Evidence for reviewing children’s apps
Use an APK report to identify technical questions for your security and privacy review.
A detected SDK or service URL does not prove collection of children’s data. The scanner does not evaluate consent flows, determine an app’s audience, or certify COPPA compliance.
What to bring to a review
SDK inventory
- From the scan
- Recognizable advertising, analytics, or attribution SDKs in the recorded build.
- Needs your review
- Whether each SDK is active, its configuration, what it collects, and how age or consent choices affect it.
Service references
- From the scan
- Hard-coded URLs and cloud references, with finding guidance.
- Needs your review
- Actual runtime requests, server-side handling, access controls, and retention. New scans do not probe detected backends.
Build and coverage
- From the scan
- A scan date, available build identifiers, and analysis limitations.
- Needs your review
- Whether this is the released build, what was outside the scan’s scope, and what needs manual assessment.
Where COPPA guidance fits
The FTC explains that COPPA can apply to services directed to children under 13 and to general-audience services with actual knowledge of collecting personal information from children under 13. Application depends on facts beyond a static scan.
Use the FTC COPPA guidance with qualified counsel when assessing your app. For Google Play declarations, also consult Google Play Data safety guidance.
Informational product guidance, not a legal determination or safe-harbor certification.