How gaming apps use your private data to track you | Marketplace
[vibrant orchestral plays] [video game din] This isn't how my son would normally play a video game: hooked up to an EEG with a neuroscientist, me, his mom, and our Marketplace cameras watching his every move. But he's come with me to a research lab to test how his brain responds to games like these. ♪ Like your prefrontal cortex is getting a workout. Games that draw our kids in. So you're more interested to play more and more.
[Christine] But once a game has them hooked, what personal information could apps be collecting? How is that data being used? And where can it end up? The answers might surprise you. ♪ But first, we're spending time with nine-year-old Jamie, who only recently started gaming again. -What's this-- -It changes the colour. ...is near... the shortcut. [Christine] His mom, Sarah, hit pause on his play altogether after noticing changes in his behaviour. When we would say, you know, time's up, there would be basically like a meltdown, irritability. It just seemed really dysregulated.
And that wouldn't just be like short-lived. It would persist for some time. Have you had that conversation with him about what you worry about with the games? I didn't want him to think that we were punishing him or this was like a penalty for him. It was more like I explained to him that, you know, we've noticed this change in your behaviour, and we're a bit concerned about what the effects of these games will be. [Christine] The effects of these games is what Emma Jordan studies at Western University, and what she's testing on my son.
And so the red line and the blue line are the channels in his prefrontal cortex. [Christine] This cap measures blood flow in the brain, allowing us to see in real time what's happening as he's gaming. ♪ There was a big peak a couple of seconds ago.
-What did you-- What happened? -I did kill him. -The other guy. -Yeah. Right? [Christine] Emma says the way some games are designed with new characters, weapons, and a virtual audience set off feel-good chemicals in the brain that keeps kids wanting more. [cheering in game] [Emma] So there was a little cheer.
So something happened right before the cheer. Yeah, the other guy just kind of gave up and killed himself. [Christine] Kids are spending an alarming amount of time on screens, eight hours a day on average. Some of that time is on social media, and some of it is spent drawn in by games. Their brains are really hardwired for rewards, and they don't really have the ability, the brain machinery, to be able to put it down. So that's really the concern.
It's almost like they can't break away from them. Well, yeah, I mean, they're seemingly designed to be addictive. All those little psychological mechanisms and cues keep them on. [Christine] And as games are played, data is often collected by game developers, giving them valuable insight into player behaviour, like what features you interact with or when you quit playing.
They want to know in terms of what is going to make children stay on these games, what's going to be most captivating. And for everything that we were seeing on those games today, the multiplayers, the different colours, the music, the reward schedule, that's all been tailored. And they're collecting all of that data to see what's going to keep them online, right? [Christine] Designed to keep you hooked.
And the longer you play, the more data they collect. But beyond the gameplay, what other information could these apps be collecting? That's a question Sarah has started asking. What went through your mind when you sort of saw, hey, we want to talk to people about games and data privacy? Yeah, no, I thought that was really interesting. I think about him engaging in the apps and playing those games and thinking about kind of how it will impact him.
But I haven't really thought much about what are they getting from him? [Christine] What are the apps getting from him? It might be more than you think. When you download an app onto your device, it can immediately start collecting information about you. It could be your name, your device ID, your location, even what other apps you use or sites you visit. All of that information from all those different sources can be pulled together to build a sizable profile of the user.
One they'll never even see. But it can be shared or accessed by third parties like advertisers who are looking to learn things about us like our habits and our interests. [rising tones] To learn more about how this applies to children, we're in Montreal to meet up with Maude Bonenfant, a Canada Research Chair on gaming and big data.
Children are supposed to be protected from this kind of data collection, are they? No, they are not protected. [Christine] She studied 249 free children's games and found that more than 60% shared data with third parties. It's impossible to really protect the privacy of your own child. [Christine] By the time a child is 13, over 72 million pieces of personal data have been captured about them, according to one tech company. But that shouldn't be the case.
In the U.S., a law known as COPPA prohibits personal information from being collected on children under 13 without parental consent. And games for kids in the app stores fall under those regulations. But experts tell us some game developers are easily getting around them.
So we're taking a closer look at how. The answer lies in the game's fine print. Whether you're in the Apple App Store or the Google Play Store, most apps will have a rating telling you what age the content is appropriate for. A game like Candy Crush has a rating of 4+ on the Apple App Store.
It's rated E for Everybody on the Google Play Store. But when we look into the terms of service, it says you must be at least 13 years old or you must not use their services. So why the discrepancy? If a game isn't made for kids, it's not held to children's privacy regulations. So we put 20 of the most popular games to the test and find in the Apple App Store, nine games have an age rating that doesn't match the age in the privacy policy.
And over at the Google Play Store, 12 games have an age rating that doesn't match the privacy policy. So the privacy policy says it's not for kids, but the content seems to be. I think it's misleading the parents.
The parents don't understand and it's hard to understand. Do you feel this is done intentionally? It's done intentionally. They know that kids should be protected, doesn't respect the spirit of the law. For Sarah, the rating in the Google Store helps determine whether it's a game Jamie is allowed to play.
But we show her the fine print behind one of his favorite games. All right, so this is Paper.io 2, E for Everyone in the Google Store. But if you click on the game developer's privacy policy right here, it says, please remember that Voodoo apps and games are not meant to be used if you are under 16. Wow.
Well, we are Android users and saw the E for Everyone. So... that completely doesn't match that. And it goes on to say Voodoo never knowingly or willingly collects any personal data concerning children under 16 years of age. If you are under 16, please do not use Voodoo apps and games. Wow. I mean, when we create his profile,
the age is there. So I would think that it should be like, blacked out or not in the store if there's that age limit. Both Google and Apple say the age ratings in their stores is about the content only.
Google says they cannot determine how developers handle user data. But add parents looking for games specifically designed for children should go to the family store section and look for the data safety label, which shows how apps handle user data. Apple says they don't dictate apps privacy policies and say it's the developer's responsibility to ensure their app is compliant with regulations.
And they say none of the games we looked at are in their kids category, which has different rules for collecting user data. As for game developers, they echo what tech giants Apple and Google say: that age ratings only apply to content, not privacy. King, the maker of Candy Crush, say they're following privacy regulations and their games are designed for adults. The developer behind Paper.io 2, say they're abiding
by the most conservative data protection regulations and that their games are not specifically designed for young children. But a child does play the game. So what information could it be collecting and sharing? To find out, we're turning to Tim Wyatt of AppCensus, a tech privacy company that looks under the hood of apps. He's running an analysis on Paper.io 2,
the game that Jamie just can't put down. And he's not alone. It's a popular game with more than 100 million downloads in the Google Play store. I am curious about what could be connecting and what information they might be calling from his game usage. -Are you nervous? -Yeah, I'm a bit nervous.
There's always that fear, you know, that you're trying to do your best as a parent and that, you know, there could be a misstep. That there's a door open back there that's giving people -more than you want. -Yeah. We'll let you know what they say.
-Okay. -You ready for that, Jamie? Yeah. ♪ But it's not just what they can find about our kids. As you'll see, they can actually find our kids.
[Christine] This is your Marketplace. Nine-year-old Jamie's go-to game is this one, Paper.io 2. And we turned to the experts at AppCensus, a company that tests the privacy settings of apps. They've been running an analysis on that game to see what information it's collecting and where it's going. And now, the results are in. You did the analysis.
Give us a sense of what's running behind Paper.io 2. So there are 27 different third parties that the developer has integrated libraries from into the application. [Christine] 27 third parties. The majority of them are advertising companies. Could you recognize from Paper.io 2, any of the third parties? Yeah, a lot of them are very common advertising networks.
-They run behind a lot of games. -Yeah. The analysis finds many of the third parties are collecting the advertising ID, a unique sequence of numbers and letters assigned to your device that links information companies are collecting on you. And some were also collecting approximate location. Was it accurate when you played the game for where you were? In my case, it was within the neighborhood. They figured out what neighborhood -you were in, roughly. -Right.
That seems like a lot of information, actually. It's not nothing. [Christine] How can that information be used? It's primarily used in this app for delivering targeted advertising. So the advertising networks that are running behind this app are building profiles of the people using it? Yes. We're bringing the results back to Jamie and his mom.
The data was being sent out to around 27 third parties and many of them are ad networks. Wow. Wow, 27. What is hearing 27 different ad networks, 27 third parties, what does that make you think? It makes me think that it's a lot bigger of a possibility and that his information is being shared on a pretty big scale that I just hadn't really thought of before. [Christine] We tell her the approximate location was also collected.
Does that worry you that third parties can get a sense of where Jamie is? Yeah, absolutely. I mean, that's not something I was aware of that we were sharing with them and I definitely wouldn't want to be sharing that. Why do they need to know what neighborhood he's in? That's very specific. The maker of Paper.io 2 says it's common practice for mobile games to integrate third parties and say they're committed to user privacy. But they don't address the fact that a nine-year-old is playing their game.
Data expert Maude Bonenfant says the more information companies can glean, the more value it has. There is an economic model based on the data and the companies need the data. So that's the money. [Christine] And it's big money. The global data broker market which consists of thousands of companies collecting, analyzing and selling consumer data was valued at $562 billion last year.
So when a company sells data, can anyone get their hands on it? To find out we're testing to see if we can buy kids data posing as game developers. We're looking to, we want to develop a kid's mobile game. [Christine] We say we're looking to learn where kids are spending time to help us market our own game and reach out to four companies that sell location data. All four companies tell us they don't have data on children.
[Christine] But they give us the pitch. [Christine] And even get candid. [Christine] Despite feeling like Big Brother, the brokers say the data they're selling is anonymous because there aren't any names attached to it.
Most companies require buyers to sign a contract stating they won't try to identify who the data belongs to. But we don't sign that contract, and still obtain a sample of data from one of the companies. It contains 34 million location points for more than 700,000 devices over a one month period in late 2024. The data is concentrated to one district in East Toronto. And very quickly we find hundreds of data points at elementary schools.
Zeroing in on one device we can see that it arrives at an elementary school every day at 8:50 in the morning. Then it leaves at 3.15 in the afternoon. We watch as it gets on a bus or goes to a nearby convenience store. But more significantly we see where it ends up at the end of the day: home.
So we're retracing that route looking to find the person we already know so much about, to find out if it's a child. ♪ All right so we knocked on the door of the home that the data led us to, and did confirm children do live there. Three of them go to the nearby elementary school and one of them told us he takes the phone to school with him every single day.
So it's likely his location data that we've obtained. Intentional or not, children's data is seemingly available for anyone to get. Our findings don't surprise Maude, but they do trouble her. It is really scandalous that it is so easy to get information from the kids like this. I think no parent would feel comfortable if like a van followed their child around when they went to school and came home. And yet the phone in their pocket is following them around and we've become very used to it.
Yeah and so often I give the example would you accept that when your kid is playing there is 10 adults around with pads noting what he's behaving, where he is, what he's doing. It's the same thing. [Christine] And the potential use of that information is what concerns Maude.
But the kids, they are growing. They are discovering themselves. So we can really manipulate what they will like, what they will buy, and what they will consume. But if we can manipulate the conception, we can also manipulate the political idea. We can manipulate the way we'll see the world. [Christine] And the way the world sees your child.
Your kids will grow up and he will want to have a life. He will want to get a job, to have a credit, to buy a house, to have insurance. And all those information, those personal information can have consequences on his life in the future. [Christine] Unlike in the US and EU, in Canada there are no child-specific privacy laws. Canada's Privacy Commissioner Philippe Dufresne says it's one of his top priorities. [Philippe] And we will champion children's privacy rights.
[Christine] We share the findings of our investigation with his office. But they say they're not in a position to specifically comment, and decline our request for an interview. Is Canada doing enough to protect the privacy of our children? No, I don't think that Canada is doing enough.
We should have our own law. [Christine] But until then, what can a parent do? -There has to be a better way. -Find out after this. [Christine] This is your Marketplace.
[rapid beeping] [Christine] We've uncovered companies sharing data that, intended or not, can easily be traced back to Canadian children. So it is really scandalous that it is so easy to get information from the kids like this. [Christine] Until regulations are strengthened, there are some steps you can take to protect your children. Try to limit screen time to less than two hours a day, say experts.
As for their privacy, on an Apple device, under tracking, you can turn off "allow apps to request to track." And on Android devices, under ads, you can delete your advertising ID altogether. A step that's been taken on Jamie's tablet. But it's a lot for parents to take on alone.
Definitely think that I'm going to rely less on what's in the app store and actually sit down with him and watch him play. I got to admit, I'm still really stuck on how I can evaluate the privacy piece of it because that information really isn't transparent. There has to be a better way.
2025-03-11 20:24
