Is Android right for your teen? – Adult content on Android – lack of age verification and restrictions

It is a warning/disclosure familiar to all of us. Before a movie preview is played before it displays preview rating (something like this preview has been approved for all audiences etc.). In fact, most parents pay attention to labels like ‘G’, ‘PG’, ‘PG-13’, ‘R’ etc. Though these ratings are from MPAA and are associated with movies, similar warnings are displayed at lot of adult sites. Difference being that for accessing adult content on the web (or through applications), application or a website asks a user if he/she is above 18 years old. If you click ok, it allows you to view explicit/adult content. Though less than ideal, this is still something that prevents accidental viewing of explicit contents by minors.

If an application accesses or displays adult/explicit content on iPhone, the user is warned during installation. In addition, there are settings that can be enabled under ‘Settings” -> “General” -> “Restrictions”. There are quite a few options to fine tune type of content allowed on the phone. One can tune music, movies (with specific ratings), TV shows and applications.

While we were researching Android Markets for our book Android Security – Attacks and Defenses  Android does neither of above. It does not warn a user that application will be displaying adult or explicit content. Neither does it provide fine grain controls like iPhone.

We installed an application that displays explicit content on Android. There were multiple failures on part of Android to either warn the users or to provide right warning and provide restrictions.
To use Android Market and get an application from there, we need a Google account. We first created a Google account through Android phone. Account creation did not require us to provide our age. We then used this account to download an adult application from Android Market. We were not prompted about explicit content warning or asked us to confirm if we were above 17 years or older. Once application was downloaded, Android did not warn us that the application contains/displays explicit material and if we were 17+ years of age.

One can argue that the application used in our example below is very graphic. Thus user would be aware that content is explicit or adult. However, at times application names might not be explicit about type of content they would display. For an application like craigslist, though adult content is not primary goal of the application, user can run across such content through the application.

There are many ways through Android can (and should) take care of this issue:

This slideshow requires JavaScript.

1. Creation of Google account through Android: User should be required to enter birth date before account is actually created. Content from Android market then should be restricted based on user’s age.
2. Android should explicitly ask user permission during installation if application contains explicit material.
3. Android should provide settings like iPhone where restrictions on content can be implemented. These should cover application, music, movies and so on. Android Parental Control is a free application available from Android Market and seems to be equivalent of iPhone restrictions. However, this type of functionality should be built into the platform itself.

Case study: Installing an adult application on Android

1. Create Google Account to access Android Market. Note that none of the steps require us to enter our age or birth date.
2. Android Market terms of service after Google account has been created.
3. Searching Android Market for an adult application
4. Installing ‘TV adult relaxation’ app from Android Market.
5. Permissions requested by the application (includes Phone calls!). Note application alert that it contains explicit content.
6. Application installs on the device
7. Opening the installed application

Another thing to note is that Google account created through website does not allow a new account if it does not meet age requirements. However, one can create an account through Android and the above check is not enforced.

Advertisements

---