Girard Kelly
Head of the Common Sense Privacy Program
Companies Need to Be Honest About Selling Our Data
Our new report shows that most apps and platforms mislead kids and their caregivers about how they sell and share personal data.
As the digital world becomes increasingly integrated into kids' lives, accessing most apps, games, and platforms requires sharing personal information. Once kids download an app or log in, they not only share their basic demographics, but they also open the door to continuous detailed tracking of their preferences and behaviors. Despite the privacy concerns of parents, caregivers, and families, the complex ways companies collect, sell, and share kids' data to make money aren't fully understood.
With our 2023 State of Kids' Privacy Report , we took a deep dive into whether the most popular apps and platforms among kids and families disclose how they sell and share personal data since the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) became law. We found that three-quarters of the apps and platforms that claim they do NOT sell data are still monetizing kids' and families' personal information in some way, often through tracking their behavior and then sharing that data with advertisers for profit.
Recent laws extend privacy protection, but with limited impact
The CCPA was enacted in 2020 to provide residents of California with increased control over their personal information, placing restrictions and obligations on how businesses can use and share personal data. This year, the CPRA expanded the definition of "selling data" to include any practice by which apps or platforms track user behavior and then share that data for commercial purposes (like targeted advertising on other apps and services).
Despite these strong privacy laws, our research reveals an unsettling truth: By not being fully transparent about how they profit from our data, companies are misleading children, parents, and caregivers about how much their data is protected.
Our research found that 73% of companies currently disclose that they do not sell data, per the regulations of the CCPA. But with the new definitions under the CRPA, a more accurate look at the current industry privacy landscape breaks down like this:
- 25% of companies are privacy-protective and don't sell data
- 13% are still unclear about their practices because they don't tell us
- 62% of companies should be disclosing that they sell data under the new CRPA
That works out to nearly three-quarters of the industry still monetizing data for sale in some way—almost the complete reverse of what companies are telling kids and families.
This breach of trust is hard for parents and caregivers to see because the process is mostly behind the scenes, invisible to users. In many cases, adults or their children may have opted in to use an app or a platform, thinking that their (or their child's) data is protected, when in reality, it isn't.
If companies are allowed to mislead people by saying one thing but doing another, then consumers aren't given a meaningful choice or the option to consent to selling their data. It is also unfair and deceptive to parents and caregivers because it impacts their ability to make informed decisions.
And with nearly three-quarters of the industry monetizing data in some way, the practice is not reasonably avoided—which is especially concerning when it comes to children.
Industry needs to be held accountable for its privacy practices
While the industry continues to be less than trustworthy about their practices with personal data, Common Sense Media provides free privacy ratings to help hold companies accountable. These ratings give families a clearer picture of how popular apps and platforms are collecting, selling, and sharing their data, so they can make intelligent and informed decisions.
Passing privacy laws is the first step to giving consumers notice and meaningful control over their data. However, to have any real impact, companies need to be forthcoming about how they use personal data—much like how nutrition labels must list a product's ingredients.
In short, companies must be held accountable when they put kids and families at risk by not complying with the law. Otherwise, the industry will continue to make money by influencing and exploiting children's data for commercial purposes, all while claiming they respect our privacy
As the digital world becomes increasingly integrated into kids' lives, accessing most apps, games, and platforms requires sharing personal information. Once kids download an app or log in, they not only share their basic demographics, but they also open the door to continuous detailed tracking of their preferences and behaviors. Despite the privacy concerns of parents, caregivers, and families, the complex ways companies collect, sell, and share kids' data to make money aren't fully understood.
With our 2023 State of Kids' Privacy Report , we took a deep dive into whether the most popular apps and platforms among kids and families disclose how they sell and share personal data since the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) became law. We found that three-quarters of the apps and platforms that claim they do NOT sell data are still monetizing kids' and families' personal information in some way, often through tracking their behavior and then sharing that data with advertisers for profit.
Recent laws extend privacy protection, but with limited impact
The CCPA was enacted in 2020 to provide residents of California with increased control over their personal information, placing restrictions and obligations on how businesses can use and share personal data. This year, the CPRA expanded the definition of "selling data" to include any practice by which apps or platforms track user behavior and then share that data for commercial purposes (like targeted advertising on other apps and services).
Despite these strong privacy laws, our research reveals an unsettling truth: By not being fully transparent about how they profit from our data, companies are misleading children, parents, and caregivers about how much their data is protected.
Our research found that 73% of companies currently disclose that they do not sell data, per the regulations of the CCPA. But with the new definitions under the CRPA, a more accurate look at the current industry privacy landscape breaks down like this:
- 25% of companies are privacy-protective and don't sell data
- 13% are still unclear about their practices because they don't tell us
- 62% of companies should be disclosing that they sell data under the new CRPA
That works out to nearly three-quarters of the industry still monetizing data for sale in some way—almost the complete reverse of what companies are telling kids and families.
This breach of trust is hard for parents and caregivers to see because the process is mostly behind the scenes, invisible to users. In many cases, adults or their children may have opted in to use an app or a platform, thinking that their (or their child's) data is protected, when in reality, it isn't.
If companies are allowed to mislead people by saying one thing but doing another, then consumers aren't given a meaningful choice or the option to consent to selling their data. It is also unfair and deceptive to parents and caregivers because it impacts their ability to make informed decisions.
And with nearly three-quarters of the industry monetizing data in some way, the practice is not reasonably avoided—which is especially concerning when it comes to children.
Industry needs to be held accountable for its privacy practices
While the industry continues to be less than trustworthy about their practices with personal data, Common Sense Media provides free privacy ratings to help hold companies accountable. These ratings give families a clearer picture of how popular apps and platforms are collecting, selling, and sharing their data, so they can make intelligent and informed decisions.
Passing privacy laws is the first step to giving consumers notice and meaningful control over their data. However, to have any real impact, companies need to be forthcoming about how they use personal data—much like how nutrition labels must list a product's ingredients.
In short, companies must be held accountable when they put kids and families at risk by not complying with the law. Otherwise, the industry will continue to make money by influencing and exploiting children's data for commercial purposes, all while claiming they respect our privacy
Girard Kelly is the head of the Common Sense Privacy Program. He is an attorney focused on Internet, privacy, cybersecurity, and Intellectual Property law who thrives on cutting-edge legal issues and has a strong background in public policy, information technology, entrepreneurship, and emerging technologies.