Hey, parents: Advertisers could be using mobile games to build profiles about your kids

CBC

07-03-2025

A small cube snakes around a blank canvas, trying to paint as much space as possible and eliminate other cubes trying to do the same.
It's called Paper.io 2 and is one of the games nine-year-old Jamie Dermody plays most often on his tablet in his Toronto home.
Jamie's mother, Sarah Dermody, says she tries to protect him in a world full of screens with thousands of apps at his fingertips. She says she checks the app store rating of each game he asks to download and monitors his screen time.
"You're trying to do your best as a parent," she said. "There's always that fear … there could be a misstep."
A Marketplace investigation has pulled back the curtain on how some mobile games, which seem to attract children, use loopholes in rules protecting kids' data — allowing marketers to build advertising profiles tailored to them, which can then be more effective at influencing their behaviour.
Not only that, but some games also collect the device's location, which some companies buy, sell and use for targeted advertising. The data is sold with the promise of being anonymous and free of children's information, but Marketplace was able to track down a child using a data sample it received from a company that collects location data.
Games in the Google Play store and Apple's App store are supposed to follow American and European laws that prohibit collecting children's personal information without parental consent, but experts say game developers are easily getting around the rules by putting age restrictions in the games' fine print.
Marketplace looked at 20 of the most popular games in the two app stores to see how often a game's content rating in mobile app stores would differ from the developer's privacy policy.
Marketplace found the privacy policies of many of the games said they were only suitable for players aged 13 and up, while the content rating in the app stores, such as E for everyone, suggests the games are appropriate for younger players.
Since most parents look at the app store rating and not an individual game's privacy policy, many children could be playing games that are collecting their data without parents realizing it.
Though there are federal laws in place to protect people's privacy, researchers say Canada's legislation hasn't kept pace with technology and has no specific protections for children.
"Would you accept that when your kid is playing, there are 10 adults around with pads, noting how he's behaving, where he is, what he's doing? It's the same thing," says Maude Bonenfant, a Canada Research Chair on Gaming, Technologies and Society.
"There's an economic model based on the data and the companies need the data, so that's the money … it is really scandalous that it is so easy to get information from the kids like this."
Age ratings on games in app stores aren't what they seem
When some apps are downloaded, they can immediately start collecting information about you — or, in this case, your kids — ranging from details about the device to details about you and your location.
As you play, more data gets collected. Some of it is innocuous and there to help keep the game running properly, while other data may include personal information about the player and make inferences about their personality and interests.
All that data from different sources gets combined to create a profile on the user — one they'll never see but can be shared or sold to marketers, data brokers and other third parties looking to learn things about the person playing.
Bonenfant and Sara Grimes, a University of Toronto professor in the faculty of information who also researches data privacy in games, both say the issue of advertisers collecting kids' data is widespread.
WATCH | How mobile games keep kids playing and what they do to kids' brains:
Research by one tech company, SuperAwesome, says by the time a child is 13, more than 72 million pieces of personal data will have been captured about them.
"It's daunting. I can't imagine having that much data collected about me and I'm a quasi-public figure … but not when I was three and when I was 13," Grimes said.
In their privacy policies or terms of service, many apps claim the games are for people over 13 and they don't knowingly collect personal information from people younger than that, in line with privacy legislation in the United States that forbids harvesting personal data from anyone younger than 13 without parental consent. Privacy legislation in the European Union has similar measures, with restrictions that go as high as anyone under 16, depending on the country.
But Bonenfant says that doesn't protect children from playing those games because parents often don't look, or know to look, at the fine print. Instead, they likely rely on the first piece of information they see: what's displayed in the mobile app stores.
The App Store and Google Play store have age ratings for games, but those ratings only consider the maturity of the content in the game, not the privacy implications of playing it. The developers behind the games don't determine the ratings in the app stores.
So those ratings don't always match up, but kids or their parents may not know that. Of the 20 games Marketplace looked at in the App Store and Google Play store, there were numerous inconsistencies. In the App Store, nine games had an age rating that didn't match the ages listed in the privacy policy. In the Google Play store, 12 games had an age rating different from what's in the privacy policy.
"Ratings in app stores are almost meaningless and they're continuously contradicted by the age in privacy policy," said Grimes. "It makes no sense."
Dermody was "shocked" to see the app store age rating for Paper.io 2 didn't match what was in the developer's privacy policy.
In its privacy policy, Voodoo, the developers of Paper.io 2, says its games "are not meant to be used if you are under 16" and asks people not to play if they are under 16. But the Google Play store says it's rated as "E" for everyone.
Voodoo said the age in its terms and conditions reflects the age below which parental consent is required to collect and process a player's data and doesn't mean the game is unsuitable for younger players.
Google said the International Age Rating Coalition, not Google, sets the app content ratings in the Play Store. It also said it can't determine how developers handle user data, but said apps have descriptions of how data is collected and handled and the Play Store includes a families section with games designed specifically for children.
Apple said it doesn't dictate an app's privacy policy, apps in the App Store must follow local laws and none of the games Marketplace looked at are in its App Store Kids category, which it says has different rules for apps collecting user data.
Paper.io 2 does not ask for a player's age and lets you play as soon as you install the game. Experts say that could put the game in violation of American privacy laws if the app is directed at children.
Marketplace approached AppCensus, a privacy compliance firm, to get more details about the game.
AppCensus ran an analysis and found Paper.io 2 connects with 27 third parties, many of which are advertising platforms.
AppCensus said the information that could be collected by third parties ranges from innocuous data used to make sure the game runs properly, to more personal information, like a device's unique advertising ID — used to build an advertising profile for users — and the device's approximate location, right down to the neighbourhood level.
In response to these findings, Voodoo said it is committed to user privacy and complying with data protection regulations.
It also said their games don't need age-verification measures, because they aren't specifically designed for young children. The company added third parties may collect localization data (country, time zone, etc.) with the main goal of displaying ads in the player's language or rough location.
Marketplace brought those findings back to Dermody and her son.
While her son's device does have its unique advertising ID turned off, Dermody said she had no idea how many third parties were connected to the game or what information they were collecting.
"I definitely wouldn't want to be sharing that," she said. "Why do they need to know what neighbourhood he lives in?"
Grimes said the findings aren't surprising — but are concerning.
"The number of apps that have no kind of geolocation features but that still collect location data is pretty surprising, and this is as true, maybe even more true, of kid-targeted apps," she said.
Who can get their hands on kids' data?
The Marketplace team also posed as game developers and approached companies that sell location data to see how accessible it could be.
The data shows the whereabouts of people's devices but doesn't have any personal information, like someone's name or email address, attached to it.
All four companies told us they don't have data on children, and most require buyers to sign a contract stating they won't try to identify who the data belongs to.
One company sent a free sample of data without requiring the undercover journalists to sign a contract.
The sample included 34 million location points for more than 700,000 devices in east Toronto over a month-long period in late 2024.
Retracing the route of one device, which could be seen moving between an elementary school and a house, Marketplace tracked down the device to a home with children in it — one of whom said he takes his phone to school with him daily, which means the device we tracked down was likely his.
Marketplace is not identifying the child to protect their privacy.
Grimes questions how strictly these safeguards around making sure data is stripped of personal detail is followed.
"Are all these companies doing a really good job of making sure their data is completely locked down and only good actors have access to it? Highly doubtful."
Bonenfant and Grimes say the results show how concerning it can be if advertisers collect more than just players' locations, like information that helps them shape children's attitudes, beliefs and interests.
Canada needs to do more to protect kids' data, experts say
Both experts say Canada's privacy laws need to be stronger and could look to the U.K. Children's Code for inspiration.
The U.K. Children's Code has 15 standards that online services, like apps, games, connected toys, news services and others, must follow.
The standards include prioritizing the best interests of children, requiring online services to undergo privacy assessments and having the highest privacy settings be the default settings, among other things.
Privacy Commissioner of Canada Philippe Dufresne and his office declined an interview request for this story and said they weren't in a position to comment on Marketplace 's findings, but, in a statement, said protecting children's privacy rights is a priority.
The statement also said the office has advised organizations that children's information is particularly sensitive and requires special consideration.
The office said it has done work on issues related to children's privacy, including opening an investigation into TikTok to determine if the video-sharing platform is complying with privacy laws, including whether proper consent is obtained for the collection, use and disclosure of personal information.
Until Canada's laws are updated, Bonenfant said people will have to do their best to protect themselves.
Dermody said it leaves her in a tough spot.
"I'm still really stuck on how I can evaluate the privacy piece of [games] because that information really isn't transparent," she said. "There has to be a better way."
How to limit advertisers from tracking you on your mobile device
On Apple devices, under the privacy section of the settings app, users can turn off personalized ads.
Users can also ensure the "allow apps to request to track" option is turned off, which will automatically deny any requests by apps to track your activity across other apps and websites.
On Google devices, under the privacy section of the settings app, users can send a "do not track" request to websites to try and prevent them from tracking you.
Users can also delete their advertising ID.