How do app stores restrict underage users? What apps are out of bounds?: askST

It is now mandatory for app stores in Singapore to screen and block people under 18 from downloading apps and games, such as those providing dating services or with sexual content, not meant for their age.

This requirement, which kicked in on April 1, is spelt out under the Infocomm Media Development Authority’s Code of Practice for Online Safety for App Distribution Services. It applies to Apple, Google, Huawei, Samsung and Microsoft as they operate stores or online portals for downloading apps.

The code aims to set guard rails at the gateway to apps that have come under fire for exposing children to harmful content such as sexual and violent material, and content linked to self-harm or cyberbullying.

The Straits Times examines what kind of apps are now restricted for under-18 users, and how app store operators handle data provided by users.

1. What apps are rated 18+?

Most app stores give dating apps such as Tinder and Coffee Meets Bagel an age rating of 18+. Huawei’s AppGallery does not carry these apps, but their equivalents such as Badoo and TrulyThai are rated 18+.

But checks done by ST on April 1 found that age ratings for apps can be inconsistent across the various app stores.

For instance, Monopoly Poker – Texas Holdem is rated 18+ on Apple’s App Store and Google Play store for simulated gaming and features such as loot boxes and in-app chat functions.

However, the same game on Microsoft Store in Singapore has been given a “Teen” rating – which states that the content is appropriate for those aged 13 and above.

Games under the Grand Theft Auto (GTA) series carry an 18+ rating on Apple’s App Store and the Google Play store for containing violence and drug use materials. But GTA V is given a 17+ rating on the Microsoft Store.

Apps that have been given an 18+ rating on the Microsoft Store include Rooms of Intimacy – advertised as a board game that helps to build intimacy between couples and contains strong sexual content.

Social media apps such as Reddit and X are also not rated equally across app stores. X is given an 18+ rating on Google Play store, while it is rated 16+ on Apple’s App Store. 

Reddit is given an 18+ rating on Apple’s App Store, while it can be downloaded by under-18 users on Google Play and Microsoft Store.

On Huawei’s AppGallery, messaging platform Telegram is given an 18+ rating. The app is rated 13+ on Apple’s App Store, and 12+ on Google Play.

2. Who decides on the age ratings for apps?

Before apps can be listed on Apple’s App Store, app developers must first complete a questionnaire that requires them to declare if their content carries references to alcohol and drug use, sexual material, violence, loot boxes, or the use of gambling or simulated gambling.

App developers must also provide details of in-app controls and capabilities, including the ability to broadcast user-generated content or chat functions. 

Apple will then assign an age rating, which varies depending on the country or region that the user is in. According to the company’s site for developers, apps that are rated 18+ by Apple can contain frequent nudity, realistic violence, and references to vices such as alcohol use.

Apps that contain gambling or frequent simulated gambling are also rated 18+.

For Microsoft Store and Google Play, ratings for apps are set by the International Age Rating Coalition (IARC). The IARC is a coalition of the world’s leading content rating agencies. Apps will be automatically assigned a rating after developers complete a questionnaire that is similar to the one for Apple app developers.

Apps that are rated 18+ by the IARC contain graphic violence, which includes depictions that are directed at defenceless characters or lack motive. These apps may also contain graphic sexual content, discriminatory acts, and glamourisation of illegal drug use.

Google also has reviewers to check if an app’s rating is aligned with its content, said the company in response to queries from ST.

“If our reviewers determine that an app’s rating is significantly lower than what the content warrants, we take action by rejecting new apps from entering the Store,” said Google.

“The developer is required to resubmit the IARC questionnaire to obtain an accurate rating, after which the app must undergo a new review.”

3. Do all account holders need to prove their age?

For Apple and Microsoft, app store account holders will be prompted to prove their age only when they attempt to download an app that is rated 18+. 

Apple’s App Store users can enter their credit card details or scan their ID (NRIC or driving licence), while those using Microsoft Store can do either or a facial scan to prove their age.

Galaxy Store users, on the other hand, will be prompted to verify their age when they open the app. Users who choose not to enter their credit card details will only be able to view and download age-appropriate content and features, said Samsung on its website.

Google Play users need not manually verify themselves as machine learning technology is used to estimate a user’s age by analysing account activity such as videos watched on YouTube. However, those who have been incorrectly identified as under 18 can scan their NRIC, enter their credit card details, or do a facial scan to verify their age.

Tests done by ST on Apple’s App Store found that a pop-up page is displayed before users are allowed to download a dating simulator, which requested that the existing credit card on file be used to verify that the user is above 18. Subsequent downloads of other apps rated 18+ did not ask for age verification.

A 17-year-old who helped with the tests found that he could not access the download page for Tinder on Google Play, and was prompted to verify his age via credit card, government ID or by taking a selfie. 

An added option also showed that Google can estimate his age by checking online data associated with his e-mail address.

4. Will a copy of my personal data be kept by the app stores?

Microsoft taps third-party provider Yoti to collect data such as the user’s selfie or NRIC, which is then deleted after the verification is complete. The firm will then notify Microsoft if the user is over or under 18, without giving up the user’s full identity or biometric data.

Those who verify their age through credit card details on the Galaxy Store and Huawei’s AppGallery can choose to delete their card after the verification process is completed.

“Credit card details will be used solely for the purpose of age verification,” said Huawei on its website.

On its site, Apple said it does not store credit card or ID details unless users choose to save them for other purposes, such as adding a payment method to their account.

Information collected by Google, such as one’s NRIC or credit card details, is stored securely in the user’s account or deleted a short time after successful verification, said Google.

For instance, a photo of the user’s NRIC will be deleted automatically after the user’s date of birth is verified, said Google, adding that users can choose to cover their NRIC number in the photo.

For facial scans, the company engages cryptography and biometrics firm Private ID to verify a user’s age.

“Google provides to Private ID only a random identifier for your Google Account,” said the firm, adding that no other data associated with one’s account is shared.

“When age estimation is complete, Private ID shares with Google if it can confirm you’re old enough. Your selfie is then deleted.”

Source: The Straits Times © SPH Media Limited. Permission required for reproduction.

ADV: Newly Published: The Singapore Torrens System After Baalman Shanmugam, Tan See Leng each awarded $210,000 in defamation suits against TOC’s Terry Xu