information than the worldwide average.  However, they were more likely to indicate they disclose information to third parties.

Therrien said parents and teachers need to be aware of digital privacy issues and share their knowledge with children. The OPC has an online privacy tip sheet for children and their parents and a classroom activity to help teachers.

In March, it also released tips for organizations such as app and website makers that collect information from young people.