  The digital age has brought a world of opportunity to children. Connectivity
can be a game-changer for some of the world's most marginalized children.
However, while legislatures around the world have enacted regulations to
protect children's online privacy, and app stores have instituted various
protections, privacy in mobile apps remains a growing concern for parents and
wider society. In this paper, we explore the potential privacy issues and
threats that exist in these apps. We investigate 20,195 mobile apps from the
Google Play store that are designed particularly for children (Family apps) or
include children in their target user groups (Normal apps). Using both static
and dynamic analysis, we find that 4.47% of Family apps request location
permissions, even though collecting location information from children is
forbidden by the Play store, and 81.25% of Family apps use trackers (which are
not allowed in children's apps). Even major developers with 40+ kids apps on
the Play store use ad trackers. Furthermore, we find that most permission
request notifications are not well designed for children, and 19.25% apps have
inconsistent content age ratings across the different protection authorities.
Our findings suggest that, despite significant attention to children's privacy,
a large gap between regulatory provisions, app store policies, and actual
development practices exist. Our research sheds light for government
policymakers, app stores, and developers.
