• by Wendy Davis  @wendyndavis, February 16, 2012

Developers of childrens' apps often fail to adequately tell parents what data the apps collect, according to a Federal Trade Commission staff report.

The report, described by the FTC as "a warning call to industry," faults app developers, as well as the iTunes and Android marketplaces and in-app advertisers, for the lack of information.

"FTC staff believes that all members of the kids app ecosystem -- the app stores, developers, and third parties providing services within the apps -- should play an active role in providing key information to parents who download apps," states the report. "The mobile app marketplace is growing at a tremendous speed, and many consumer protections, including privacy and privacy disclosures, have not kept pace with this development."

The FTC says that app developers should state what information is collected through "simple and short" disclosures or icons that are easily viewed on a mobile screen. The agency also says that app developers should alert parents if the app connects with social media or allows for targeted advertising. Third parties that collect information through apps also should disclose their privacy practices, the FTC recommends.

For the report, FTC staff examined 200 Android apps and 200 iPhone apps, nearly all of which were aimed at children. The FTC reviewed pages that were available to desktop users, but didn't examine how app developers also used the mobile interface to explain privacy issues.

The agency said that promotion pages on Android and iTunes, as well as the individual app developer sites, "revealed very little information" about the apps' data practices. Only two out of all 400 app promotion pages linked to a landing page that provided information about how the app collected and shared data collection, according to the report.

The FTC also reported that Apple's app promotion pages disclosed "almost no information" on developers' privacy practices. The Android marketplace requires app developers to reveal what types of data they access and to seek users' permission. Nearly three out of four of the Android apps examined told users that the apps would gather data -- such as information about users' locations -- but only three out of 200 attempted to explain why they did so.

Google said in a statement that it was reviewing the report. The company also said that it offers parental controls and informs developers about best practices for handling data.

The FTC report didn't address whether app developers are actually collecting data -- only whether they offer understandable privacy policies. But the agency says it intends to also look at whether app developers are gathering personal information from children under 13 without their parents' permission. Doing so potentially violates the Children's Online Privacy Protection Act.

In August, the FTC brought its first COPPA enforcement action against a mobile app developer -- the company Broken Thumbs. The developer agreed to pay $50,000 and to destroy information it collected from children.

Jules Polonetsky, co-chair and director of the think tank Future of Privacy Forum, says that Thursday's report shows that app developers need to set out their privacy practices "in the alpha version, instead of waiting for the beta update. It's pretty clear that parents are not getting easy access to the information they need to decide whether they're comfortable with apps."

Jeffrey Greenbaum, an advertising lawyer with Frankfurt Kurnit Klein & Selz, adds that the report shows that the FTC is paying close attention to how consumers are using new platforms. "This FTC is very attuned to technology, and is trying to be ahead of the curve on some of these issues."

The report comes as mobile app developers are under scrutiny on a variety of privacy issues. In the last week, news broke that Path and Hipster were downloading users' address books without first notifying them.

The FTC also recently warned three online data brokers that their mobile apps must comply with the federal Fair Credit Reporting Act. That law provides that reporting agencies must take steps to ensure the accuracy of background reports used for employment, housing and credit. The law also gives consumers the right to challenge information in those reports.

The report drew notice on Capitol Hill, where Sen. John Kerry (D-Mass.) said the investigation demonstrates the need for new privacy laws. "The more we learn about the collection, use, and distribution of people’s personal information, the more it underscores the need to make a baseline code of behavior the law of the land."

Last year, Kerry and Sen. John McCain (R-Ariz.) introduced the Commercial Privacy Bill of Rights, which would require companies to obtain users' opt-in consent before collecting data that is both "personally identifiable" and "sensitive."