Mobile Apps And Children's Privacy

MS. DIANE REHM

10:06:56
Thanks for joining us. I'm Diane Rehm. Smartphones and tablets are topping many wish lists this holiday season, but the FTC just released a report about apps for kids that could give parents pause. It found hundreds of popular educational and gaming apps for children failed to give parents basic details about the kinds of personal information they collect.

MS. DIANE REHM

10:07:25
Joining me to talk about mobile apps and children's privacy: Jessica Rich with the Federal Trade Commission, Morgan Reed of the Association for Competitive Technology, Cecilia Kang with The Washington Post and Angela Campbell of the Institute for Public Representation at Georgetown University School of Law. I hope you'll join in our conversation this morning. You can call us on 800-433-8850. Send us an email to drshow@wamu.org. Follow us on Facebook or send us a tweet. Good morning to all of you. Thanks for being here.

MS. JESSICA RICH

10:08:11
Good morning.

MS. CECILIA KANG

10:08:11
Good morning.

MR. MORGAN REED

10:08:12
Good morning, Diane.

MS. ANGELA CAMPBELL

10:08:12
Good morning.

REHM

10:08:13
Jessica Rich, if I could start with you and get you to tell us about the FTC's report on mobile apps for kids, what did you find?

RICH

10:08:25
So this was the FTC's second report of its type. And we looked at 400 apps in the largest app stores, Apple's and Google's, and we made some key findings that we found very troubling. First, many apps transmitted information from the device back to the developer, or even more commonly, to advertisers, analytic companies and other third parties without any disclosure to parents. Many apps also provided access to interactive services such as advertising, access to social networks and the ability to make purchases -- these are kids' apps -- without any disclosure to parents.

RICH

10:09:10
In the cases where information was transmitted, in most cases, the -- it was the device's ID. And the device ID is a string of letters or numbers that uniquely identifies a mobile device. If you have it, you can track a device user's activities across different apps that use across different mobile services they access and potentially develop a detailed profile of the user. Some apps also transmitted the device's location and the phone number associated with it. Here's why we're so concerned about it: Before downloading apps for kids, parents should be able to learn basic information.

RICH

10:09:57
They should be able to learn what information is being collected from their kids, how it's used, who it's shared with, all the third parties it may be shared with and what interactive services, such as being able to access the social network, a kid will encounter in the app. And I would also note that, while it's true that many information doesn't need to be collected in apps for certain basic functionality, the key finding here is that most of the data went to third parties.

REHM

10:10:30
Jessica Rich of the Federal Trade Commission. Cecilia Kang, how big a problem is this?

KANG

10:10:39
Well, it's certainly an important issue that the FTC has addressed in that this is the first bit of evidence that shows really what apps are doing. A lot of it's been hypothetical so far. It is a problem in that children are adopting mobile technology faster, arguably, than any other technology. And what that means is that children and teens, youth in general, they're carrying around computers in their pockets, in their backpacks all the time, so they're constantly attached to some sort of device that connect them to the Internet.

KANG

10:11:13
And that makes them -- that raises big questions as to, OK, so what does that mean for our ability to track what they're doing on the device, where they are because you can track a person's location, lots of new questions that mobile technology has raised. And so it's a big issue in that sense in that the technology has really become a very -- the technology itself is so new and so different and is being adopted so quickly.

REHM

10:11:38
Cecilia Kang, she's with The Washington Post. And turning to you, Morgan Reed, what are the companies that develop these devices and distribute these apps doing with the information they collect?

REED

10:11:57
Well, it depends. You know, Jessica raised a very good point. There is a plethora of information that we need in order to make apps better. I mean, ironically, in order to make a cool app for kids for education, I need to know when a child's finished a set of math problems. So there is information that I need back.

REED

10:12:14
If I've got an app that I want to be able to have a child -- like, "Stack the States" or something where I want to know what state they're in and provide them with information about their state capital, I might need to know their location. However, Jessica raises another point, which is this question about what is the data that we are collecting when we're sharing it with third parties?

REED

10:12:30
And are we doing enough to notify our users about what's happening? And I'd say that right now, our industry accepts the fact that we need to do more and we need to do a better job. A lot of the time, the hardest part we're having is finding a way to have parents take the time to read the information that we do provide them. And that's the conundrum we're facing right now.

REHM

10:12:49
But are you saying that that information is provided right at the top and it's directed to parents, saying, before you give you give your child this app, make sure you've read all the details?

REED

10:13:07
So the problem that we've had is that -- and there are some -- this is the good news about it being an industry that's happening so fast -- is that the California AG and the large platform companies have worked together to establish that platforms will, in fact -- and by platforms, I mean stores -- will, in fact, provide a link directly on the purchase site and even the one on the mobile device itself that says, hey, here's the privacy information.

REED

10:13:30
Now, what we've done in working specifically with Moms With Apps and Parents With Apps is to try to find a way to simplify, simplify, simplify so in that 20-second window when a parent is looking at the application, that they can see some very basic information. And that is -- has been the conundrum because on the one side, the lawyers say, tell them everything. We can't afford the liability. On the other hand, parents say, tell me what I need to know so that I can move on.

REHM

10:13:57
Morgan Reed of the Association for Competitive Technology. Angela Campbell, kids don't need to put in any information about themselves. They are being tracked in any case, aren't they?

CAMPBELL

10:14:19
Well, oftentimes they are, but oftentimes, these mobile apps will also ask children for information such as to provide their email address or to provide the email addresses of their friends or to sign in through Facebook, which then gives the app operator all the access to all of their information that they have on Facebook. So some of it is actively collective, and some of it is passively collective.

REHM

10:14:45
Angela Campbell, she is director of the Institute for Public Representation at Georgetown University Law School. Angela, you helped file a complaint against makers of the popular virtual pet game "Mobbles" this week. Tell us about that.

CAMPBELL

10:15:07
That's right. We were really horrified when we saw this game because...

REHM

10:15:11
Tell me about it.

CAMPBELL

10:15:12
...when you play the game, it's easy enough. It's a free game, and you download it. It -- then you have to try to catch these little pets, and they're in your neighborhood. And so you click, you know, find "Mobbles" and you get the map of where you are, showing your exact address and then showing you where these little virtual pets are that then you can go and capture. And then the other thing that was troubling -- well, many things are troubling about the game, but once you have the pets, you have to take care of them.

CAMPBELL

10:15:44
And to do that, you have to feed them, you have to play with them, and so you can earn points by doing things so you can buy food. But you can also spend actual money to buy this virtual cash so that you can buy things for your pet. And they're constantly asking children to buy more things and to -- and they'll even, like, send you push notifications when you're not even playing the game, saying, oh, your pet misses you, you know, come back and feed them. And so I think it's really unfair taking advantage of children to be constantly trying to get them to spend money on virtual goods.

REHM

10:16:21
So you filed a complaint with the FTC. How does the FTC receive that complaint? Jessica, what do they do with it?

RICH

10:16:32
Well, our investigations are non-public, but we very much welcome information from academics, consumer groups, any sources that would help us with our law enforcement. So I can't comment on whether we're pursuing it, but obviously, we're very interested.

REHM

10:16:47
How serious is this kind of game, Cecilia?

KANG

10:16:51
Well, first of all, these kinds of games are all over the app stores. There are so many of them. And it's serious in that I think a lot of parents don't actually know what happens in these games unless they really test them out. What Angela is describing in-app purchases, for example, that's something that's a big source of revenue for a lot of companies, including Apple and Google and their app stores. And that's sort of seen as the future of mobile -- the mobile economy in many ways.

KANG

10:17:19
So if parents knew and if they really tested out what the apps are doing, what kind of advertising their kids are getting exposed to, what kind of purchases the kids are being asked for, the fact that -- in this case, "Mobbles" -- that children's locations are given up, I think that parents might think twice. But that means that a parent would have to test out every app in every level to a large screen. I think a lot of parents want to know. It's just a lot. And they would just like to know upfront. OK, just tell me. What's going on in this app?

REHM

10:17:49
So, Morgan Reed, it's not just what you say upfront. It's going through that game. It's going through that app every single step of the way and all of its possibilities.

REED

10:18:04
Well, there are a couple of things, and I guess I want to make a very key point. We've been kind of waving our hands and say that children are purchasing these things and that children are buying this and children are doing this. Let's pause for a second and remind everyone and take an education moment.

REED

10:18:21
When you hand your username and your password to your iTunes account, it is very much like walking into Toys "R" Us, handing your child your credit card and saying, go crazy, 8-year-old. And I think parents need to remember that they're blithely handing over usernames and passwords that are directly tied to a credit card. It's something we need to work on.

REHM

10:18:41
Morgan Reed, he's executive director of the Association for Competitive Technology. Short break. Stay with us.

REHM

10:20:05
And joining us now from his office on Capitol Hill, Minnesota Sen. Al Franken. Thanks so much for joining us.

SEN. AL FRANKEN

10:20:16
My pleasure, Diane.

REHM

10:20:17
I know the Senate Judiciary Committee is taking up your Location Privacy Protection Act today. Tell us how that bill would affect children's use of mobile apps.

FRANKEN

10:20:34
Well, the bill would require these apps to get people's permission to take their location and to collect it and to share it with any third party. So, you know, the FTC's report this week showed that parents are not, you know, that these apps and 12 of the most popular children's apps are taking location information, collecting it without the parent's knowledge or permission. And this is actually pretty precise location knowledge.

FRANKEN

10:21:15
My office asked the researchers at the FTC, you know, you said these kids' apps gave out their user's precise geolocation. Just how precise was that location? The authors of the report answered exact location. It showed us sitting in the FTC's research lab. So this is, you know, I think parents would be a little disturbed to know that these apps were taking their children's precise location and can share it with God knows whom.

REHM

10:21:52
So exactly what would your bill require?

FRANKEN

10:21:58
The bill would require that when you're getting an app, when you try to -- when you get an app, on the screen, it says, you know, do you give the permission for this app to take your location and to share it with third parties. And that's what it requires. And that's a big part of the bill. Another part of the bill is we go after stalking apps. You know, we -- I've been on this for about a year and a half on this issue.

FRANKEN

10:22:34
And when we first started doing hearings on it, we got some very shocking, disturbing testimony. For the first hearing we did, the Minnesota Coalition for Battered Women presented some testimony that -- from a woman in St. Louis County. It's in Northeastern Minnesota. She had -- was in an abusive relationship. She went to a county building to a domestic violence program there.

FRANKEN

10:23:08
When she was there, on her smartphone, she got a message from her abuser saying, why are you in the county building? Are you going to the domestic violence program? She got very scared. So they took her to the courthouse to get a restraining order. She gets to the courthouse. She gets a message from the same guy -- from the guy saying, why are you in the courthouse? Are you getting a restraining order?

REHM

10:23:31
I wish she had thrown her phone away at that point.

FRANKEN

10:23:36
Yeah. I think that at that point, you get the restraining order, first of all.

REHM

10:23:40
Yeah. Yeah.

FRANKEN

10:23:41
And when you -- yeah, you probably don't -- you get rid of that phone.

REHM

10:23:46
OK. There's another issue here, which is that if the company is involved are doing what they argue is due diligence by putting the message upfront to parents: this is what this app will do. And yet -- you may have heard us talk about the game "Mobbles" -- once the kid gets on to that app, unless the parent is sitting right there with the child, he or she has no idea about the amount of information being collected. So it's not just, you know, where the data is going. It's that parents have no idea of the depth of information that these kids are handing over.

FRANKEN

10:24:49
Absolutely. Although my bill is really about geolocation.

REHM

10:24:53
Right.

FRANKEN

10:24:54
And so this is a discrete bill about this subject about that and stalking apps. But, no. I mean, obviously, when you get your kid an app, you know, you should kind of supervise your child using the app, too...

REHM

10:25:13
I would think.

FRANKEN

10:25:14
...in terms of whether your -- the child was spending an incredible amount of money on that app that you're not aware of, you know?

REHM

10:25:24
And have you been working with industry to...

FRANKEN

10:25:30
We have been actually, yes, interacting with industry a lot in, you know, and there are some best practices that are best practices that aren't enforced within the industry very often. And that's one of the reasons we've made this, you know, I've begun half of this legislation, which is addressing this part of it, which is geolocation.

REHM

10:25:54
And how much support do you think you have?

FRANKEN

10:25:58
Well, we'll find out today.

REHM

10:26:00
Yeah.

FRANKEN

10:26:00
We have support of every consumer, every major consumer protection group and every domestic violence group in the country, all the major ones. So I know I have -- and I have four co-sponsors on the committee. And so we're hoping to, you know, we've been talking, really, to the Republicans on the committee and having some very, very productive talk. So I'm optimistic.

REHM

10:26:30
You decided not to run again, Sen. Franken, so...

FRANKEN

10:26:35
No, no, no. I am running again.

REHM

10:26:37
You are running again.

FRANKEN

10:26:39
Yeah. I'm sorry. And in fact, I'm running to -- something else I have to do. But I'm also -- I'm going to be running for re-election.

REHM

10:26:47
I'm glad to hear that. Minnesota Sen. Al Franken. Thanks for joining us.

FRANKEN

10:26:54
You bet, Diane.

REHM

10:26:54
All right. Bye-bye. And these concerns, I mean, not only the location but the money that can be spent without a parent's knowledge, Morgan Reed, there's a lot of concern here.

REED

10:27:14
Well, as I said -- and it was interesting to listen to Sen. Franken talk about how do we notify people. One lesson that we've learned is throwing more paper at folks doesn't necessarily lead to better notification. We all know that from the HIPAA forms we get, from the annual letter that we get from our credit card. No one reads it. So what industry is actually doing and, I think, is actually critical to this is we're leapfrogging over the notification and trying to actually empower users by giving better controls.

REED

10:27:43
If you look at the latest iOS devices, the Apple devices and Microsoft's device, they're actually making it possible for you to make a decision immediately in every case and per app to say, you know what, I don't want location on that, just that app. And also, you can just say, you know what, right now, I'm OK with it. But tomorrow, I may not be.

REHM

10:28:04
Cecilia, how well is that going to work?

KANG

10:28:08
So you are seeing some voluntary efforts that have made progress. So some companies do a better job of pushing you a little request saying, can we track your location? Yes or no.

REHM

10:28:18
Right. Right.

KANG

10:28:19
And that is a step forward. The -- what Sen. Franken is doing and what the FTC has looked into is to ensure particularly for children whether there needs to be even more safeguards because the idea in general is that children, particularly those 12 and younger, should be afforded certain safety, certain special considerations when it comes to their tracking of location, the tracking of information to create profiles on them. So that's really what we're talking about, whether there's -- what the tradeoff is if there were some sort of regulation or a law to protect children more concretely.

REHM

10:28:57
What about that tradeoff, Angela?

CAMPBELL

10:28:59
Well, I just want to point out that we currently have a law, and it's called the Children's Online Privacy Protection Act. And it requires that before you collect any personal information from a child, that you notify the parents and you get their affirmative consent in advance. And many companies, like this "Mobbles" complaint that I was talking about, they were not providing any notice, and they were not providing any consent -- or providing for any consent. They weren't asking the parents.

CAMPBELL

10:29:28
So I think that's critical. I think there have to be -- that law needs to be enforced and there need to be clear guidelines about certain things you just cannot do with children because they're fundamentally unfair. Children don't have, for example, the judgment to know whether or not they should allow their location to be known or to know what a third party is and what they might be doing with that information and how it might affect them.

CAMPBELL

10:29:50
So that's why the parents have to know. I agree, though, that the really long privacy statements are incomprehensible to anybody, including myself, and they're so vague and general that you basically have no choice but to accept it or not or not use the app at all.

REHM

10:30:05
Cecilia.

KANG

10:30:07
I will note that one of the difficult things for companies is that it's, often on the -- on mobile apps, hard to determine whether an app is really aimed toward a kid or not. So when "Angry Birds," for example, came out, it really looked like an app that would have been just for kids. But as we know now, it's so popular ubiquitously across different age groups.

KANG

10:30:27
So how does -- how do federal regulators, how do companies try to approach privacy and really look at children and their privacy when it comes to sort of the gamification, if you will, of so many apps on the Web, on mobile devices? Well, that's sort of a problem.

REHM

10:30:43
And, Jessica, during the break, you and Morgan were having some words. I want to understand what those words were about and where that basic disagreement lies.

RICH

10:31:02
So I think it was in relation to -- Morgan had said that parents are handing over their credit cards -- not their credit cards. They're handing over their mobile device to children and with the password and that they need to exercise more responsibility. And I took issue with him because I don't think parents have any idea, when they hand the device to their children, the extent of what happens.

RICH

10:31:27
So, for example, we talked about privacy, these various disclosures. Well, the disclosures often say, we're collecting your location information, but they don't say, and we're going to share it with numerous third parties. A parent may think that means, oh, OK, it's some sort of game that requires location information, but they don't realize that the information could flow for all sorts of purposes to additional people.

RICH

10:31:50
Furthermore, as our survey showed, there aren't even those basic disclosures for most apps. So I think there's a fundamental gap here in saying parents aren't exercising their -- or in suggesting that parents aren't exercising their responsibility when they just don't have the information they need to do so.

REHM

10:32:07
Morgan.

REED

10:32:07
So I think it's less of a disagreement than a question of how do we plow forward on this because I think the problem we're facing is that I don't know that we can solve this by just shoving more information at parents early in the process. I believe that the problem that we have to solve for parents is to make sure that they are aware of it as it's happening, and Jessica raises a really important part about the sharing of information.

REED

10:32:30
But the problem that we face right now on this is, part of Jessica's report, is a bit of a bully pulpit. Its intent is to say to my folks, hey, guys, you need to clean up your act. But the problem is, on the other hand, we had the recent FTC settlement with Google, which has 98 percent of the market share in advertising, which was less than a slap on the wrist, which Google did not have to admit that they were in -- at fault and, in fact, kind of insulted the FTC afterwards.

REHM

10:32:56
And you're listening to "The Diane Rehm Show." What about those points, Jessica?

RICH

10:33:03
Well, actually, I'm surprised you said that about Google. Google had to -- has to implement a whole privacy program. It's got to notify consumers every time it change, you know, every time it changes its practices. So I actually don't agree with what he said about Google.

REED

10:33:19
Yeah, I'll clarify. That was a -- that was $22 million for Google, which is, I think, they accidentally can lose that in the couch cushions. But then, additionally, on top of that, there was no admission of guilt. So when I'm looking at it from a small venture capital company looking as a startup, if I can get to be a billion-dollar company and the only pain I feel is $22 million, well, I'll take that issue in spades. And so when you look at somebody that has that much market share...

REHM

10:33:44
It's the cost of doing business.

REED

10:33:46
Exactly. And so I think what -- if it's going to be effective, it has to actually go after somebody like Google. And by the way, in this case, they were breaking privacy settings that were already existent on the iOS devices. So this wasn't a situation where they were just failing to notify. They were actually changing built-in settings in Safari and actually making that. And their cost of doing business? A few million dollars.

REHM

10:34:13
Angela.

CAMPBELL

10:34:14
I was going to say I think that illustrates why the FTC needs to take more active enforcement role. I mean, it's all well and good that they did this study. Actually, it was their second study, so I don't know why the industry didn't get the message the first time, but maybe their lack of enforcement. And I think that the commission's maybe brought 20-some COPPA complaints, but, I mean, there could be so many. I could file them, you know, all day long for the next year because there are so many problems.

REHM

10:34:39
Jessica.

RICH

10:34:40
Actually, the FTC's brought, you know, many, many dozens of cases both in the kids' area and the adult area. And $22 million, I mean, we can quibble over whether $22 million is a significant amount of money. But what is significant about the orders is the incredible injunctive relief we get that usually lasts for 20 years, and that's pretty painful for companies that violate privacy if they have to follow very, you know, implement programs and report to us for 20 years. And I think that's a lot -- even more powerful than the money that we obtain in the orders.

REHM

10:35:16
Cecilia.

KANG

10:35:17
Well, I'm actually just curious, Morgan, if -- do you think the FTC should define location and device IDs as personal identifiable information? In other words, that your developers would have to get permission from parents to collect these things? Are you -- do you disagree that that's a...

REED

10:35:35
Well, I think location is pretty clearly going to be something that we consider to be personally identifiable information. I think that, I think, pretty much across the board. There are some questions about if I take that information and keep it on the device. But back to Jessica's point, if I share it, I think that's a very different thing than if I just keep it on the device so that I can use it interactively.

REED

10:35:55
On your other question about ID, again, I think the industry is kind of trying to leapfrog ahead. The platforms are now actually separating out. I'm not making one ID for one device, one ring to rule them all since we're closing in on a "Lord of the Rings" movie. We've moved away from that now, and we're giving one ID for different uses. So for advertising there's an ID, and there's an ID for vendors, and we're not supposed to mix them. So it prevents or mitigates the possibility of building kind of information stacks about one person based on an ID.

REHM

10:36:29
Jessica.

RICH

10:36:30
Well, I think it's a good development that one platform is putting out different IDs. But right now, there's been a lot of -- a lot written about the fact that the super ID is still available to everybody, and everyone is still using it. So this is a promising development if we're going to go in a direction where you can only identify someone in a limited -- for limited purposes, but that -- we're not there yet.

REED

10:36:58
No, and that's what we've got to work on.

REHM

10:36:59
You know, it sounds to me as though the technology is moving faster than we as parents, even human beings, are able to keep up with it. We're going to take a short break. But I just want to read you one email from Paul, who says, "Here's an idea: Take the smartphone away from the child. Children do not need a smartphone. If you must give them a phone, give them something basic without apps or social media." Short break. We'll be right back.

REHM

10:40:06
And we're back, talking about privacy online most especially for apps aimed and used by children. Let's go first to Raleigh, N.C. Good morning, Henry. You're on the air.

HENRY

10:40:24
Hi. Thank you very much. Thanks for taking my call.

REHM

10:40:26
Surely.

HENRY

10:40:27
I appreciate this topic. I've got a 7 and a 9-year-old. This is a topic that keeps my wife and I up at night. And our default has been what Paul's email mentioned. We just haven't given our kids any smartphones at this point, but we realize at some point, we're going to have to. And it seems to me that you all have hit at the heart of the issue that it's -- disclosure is not helpful for parents. Control is helpful, and some apps allow you to not use your push notifications or not use your location information.

HENRY

10:41:00
But what we're missing is to go above the app and give parents the ability to configure a device for use with children just the way that you slide the airplane mode on and off. If you had a child mode, you could slide on and that it was password-protected by the parents, and the parents could go in and say, turn off use of credit card. Turn off location. Turn off sharing of information. Then you could feel like you were -- you can hand over a device safely, and that technology seemed like it exists.

REHM

10:41:33
Is that on the way, Morgan?

REED

10:41:36
Well, it's more than on the way actually. We can use this as a bit of a teaching moment for all of your listeners who have an iOS device. You can go into settings, and there's one page for restrictions and that's exactly what it does. It allows you to set up a separate password, and you can restrict all of this private information for your child under a different password than the device.

REED

10:41:56
And Microsoft's version is they allow you to designate your child on the device -- give them a name -- and then restrict access to certain portions of the device by saying, hey, Sally is my child, and here are the restrictions I want for Sally. So right now, Microsoft and Apple are definitely leading in this case. And on the iOS device, they have a separate restriction screen. Now, we need to do a better job about educating parents about it, and that's where we're falling short.

REHM

10:42:20
Is that going to work, Angela?

CAMPBELL

10:42:23
Well, I think that's a helpful stuff for, but there's -- a different problem is that the -- a lot of the -- our concerns are not device specific, and most of the third parties that had been mentioned are advertisers or advertising networks or advertising companies that, like, are bidding real time to reach specific types of people that they want to sell things to. And so even if you can turn it off on your iPhone, it doesn't necessarily mean that your child isn't being tracked.

CAMPBELL

10:42:50
For example, Viacom has this thing called Surround Sound where they can track specific individuals across all their platforms. So the computers, the phones, the iPads, everything they can -- and then target with the knowledge of the profile of that they have of that person, target ads specifically to them, and that obviously gives them the capability to really take advantage of children who, you know, don't really fully grasp advertising anyhow at a young age.

REHM

10:43:15
Cecilia.

KANG

10:43:17
Yeah. I mean, there are some ways to engineer your phones for sure, and there is -- there are steps forward, and parents can exercise more control if they put the effort into it. But I think Angela does bring up a good point is that that doesn't do much for the fact that companies are getting or tracking information about users through their device ID and through the device and through the apps themselves. And so the question is, you can try to engineer your funds, you can turn off the location and some other things, but it's -- you can still track a child.

REHM

10:43:46
Here's a tweet, which says, "The uneven bargaining power of problem is that you cannot choose what data you allow disclosed. It's all or nothing. Take it or leave it." Angela.

CAMPBELL

10:44:05
Yes, I think that's generally true. And what we'll see, like, for example, Nickelodeon has a single privacy policy for all of its -- everything. And so it says, well, we may collect this or we may collect that or we may share it with this or we may share it with that. And that's why you can't just make a rational decision about, well, I want it to be used for this purpose because it's educational, and I don't want to be used for marketing.

REHM

10:44:29
Jessica.

RICH

10:44:30
Well, this goes to an earlier point I made which is that the missing issue in a lot of disclosures and a lot of discussions is the difference between collecting the information for basic functionality and sharing it with third parties. And so if there's a take it or leave it and they say, oh, we're collecting your information because that'll enable us to provide your location which is essential to the map functioning, but then the information's all go into third parties and that's not disclosed as either there as part of education to parents. It is very much a take it or leave it. And that's really a problem.

REHM

10:45:09
Can private parties access that kind of information from a child's iPhone?

REED

10:45:20
Well, first of all, a child -- this gets to the point about a device. It isn't the child's device. It isn't the child's phone. It's actually the parent's device, and the parent is the one with the account on top of it. But now we're in...

REHM

10:45:31
But the child may be carrying it.

REED

10:45:33
But the child may be carrying it in any given moment. So this becomes part of the problem that we face. Now, I think we're talking about third-party sharing and how that works, and I want to bring up the uncomfortable subject about money. And the fact remains that advertising is a big part of how apps and other products get on these devices at a 99 cent price point.

REED

10:45:53
Because for all the discussion we're having here about protecting your child, the parent, when faced with a free app or a 99 cent app -- so we're not talking huge money, 99 cent -- we see 100-to-1, the parents will choose the free version over the 99 cent version. And the crazy part of that is how do they think -- I mean, and we need to do a better job of informing. But even when we tell them advertising is going to be part of this, they still choose the free.

CAMPBELL

10:46:23
Well, the difficult thing about advertising in children is that we have, for decades in this country, thought that children should be sort of safeguarded from too munch advertising. And over mobile devices and Internet technology, you cannot only just push ads, you can push ads at a very personal and targeted toward the children. So that adds another level of, frankly, sort of ickiness for some parents to consider.

CAMPBELL

10:46:47
And so the question is, should there be specific safeguards for -- that guards children from targeted behavioral advertising based on everything else they do on the Web? And so that's sort of the issue, and, yes, advertising is a big business, and it affords that free app. And the question that parents have to ask themselves is, OK, am I OK with that with my child?

REHM

10:47:08
All right. To Norfolk, Va. Hi there, Brett. Brett.

BRETT

10:47:13
Hi. Yes, ma'am?

REHM

10:47:15
Yes. Go right ahead, sir.

BRETT

10:47:17
Thank you. I was just sitting here listening. I love the show, and I was thinking that a possible good work around is all the phones, as was stated earlier, belong to the parent. And if the -- but the parent doesn't always know when a child downloads an app 'cause, you know, they could be at school downloading it or wherever and they can download an app.

BRETT

10:47:38
If the -- if -- when the parent gets a phone for their child and their child is age 13 and under, 14 and under or whatever age group they've come up with, that the parent receives a push notification, an email, that whenever the child downloads an app, an email automatically goes to the parent notifying that their child downloaded this app, and they'll have that information about what that app's going to do. And if the parent doesn't respond approving that app within, say, 24 hours, and then the app is automatically pulled off the child's phone until the parent approves it.

REHM

10:48:10
What do think of that, Angela?

CAMPBELL

10:48:13
Well, I mean, the children is on -- while in privacy protection, it does have something like that already that if, for example, a child wants to get a newsletter, they are allowed to do that as long as the app or the -- not just the app but the provider notifies the parents and gives them an opportunity for them to stop.

REHM

10:48:31
But what about games?

CAMPBELL

10:48:34
Well, but I think there's probably a lot of difficulty in the implementation of this at a more widespread model. I'm not sure. I would want to know -- I don't think that this is actually utilized that often. So I just don't know whether -- and it wouldn't solve the cross-platform problem either.

KANG

10:48:52
That is actually -- that those notifications are available to some extent In that whenever somebody in my family downloads an app on one of our iTunes, you know, devices, I get a notification when my child -- she's 9 -- when she downloads a book on her Kindle, I get a notification. I sort of like this idea, this latter part that the caller suggested and the ability to automatically block that if I wanted to. But I do know, and that there is a certain amount of disclosure for sure.

REHM

10:49:21
Tell me, Morgan, the reaction by the industry to the FTC report generally.

REED

10:49:31
Well, as I said earlier, I think in general, our members don't disagree with the findings. Their frustration has been an understanding of how do I meet these requirements. COPPA is expensive. Finding COPPA compliance has been expensive. The FTC estimates it costs about $9,000 -- a little over $9,000 just to implement the new version that's coming out. That's their estimate cost.

REED

10:49:55
And that may not sound like a lot, but it's worth nothing that most apps don't make over $3,000 in their lifetime. So a $9,000 upfront cost is significant. And the second part of it is I think we still are quite a ways away from the education that we need to have as developers about what are our best practice and how do we implement those.

REHM

10:50:12
Jessica.

RICH

10:50:14
I did want to take a second to make a point about the Children's Online Privacy Protection Act, which has been -- so the FTC right now has an effort to revise the Children's Online Privacy Protection Act to address some of the very issues that are being discussed today. So the proposal that's on the table -- and this is still being considered by the commission -- makes clear that precise geo-location is covered and, therefore, gets all the protections of the act, meaning you've to get parental consent before collecting it.

RICH

10:50:47
And in addition, the proposal attempts to cover device ID as personal information, again, bringing all the protections of the act for profiling. And then third, it proposes to cover these third parties that collect information through the apps and other mobile services. So I just wanted to have an opportunity to mention that, and that's pending at the commission. And if approved, it will address some of the issues we're talking about today.

REHM

10:51:19
You know, I asked a question earlier about whether an individual could follow a child by virtue of that use of a cellphone or an iPhone. For example, you've got tons of hackers out there. Suppose you had a predator, an individual predator, who spotted a child who had that kind of mobile device in hand. Is there a way that that predator could follow that child?

KANG

10:52:03
If the location service is on, they can, in that -- so Facebook, for example, does not technically allow anybody under 12 or younger to be on their site. But say you check in on Foursquare or Facebook into where your location is, you can be tracked, and then anyone who follows you on where your update is, where you are, can -- and, in fact, a colleague was just telling me about how his relative found her runaway child through location check-ins on Facebook. And so you can individually as long as -- if you don't turn off the location function, then theoretically you can.

REHM

10:52:44
Now, you mentioned earlier, Cecilia, that schools are now going to use these iPads.

KANG

10:52:55
Sure. A lot of schools actually have what they call one-to-one programs, an Apple iPad or a Microsoft Surface per child. There are private as well as public schools. There's a lot of government funding on the state and local level as well as in federal level to subsidize some of these programs. The idea among educators is very hot right now. The idea to use a tablet in replace -- in place of...

REHM

10:53:22
Books.

KANG

10:53:22
...you know, very heavy books, you know, weighing down your backpack, using games to enhance math curriculum, using games, you know, to -- for pattern recognition. And some of this -- and I've seen a lot of these. I've actually followed couple schools here in the area and watched -- it's really fascinating, really great tools in some ways.

KANG

10:53:41
I think you'd find educators, some educators you'll find also that they may be a little bit superfluous, not as useful as could be. But definitely, there is -- for a parent who -- in response to one of the callers, for a parent who wants to control the access to tablets and mobile devices, that's very difficult at this point.

REHM

10:53:59
Cecilia Kang of The Washington Post, and you're listening to "The Diane Rehm Show." Let's go to Put-in-Bay, Ohio. Good morning, Bob.

BOB

10:54:11
Good morning, Diane. I have an idea that sort of speaks to the wonderment about satisfying the lawyers for liability but also satisfying the parents' need for quick information. And that idea came to me from the ferry boat that we get on the island. Since 9/11, they have a sign up that says different levels of security 'cause we're a border town with Canada.

BOB

10:54:33
And that made me think of the movie rating systems whereby parents know instantly if it's a G-rated or R-rated or PG-rated. What that means, it is encompasses a whole bunch of different parameters. Maybe the privacy settings could do the same thing, that this is privacy setting A or B or C, and then parents would know very quickly exactly what that encompasses. And at the same time, the lawyers would be satisfied because it's all -- because it's common knowledge.

REHM

10:54:58
Jessica.

RICH

10:54:59
Interestingly, some codes and -- have been developed to do just that, and they provide ratings for various kids' apps. The thing is today, they haven't focus as much on privacy as we would hope, but I think they're moving into that area, and maybe they ought to call you and get your good -- more good ideas from you about it.

REHM

10:55:22
Jessica, what are the recommendations from the FTC to parents to all of us concerned about the issue of the privacy with these mobile apps?

RICH

10:55:35
The recommendations to industry are that all players in industry, and not just the apps, but the apps stores, the third parties that pull information through apps that I've been talking about and the developers really need to speed up efforts to make sure that instead of 20 percent of apps having disclosures to parents, that they all have disclosures to parents.

RICH

10:55:55
And then in the absence of disclosures, the tips for parents are some of the things that we talked about earlier, which is parents, right now, they need to try out an app that they are downloading for their kids. They need to look at the device settings and see if they can cut off certain functionality. They could look for disclosures and some -- they may find it for some apps but very few. So we recommend the other measures.

REHM

10:56:19
And just to let listeners know, we do have the FTC report on our website, drshow.org, with tips to parents and consumers generally. Last word, Morgan.

REED

10:56:36
So to your last caller, I'd say that groups Moms With Apps and Parents With Apps actually have been doing privacy notifications that are short and sweet. And websites like privacychoice.org, which is a nonprofit and a separate company, helps you look at your apps and figure out what information is collected. And companies like TRUSTe now have seal programs as well, so we're on the way.

REHM

10:56:56
Morgan Reed with the Association for Competitive Technology, Jessica Rich of the Federal Trade Commission, Cecilia King of The Washington Post and Angela Campbell of Georgetown University School of Law. Thank you for your work, and thank for bringing this information to our listeners. And thanks for listening. I'm Diane Rehm.

ANNOUNCER

10:57:28
"The Diane Rehm Show" is produced by Sandra Pinkard, Nancy Robertson, Denise Couture, Susan Nabors, Rebecca Kaufman, Lisa Dunn and Jill Colgan. The engineer is Erin Stamper. Natalie Yuravlivker answers the phones.
Transcripts of WAMU programs are available for personal use. Transcripts are provided "As Is" without warranties of any kind, either express or implied. WAMU does not warrant that the transcript is error-free. For all WAMU programs, the broadcast audio should be considered the authoritative version. Transcripts are owned by WAMU 88.5 FM American University Radio and are protected by laws in both the United States and international law. You may not sell or modify transcripts or reproduce, display, distribute, or otherwise use the transcript, in whole or in part, in any way for any public or commercial purpose without the express written permission of WAMU. All requests for uses beyond personal and noncommercial use should be referred to (202) 885-1200.

Our address has changed!

The Diane Rehm Show is produced by member-supported WAMU 88.5 in Washington DC.