A fine line

Parental control apps jeopardize privacy

Many parents use apps to protect their children's safety and privacy. However, accessing cheap and fast offers could have exactly the opposite effect: Some so-called "sideloaded" or unofficial apps are more likely to have excessive access to personal data and hide their presence.

Up to 80 percent of parents use apps to protect their children's safety and privacy. The apps offer a range of features, from limiting children's time online and the content they can see, to activity monitoring and location tracking.

A study by University College London (UCL) and St. Pölten UAS has now compared 20 "official" parental control apps available in the Google Play Store with 20 "sideloaded" or "unofficial" parental control apps from other sources. Privacy policies, Android package kit files (used to distribute and install Android apps), application behavior, network traffic and functions were examined.

Stealthy spying
The team found that sideloaded apps tended to hide their presence from users - a practice that is prohibited for official store apps. They also required excessive permissions - rules that define what apps can access on the phone, including "dangerous" permissions such as access to personal data, such as exact location, at any time.

In addition, three sideloaded apps transmitted sensitive data unencrypted, half had no privacy policy and eight out of 20 apps were identified as potential stalkerware.

Fine line between protection and surveillance
Leonie Tanczer, lead author of the study from UCL: "Parental control apps are a popular way to keep children safe online and in person, and can be useful tools for parents to manage the dangers children face in today's world. But the results of our study show that many sideloaded apps have serious privacy, consent and even security issues. For example, if an app tries to hide its presence on the device, it's nothing more than stalkerware. Once you start removing the safeguards that official store apps are required to have, it's a fine line between legitimate use and unethical surveillance or, in extreme cases, domestic violence."

Secret screenshots and call tapping
The researchers observed several worrying behaviors from sideloaded parental control apps that they believe are inappropriate for apps marketed as parental control tools. For example, the apps included features to intercept messages from dating apps such as Tinder.

Many sideloaded apps also included the ability to remotely take screenshots, view call logs, read messages and even listen in on calls.

The researchers found that due to a backlash against apps marketed to catch unfaithful spouses, for example, developers have instead switched to marketing apps as parental control tools.

Lack of consent from children
Eva-Maria Maier, first author of the study, who wrote the work as part of her final thesis in the IT Security degree program at St. Pölten UAS, says: "The main problem with the extensive functionality of these unofficial apps is consent. If parents have an open, transparent relationship with their child, they shouldn't have to hide these apps on their child's phone or access so much private information. This raises serious questions about whether children know how they are being tracked and how this affects their privacy and rights. Even if parents believe they have their child's best interests at heart, collecting so much personal information carries risks as mass data leaks are common."

Data leak from surveillance app
In 2015, for example, the developer of the mSpy app was hacked and tens of thousands of customer records were leaked online, including children's personal data. In 2024, mSpy customer service records were leaked online, revealing how customers used the apps, including spying on partners suspected of cheating. mSpy is a sideloaded app and is currently marketed as monitoring software for parents.

Lukas Daniel Klausner, researcher at the Institute for IT Security Research at St. Pölten UAS: "Children's rights vary from country to country, but in the European Union, children under the age of 16 do not have to give their consent if a parent installs a parental control app on their device. Although children over the age of 16 have to give consent, in reality it is often the parents who buy and set up devices and apps. So I suspect that consent is not always given."

This situation also means that children often have no access to or autonomy over their data collected by monitoring apps. "These apps and many aspects of online culture are relatively new - they're not problems that parents had to deal with a generation ago. I think there is an urgent need for a public discussion about the availability of these apps, how they are used and how they should be used from an ethical perspective."