“I was trying to figure out what these games were doing, and what they were asking for or collecting — in terms of geolocation, Wifi data and information that violates their privacy policy,” Kauffman said.

She participated in the Communications & Technology Law Clinic at Georgetown’s Institute for Public Representation (IPR), a public interest law firm that takes on cases at the intersection of law and technology. Under the leadership of Professor Angela Campbell, Kauffman, Bridget O’Connell (L’19), Rachel Johns (L’19) and Staff Attorney/Teaching Fellow Lindsey Barrett (L’17) worked on identifying the unfair tactics that apps use to lure kids into watching advertisements and making purchases to advance in a game.

On December 19, the clinic filed a request to the Federal Trade Commission (FTC) on behalf of the Campaign for a Commercial-Free Childhood, the Center for Digital Democracy, and 20 other consumer groups to investigate Google. The request asks the agency to investigate whether Google is misrepresenting to parents that the apps in Google Play’s family section are safe and kid-appropriate.

The clinic staff allege that many “family” apps not only contained content inappropriate for kids and violated Google’s own criteria, but they violated the Children’s Online Privacy Protection Act (COPPA) by collecting personal information from children without giving notice to parents and obtaining consent. By labeling such apps as family-friendly, the complaint alleges, Google is misleading users.

“Given that the students are fairly new to the subject area, this project provided a helpful glimpse into one of the unfortunate realities of privacy law — enforcement is spotty, to say the least,” Barrett said.

Kaufmann said the biggest thing she learned is that consumers really don’t know what they’re giving permission for. She noted that among the games she played, she might be the only person who had ever read every word of the privacy policies. Still, Kaufmann delighted in being able to work as a lawyer in the clinic.

“In meetings with clients, I got to voice my ideas and concerns, which I hadn’t been able to do, even in jobs and internships,” she said.

Problems

At the beginning of the semester, the students read a content analysis of advertising in apps for young children conducted by Dr. Jenny Radesky at the University of Michigan. The study found that most popular children’s apps target young kids with manipulative tactics.

“That made us wonder, ‘Are there legal violations?’” said Campbell.

The students downloaded and played numerous apps from the Play Store’s family section, recorded their observations, documented app practices and analyzed compliance with FTC policies and rules.

“They found so many problems with so many apps,” Campbell said. “Beer and gambling ads and games that are advertised as free but you can’t play them without spending a lot of money for virtual goods.” (For instance, “Strawberry Shortcake Puppy Palace” asks children to pick a puppy, and only one of the eight is free; the others have locks and require the purchase of activities to keep the puppy happy.)

The students used AppCensus, a collaboration led by the Berkeley Laboratory for Usable and Experimental Security that analyzes Android apps and reports the private and personally identifying information that the apps access and share with other parties (i.e. ad networks and analytic services).

“All those factor into thinking about protecting children,” O’Connell said. “You don’t want [anyone] tracking kids’ movements on the internet or collecting images without parents’ consent.”

Wild West

Johns, who was drawn to the clinic because of her interest in privacy law, worked on determining whether Google Play apps were violating COPPA and the FTC Act. She found that a surprising number of developers did not encrypt children’s data properly before they sent it to third parties.

The complaint prompted three high-profile members of the Senate Commerce Committee to request that the FTC investigate Google’s COPPA violations. It also yielded extensive media coverage, including an editorial in The Washington Post urging Congress to adopt comprehensive privacy rules.

O’Connell said the media coverage was significant because the average consumer and parent has no idea how widespread the problems are.

“It’s like the Wild West when it comes to how your data is being collected,” she said. While working in the clinic, she said she often thought about the parents who are thankful to have this problem exposed. “In the clinic, we got to see the law come alive. That’s why you want to be a lawyer.”