Check It Twice: Santa Apps Could Be Stealing Your Personal Information!

Taking Action
This is an archived article and the information in the article may be outdated. Please look at the time stamp on the story to see when it was last updated.

You know Dasher and Dancer and Prancer and Vixen, COPPA and Cupid and Donner and Blitzen…

Whoops! COPPA is not one of Santa’s eight tiny reindeer. It’s the acronym for the Children’s Online Privacy Protection Act (COPPA), a law that gives parents more control over who collects information from and about their children. COPPA applies to all mobile apps and websites directed to kids, even those based at the North Pole.

The Apple and Google app stores list tons of holiday-themed apps; children can video chat live with Santa himself, light the menorah, watch Santa feed live reindeer, track his sleigh on Christmas Eve, relay electronic Christmas wish-lists, or play Hanukkah games like dreidel.

COPPA, updated in 2013, was designed to ensure that parents could consent to the collection of personal information from children under the age of 13. Personal information includes names and addresses, email addresses, birth dates, photographs, or geolocation information.

BBB’s Children’s Advertising Review Unit (CARU) is advising parents on how to use holiday apps this holiday season. Before allowing a child to download any app, CARU recommends that parents:

  • Read the Privacy Policy: Responsible apps directed to children provide a description of the service’s information collection practices before a parent or child downloads an app to their device. COPPA requires, at the very least, that the privacy policy be on the homepage of the app when you open it. If you can’t find a privacy policy, that’s a red flag. It’s very likely that they’re on Santa’s naughty list.A privacy policy should include: A list of who is collecting personal information; What information the device collects and how it’s used; How personal information is stored; Who has access to data; and a list of your parental rights.
  • Learn What Personal Information is Collected: Online services directed to children may not collect, maintain or share a photograph, video or voice recordings of a child from children without first getting consent from a parent or guardian. The law also requires that apps get parental consent before allowing kids to disclose personal information publicly. Check out what the app has going on before you allow your child to play with it.
  • Set Permission Requirements: Many apps that are listed as free in the app store have in-app purchases that might be accessed by children after a parent has allowed them to download the app.  Ensure that your child’s device is set to require a password for each download.
  • Be Wary of Free Apps: Most free apps contain more advertising than apps that require even a nominal fee. Free apps, even those labeled as educational, may have deceptive and disruptive advertising practices—some even advertise inappropriate content. Ads may pop up extremely frequently and kids are often required to view these ads in full to continue in the game. Ads may also trick kids into clicking by placing them behind enticing items like coins or adorable creatures. If an app is meant for both children and parents to use, then not all its advertisements may be appropriate for younger children; it may contain ads for games or films intended for older audiences.

CARU asks parents who come across an app or other online service that they think violates COPPA to file an anonymous consumer complaint on CARU’s website here.


To report a scam, call your BBB at 256-533-1640 or go to the BBB Scam Tracker. To find trustworthy businesses, visit

Trending Stories

Latest News

More News