This article first appeared in Cyberlaw Currents, a Frankfurt Kurnit legal blog.
The Federal Trade Commission (FTC) issued a staff report yesterday that says makers of mobile apps directed at children, the app stores that sell them, and certain third parties providing services within apps (e.g., advertisers), are not providing the information that parents need to understand what data the apps collect and how that data is handled. In the report, the FTC also indicates that, during the next six months, the FTC staff will conduct an additional review to determine whether existing privacy regulations (including the Children's Online Privacy Protection Rule) are being violated, and whether new enforcement actions are appropriate. Taken together with recent FTC actions, the staff report is a clear reminder that the FTC regards the protection of children's privacy as a crucial issue, and serves as a warning that additional enforcement efforts relating to mobile apps and children's privacy are likely to be imminent.
The staff report, entitled "Mobile Apps for Kids: Current Privacy Disclosures are Disappointing," focuses on a FTC staff survey of hundreds of apps offered for children in the two largest app stores: Apple's App Store, and Google's Android Market. According to the report, FTC staffers found little, if any, information in the app stores about the data collection and sharing practices of the apps being sold. In most instances, FTC staffers were unable to determine from the app store promotion pages alone whether the apps collected any data at all, let alone what was collected, why it was collected, and who may have access to it.
The report also notes that mobile apps can automatically capture and transmit a broad range of user information from a mobile device, including address book information, call logs, geolocation, and other data stored on a mobile device, often without a user's knowledge. This finding is consistent with recent news reports.
In the staff report, the FTC indicates that:
- App developers should provide key information through "simple and short disclosures or icons that are easy to find and understand on the small screen of a mobile device" so that parents can "learn what information an app collects, how the information will be used, and with whom the information will be shared."
- If an app connects with any social media, or allows targeted advertising through the app, or includes in-app purchasing features, developers should alert parents to those features.
- Third parties that collect user information through apps (such as advertisers) should "disclose their privacy practices, whether through a link on the app promotion page, the developers' disclosures, or another easily accessible method."
The FTC report also urged app stores to provide new functionalities that will enable developers to display information regarding their apps' data collection practices and details regarding interactive features included in the apps, so that parents will have an opportunity to review these practices and features prior to downloading an app. Although Apple and Google are the operators of the two largest app stores, the FTC specifically noted that its guidance on this point applies to other companies as well.
The FTC noted in the report that it plans to host a public workshop later this year to gain input from interested parties about online advertising disclosures, and to update its existing business guidance, "Dot Com Disclosures". One of the topics that will be addressed is mobile privacy disclosures.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
