What 'Free' Apps and Games Actually Cost: Your Child's Data

Somewhere in your child’s tablet, there are probably 15 to 30 free apps. They’re games, creative tools, educational apps, and entertainment. Each one was built by a team of developers who needed to pay themselves and their servers. The app costs you nothing. So who’s paying?

The FTC’s 2023 report on mobile security updates found that children’s apps are among the most aggressively data-collecting categories on app stores. A 2023 study from the International Journal of Environmental Research and Public Health analyzed 100 popular children’s apps and found that 72% transmitted data to third-party trackers — companies that are not the app developer and whose data practices the parent never agreed to. Fifty-three percent continued tracking after the app was closed.

The “free app” business model isn’t a secret. But its specifics — what exactly is collected, where it goes, how it’s used — remain opaque for most parents.

Key Takeaways

• Most free children’s apps are funded by advertising, and ad targeting requires behavioral data collected from your child’s usage
• Third-party SDKs embedded in apps by developers collect data independently of the app’s own privacy policy
• The FTC has issued multi-million dollar fines to children’s app developers — including YouTube Kids — for COPPA violations
• Privacy labels in the App Store and Google Play are self-reported by developers and are frequently inaccurate
• Practical screening takes 5 minutes per app using Common Sense Media’s Privacy Not Included ratings

How the Business Model Actually Works

When a developer builds a free app, they embed what are called Software Development Kits — SDKs — from third-party companies. These SDKs provide useful functionality (analytics, ad serving, crash reporting, social sharing) without the developer having to build them from scratch. The trade is that those SDK providers collect data from every user of every app that embeds their code.

The major ad-serving SDKs are from companies like Google AdMob, Meta Audience Network, AppLovin, Unity Ads, and IronSource. When your child’s app loads an ad, the ad SDK is also:

• Recording the device’s advertising identifier (a persistent ID linked to your child’s behavioral profile)
• Logging app usage patterns (when the app is opened, how long it’s used, what actions are taken)
• Potentially reading device sensor data (motion, orientation, sometimes location)
• Correlating this data with other apps on the device that use the same SDK

The developer often has limited visibility into exactly what these SDKs collect. A developer might build a math game with genuinely good intentions, embed Google AdMob for revenue, and inadvertently become a vehicle for behavioral data collection that they didn’t design and can’t fully audit.

Specific Data Categories and Real Cases

Location data: Apps with location permissions can track where a child physically goes. This data is valuable to advertisers (target ads at people near a specific store) and sold to location data brokers who aggregate it. In 2022, the FTC took action against Kochava, a location data broker, alleging that the company sold precise geolocation data from apps used by children, including data that could be used to trace a child’s daily movements.

Behavioral and usage patterns: How often your child opens an app, what features they engage with, how long they stay, and at what point they stop — this behavioral fingerprint is used to build engagement models and ad targeting profiles. For children, this data is used to optimize the app to be more addictive and to target ads more precisely.

Contacts and social graph: Apps that request contacts access can map who a child knows and who they communicate with. This data helps build the “social graph” that advertising platforms use to understand relationship networks.

Device fingerprinting: Even without advertising identifiers, apps can build a device fingerprint from hardware characteristics, screen size, browser version, installed fonts, and other signals. This fingerprint can track a device across apps even if the advertising identifier is reset.

Biometric data: Face filters in kids’ apps — a common feature — can involve facial recognition processing. Whether this constitutes “biometric data” collection under laws like Illinois’ BIPA varies by jurisdiction. In 2023, TikTok paid $92 million to settle a class action lawsuit alleging it collected biometric identifiers from minors without proper disclosure.

FTC Enforcement Cases Every Parent Should Know

The FTC enforces COPPA, and its enforcement actions reveal what happens when companies get caught:

YouTube / Google (2019): $170 million fine. The FTC found that YouTube knowingly collected personal information from children under 13 on child-directed channels without parental consent. The settlement required Google to implement new COPPA protections and establish a COPPA-compliant YouTube Kids separate experience. Despite this, a 2021 follow-up analysis by research firms found ongoing issues with child-directed content receiving personalized ads.

Musical.ly (TikTok predecessor) (2019): $5.7 million fine. The FTC found that Musical.ly collected personal information from children under 13 without parental consent and failed to provide proper notice. At the time, the largest COPPA penalty ever. The fine was less than one day of the company’s subsequent revenue.

Turner Broadcasting / Cartoon Network (2014): $835,000 fine. For collecting personal information from children through games on websites that claimed to be directed at a mixed audience.

HyperBeard (2020): $400,000 fine. The developer of Chichens, a popular kid-targeted game, allowed third-party SDKs to track children’s behavior across apps.

The pattern in all of these cases: companies knew or should have known their app was used by children under 13, and failed to implement appropriate consent and data minimization requirements. The fines, while large in absolute terms, typically represent a small fraction of revenue, creating weak deterrence.

For a complete picture of COPPA’s protections and how to use them as a parent, see our guide to kids’ online privacy and COPPA.

Reading Privacy Policies Without a Law Degree

Privacy policies are deliberately difficult. They’re long, written in legal language, and designed to be comprehensive rather than comprehensible. But you don’t need to read the whole thing — you need to find the answers to four questions:

1. What data is collected? Look for a section titled “Information We Collect” or “Data Collection.” Red flag: vague language like “device information” or “usage data” without specifics.

2. Who is it shared with? Look for “Third Parties,” “Partners,” or “Service Providers.” Red flag: “We may share your information with our partners and affiliates” without naming them.

3. How long is data retained? Look for “Data Retention.” Red flag: no stated limit, or “for as long as necessary for our business purposes.”

4. Can you delete it? Look for “Your Rights” or “Data Deletion.” Red flag: the policy describes rights but makes the process difficult or unclear.

A faster approach: use the Terms of Service; Didn’t Read project (tosdr.org), which grades major platforms’ terms and privacy policies and highlights the most important clauses. Common Sense Media’s Privacy Not Included ratings (privacynotincluded.org) grade children’s apps specifically on data collection practices.

Practical App Screening Process

Before downloading any app for a child, run it through this 5-minute check:

Step 1: Look up the app on Common Sense Media’s Privacy Not Included (privacynotincluded.org). If they’ve reviewed it, you’ll get a grade and a summary of concerning practices.

Step 2: Check the App Store or Google Play privacy nutrition label (appears on every app page). Categories like “Data Used to Track You” or “Data Linked to You” with a long list are red flags. Note: these are self-reported and have been found to be inaccurate in studies, but they’re a quick first filter.

Step 3: Search “[App Name] + FTC” or “[App Name] + data collection children.” News and legal records about past violations often surface quickly.

Step 4: Check what permissions the app requests during installation. On iOS: Settings > Privacy & Security > [Permission Type] lists what each app has accessed. On Android: Settings > Apps > [App] > Permissions.

App Alternatives With Better Privacy Practices

Category	Popular “Free” Option	Privacy Concern	Better Alternative
Video	YouTube	Ad tracking, recommendation algorithm	YouTube Kids (restricted); Khan Academy Kids
Gaming	Most free mobile games	In-app purchases + heavy ad tracking	Toca Boca (paid, no ads); Osmo (paid)
Educational	Many “edu-games”	Third-party SDKs despite “educational” label	Khan Academy (nonprofit, minimal tracking)
Creative	Free drawing/art apps	Behavioral tracking, ad serving	Procreate Pocket ($5, no tracking)
Reading	Readsy, many “free” readers	Account creation + reading behavior profiling	Epic! (school-focused, COPPA-compliant version)

Paid apps generally have better privacy practices than free ones because their revenue model doesn’t depend on data monetization. This isn’t universal — some paid apps still collect data — but it’s a reliable heuristic for initial screening.

What to Do About Apps Already Installed

You can’t undo data already collected, but you can stop future collection:

Revoke unnecessary permissions. Go through every installed app and remove any permission that isn’t strictly necessary for the app’s function. Location for a coloring game: no. Camera for a drawing app: maybe. Contacts for a single-player game: absolutely not.

Reset the advertising identifier. On iOS: Settings > Privacy & Security > Tracking > Limit Ad Tracking (and Settings > Privacy & Security > Apple Advertising > Personalized Ads: off). This doesn’t delete past data but breaks the connection to future collection. On Android: Settings > Google > Ads > Delete advertising ID.

Request data deletion for covered apps. For any app covered by COPPA (used by your child under 13), you can request that the company delete your child’s data. Many apps have a “delete my data” option in account settings; for those that don’t, email the developer’s privacy contact listed in the privacy policy with a written request.

Uninstall apps your child hasn’t used in 30 days. Unused apps that have permissions granted continue to have those permissions. If your child has moved on from an app, delete it.

What to Watch For Over the Next 3 Months

Month 1: Do a permission audit on every device your children use. Go through Settings > Privacy and look at what each permission category lists. Revoke anything that doesn’t make sense.

Month 2: Run the 5-minute screen on the top 10 apps currently installed on each child’s device. Use Privacy Not Included and the App Store labels together. Delete any app that has significant concerns and no good substitute.

Month 3: Set up a family rule for new app requests: before any free app is installed, it goes through the 5-minute check together. This teaches the skill to children as they get older — eventually they can run the check themselves. Connect this to our broader discussion of talking to kids about data privacy.

Frequently Asked Questions

My kid’s school uses Google Classroom and assigned specific apps. Do I have to worry about those?

School-assigned apps should fall under the school’s vendor agreements and COPPA compliance requirements. Your school district is required to ensure that educational apps used with students under 13 comply with COPPA. Ask your district’s technology coordinator for their vendor data agreements and privacy assessments.

Are in-app purchase games safer than ad-supported games because they don’t sell ads?

Not necessarily. Many games monetize through both ads AND in-app purchases. Even games that primarily monetize through purchases often embed analytics and behavioral tracking SDKs that report user behavior. Check permissions regardless of the monetization model.

What is an advertising identifier and why does resetting it help?

An advertising identifier (IDFA on iOS, GAID on Android) is a unique, resettable ID assigned to your device that advertising networks use to track behavior across apps. Resetting it creates a new ID, breaking the link between your child’s past data and future data collection. It’s not a complete solution but it disrupts the longest-running behavioral profiles.

My child is 14 — does COPPA still protect them?

No. COPPA applies only to children under 13. For teens 13 and older, data collection is primarily governed by platform terms of service and emerging state privacy laws. California’s CPRA, the Virginia CDPA, and the Texas Data Privacy and Security Act all have provisions relevant to teens, but enforcement varies significantly. Federal teen privacy legislation (like the KOSA bill) has been debated but not comprehensively enacted as of 2026.

How do I explain to my child why they can’t have a specific free app without making them feel restricted?

Frame it as a resource allocation problem: “Companies need to make money. When an app is free, the way they make money is by learning things about you and selling that information to advertisers. Some of that is fine; some of it we’re not comfortable with for this particular app.” This is a factual explanation that treats the child as capable of understanding a business model, which most kids over 8 genuinely are.

---

About the author

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. Federal Trade Commission. (2023). “Mobile Security Updates and the Market for Lemon.” FTC Report. https://www.ftc.gov/reports/
2. Federal Trade Commission. (2019). “Google and YouTube to Pay Record $170 Million.” FTC Press Release. https://www.ftc.gov/news-events/news/press-releases/2019/09/google-youtube-pay-record-170-million-alleged-violations-childrens-privacy-law
3. International Journal of Environmental Research and Public Health. (2023). “Data Privacy Practices in Children’s Mobile Applications.” MDPI. https://www.mdpi.com/journal/ijerph
4. Common Sense Media. (2025). “Privacy Not Included: Children’s App Ratings.” privacynotincluded.org. https://privacynotincluded.org/
5. FTC v. Kochava. (2022). Case No. 2:22-cv-00377. U.S. District Court for the District of Idaho. https://www.ftc.gov/legal-library/browse/cases-proceedings/222-3088-kochava-inc
6. COPPA Rule. (2024). 16 C.F.R. Part 312. Federal Trade Commission. https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa