Baby photo app sends a child’s age, name and gender to Facebook App Events
I tested an iOS app called Miracle: Baby Photo Editor (version 2.2.0) and found something I think parents should know about.
The app’s privacy policy explicitly states:
“We do not sell personal data, and we do not use your photos or your child’s data for advertising.”
So I recorded the app’s network traffic on my own device to see what actually happens.
During onboarding and normal use, I observed the app transmitting child-related information to third parties.
Mixpanel received:
the child’s first name
gender
age in months
age bracket
Those attributes were associated with a persistent Firebase user ID.
The Mixpanel request also contained ip=1, which allows Mixpanel to use the connecting IP address for geolocation/profile enrichment.
But what surprised me most was this:
Facebook App Events received the child’s age in months.
This happened even though Apple App Tracking Transparency had been denied.
I did not see any separate consent screen asking the parent for permission to send their child’s information to Meta/Facebook.
To be precise: seeing a value sent through Facebook App Events does not by itself prove that Meta subsequently used that specific value to target an advertisement.
But Facebook App Events is infrastructure used for app analytics, attribution and advertising measurement.
And that makes the privacy-policy statement:
“we do not use … your child’s data for advertising”
particularly concerning when the app is transmitting a child’s age directly into Meta’s App Events infrastructure without clearly disclosing it.
Even if the developer argues that this is “analytics only,” there is still another major problem:
The privacy policy does not appear to tell parents that their child’s name, gender and age are being transmitted to Mixpanel and Facebook in the first place.
This isn’t based on SDK detection or speculation.
I captured the actual outbound requests and the exact fields being transmitted.
I contacted the developer today and asked them to immediately stop transmitting child-related attributes to third-party analytics/advertising services, investigate deletion of previously collected data, and correct their privacy disclosures.
I’m giving them an opportunity to respond.
For a baby/child-focused app, I think parents deserve to know exactly where their children’s information is going.
https://redd.it/1vvkrd3
@r_privacy
