Apps Collect Data Without User Interaction
Significant risks to children’s data privacy have been uncovered by a UNSW-led audit of school-endorsed apps in Australia. This investigation reveals that numerous apps start collecting data almost immediately, often contradicting their own privacy policies and exposing security gaps.
During the audit, funded by the UNSW Australian Human Rights Institute, approximately 200 Android apps recommended by state education departments were analysed. Researchers discovered that 89.3 per cent began transmitting data to third parties the moment they were opened, with device identifiers, location metadata, and other sensitive information being sent to analytics platforms and advertising networks.
“Our main purpose is that Australia is moving towards digital education, including from kindergarten,” emphasised Rahat Masood, a cyber security expert at UNSW. Collaborating with colleagues Sicheng Jin, Jung-Sook Lee, and Hye-Young (Helen) Paik, Dr. Masood conducted this comprehensive audit.
Analysis showed that 83.6 per cent of apps were found to transmit persistent identifiers, unique codes that can track a device across sessions and different apps. 67.9 per cent of the apps contained at least one embedded tracker or analytics tool, such as Firebase, Facebook SDK, or Unity Analytics, which serve no educational purpose.
Privacy Policies and Misleading Practices
Only a mere 3 per cent of the privacy policies analysed were accessible to someone with a tertiary-level education, with the rest requiring higher literacy levels. The study also found that only one in four apps were consistent between their privacy policies and actual data collection practices.
Dr. Masood pointed out, “Nobody will understand these terminologies and jargon,” highlighting the complexity and inaccuracy of privacy policies. Apps marketed to children were no safer than general apps, with 76 per cent showing policy distortions, despite child-friendly branding.
Call for Systemic Change
Researchers advocate for stricter oversight of child-directed apps and a prohibition on idle telemetry. They are also developing a ‘traffic light’ system for parents to easily understand app privacy and security profiles.
This study, titled “Analysing Privacy Risks in Children’s Educational Apps in Australia,” was presented at the Symposium on Usable Security and Privacy in February 2026. With digital education on the rise, these findings highlight the urgent need for improved privacy protections for children’s data.
Last updated: 20 April 2026, 3:19 pm
