Singapore’s First App Store Safety Audit: Age Checks Held Up, but 65 Harmful Apps and 24 Mis-Rated Apps Got Through

Regulators rarely get to test a child-safety rule the way a child would. Singapore’s Infocomm Media Development Authority (IMDA) did exactly that this year, setting up test accounts on the five app stores designated under its rules, trying to download adult apps as a minor, and then posing as ordinary users to report apps that should not have been there. The results came out on October 24, 2026, in the regulator’s first Online Safety Assessment Report for Designated App Distribution Services, and they are more specific than the headline suggests.

On age checks, IMDA’s verdict was favorable with a footnote. On app content and age ratings, it found apps that had slipped through on every store it tested. For privacy teams, the less-noticed finding concerns how stores handle the personal data they collect to check a user’s age, which IMDA and Singapore’s Personal Data Protection Commission (PDPC) said was handled with some good practices and some gaps in the information provided.

What IMDA tested, and under what rule

The report covers April 1 to December 31, 2025 and assesses Apple App Store, Google Play Store, Huawei AppGallery, Microsoft Store (which IMDA defines as five storefronts, including the Windows and Xbox stores) and Samsung Galaxy Store. These are the five stores designated under the Code of Practice for Online Safety for App Distribution Services, which took effect on March 31, 2025. The Code was issued under Singapore’s Broadcasting Act, which the 2022 Online Safety (Miscellaneous Amendments) Act extended to online communication services.

IMDA drew on each store’s annual online safety report plus its own evidence: test accounts that simulated real user journeys, mystery shopper testing across more than 7,000 apps, and data from public reports to the regulator. It judged measures on whether they were present, comprehensive and effective. The Code is outcomes-based, meaning stores choose how to meet it. The full report and the factsheet that accompanied it are on IMDA’s website.

Overall, IMDA said baseline safety measures were in place across all five stores and that it found no systemic breaches of the Code, while noting weaknesses in how several measures were implemented.

Age assurance: present, mostly sturdy, not foolproof

IMDA’s wording on age assurance is precise, and it is worth keeping it intact. It found age assurance measures present and well implemented on all five stores. Its sample testing found that they generally could not be easily circumvented, and it said no age assurance method is completely foolproof. One exception stood out: a small percentage of Huawei AppGallery users were able to get around age assurance in specific circumstances on certain versions of the app because of technical limitations. According to the report, Huawei told IMDA that about 7% of its users were affected, and Huawei committed to working with IMDA to monitor and address the issue. That 7% is Huawei’s own account, not an IMDA measurement.

The methods themselves fall into three families that IMDA described: age inference from signals such as a credit card or behavioral data, age estimation through facial analysis, and age verification through official documents or Singpass, Singapore’s digital ID. Credit card inference was the most common, used by three of the five stores. IMDA reasoned it was a reliable signal because card ownership in Singapore carries a minimum age of 18, but it also noted that parents or guardians should make sure under-18s are not using their cards to download adult apps. For Google Play Store and Microsoft Store, where facial age estimation is used, it said the method has a high confidence level but should be combined with other methods for greater accuracy. The IMDA test accounts also found that a child can still get around checks, for example by using a parent’s account, as reported by CNA.

After a store decides a user is a child, the next test is whether the store actually restricts 18+ downloads by default. IMDA found those restrictions generally effective on all five stores, with exceptions on two. On Huawei AppGallery and Microsoft Store, restrictions were in some tested cases absent or could be switched off by the child. Huawei has resolved its issue, according to the report. Microsoft Store has an interim fix while it works toward a permanent one, and IMDA separately found a loophole in Microsoft Store’s parental tools that let children turn off the restriction, for which the store has identified a solution and is working to implement it.

The data protection findings

Age assurance is, mechanically, a data collection exercise: a card number or a government ID image, a face scan, or months of behavioral history are all processed to answer a single yes-or-no question. The Code says age assurance must follow Singapore’s Personal Data Protection Act 2012 and the PDPC’s guidelines, including the advisory guidelines on children’s personal data, which call for data minimization. IMDA’s earlier factsheet put it as collecting the minimum personal data necessary to establish a user’s age or age range, and publishing information on data protection policies and practices.

The PDPC reviewed what the stores provided and reported positive practices: notices and consent mechanisms specific to age assurance for several methods, measures to limit the personal data collected or kept for some methods, and deletion or non-retention of certain underlying documents used for age checks. It also flagged areas where more detail would have given a clearer picture. According to the report, those areas include:

• how previously collected account or payment information is reused for age assurance, and how users are told about that reuse;
• the roles and responsibilities of certain vendors involved in the checks;
• safeguards for particular age assurance records that are retained;
• retention and deletion rules for the age-check results the process creates.

The report is explicit that these observations are based on the information available for the review and are not an overall assessment of any store’s PDPA compliance. That caveat matters. These are gaps in documentation reviewed by a regulator, not findings of violations. They still map neatly onto the questions any organization should be able to answer about an age gate: what do we keep, who else touches it, and when does it go away.

Harmful apps and wrong age ratings

IMDA’s mystery shoppers found 65 apps containing or facilitating harmful content that violated the stores’ own policies, spread across all five stores, and 24 apps with 18+ content that were rated below 18+ on Apple, Google and Huawei. IMDA says all were removed or re-rated after it or its mystery shoppers reported them.

Sexual content accounted for most of the harmful apps. By CNA’s count of IMDA’s figures, 59 of the 65 contained sexual content, four contained violent content and two facilitated vice and organized crime. Of the 24 mis-rated apps, 14 had sexual content, three had violent content and seven facilitated vice and organized crime. IMDA’s examples included generative AI “nudification” apps, AI companion or dating apps with sexually explicit content, real-money or cryptocurrency gambling apps, and violent or horror-themed games.

IMDA took care to say that, against the very large number of apps on these stores, the numbers are small and do not indicate a systemic failure. It also said they show that some harmful apps can still get past store safeguards, and that it will keep holding stores responsible for minimizing exposure and for rating apps accurately and consistently.

User reporting and accountability

Every store offered ways to report problem apps, from in-store flagging to web forms, hotlines or chat. The weak point was the follow-through. IMDA found that all five either notified reporting users of outcomes inconsistently or failed to notify them. It also found that Google Play Store and Samsung Galaxy Store did not tell users who had downloaded an app in the previous six months when that app was later removed for a violation, which the Code requires. Google said implementation was challenging and that purchases and updates would be restricted for affected apps, and IMDA said Google is required to put a notification process in place. Samsung committed to push notifications or emails by the third quarter of 2027.

All five submitted the required accountability metrics, but all reported zero or near-zero user reports of harmful or inappropriate content, and IMDA said Google Play, Huawei and Samsung must supply better metrics, such as turnaround times, in their next annual reports. IMDA also said that if any store fails to satisfy it that weaknesses have been fixed, it will not hesitate to explore further options, including potential regulatory action under the Broadcasting Act.

1. Five questions to ask about any age-assurance setup

Most companies are not app stores, but plenty of them run age gates, parental-consent flows or youth-specific settings. The questions IMDA and the PDPC raised translate directly. These are our own suggestions, not requirements from IMDA.

1. What exactly is collected for the age check? A birth date field, a card inference, a document image and a face scan are very different data risks. Choose the least intrusive method that is adequate for the risk.
2. Is existing data being reused? If account or payment data collected for another purpose now feeds an age signal, check that your notice says so and that the new purpose is covered.
3. Who processes it? Name each vendor in the chain and write down what each can keep. IMDA’s observation about unclear vendor roles is a common weakness.
4. How long do check results live? The result of an age check (“over 18”) can be a retained record in its own right. Set a retention period for the result, not just for the source document.
5. What happens when the check fails or is bypassed? Huawei’s case shows that edge cases arise on specific versions and devices. Test across app versions and parental-control settings, and have a plan for remediation and notice.

A hypothetical for product teams

Imagine a small studio that publishes a chat-based companion app and labels it 12+ on every store, because the base game has no adult content. Its users can generate story text with an AI model, and some prompts produce sexual material. This example is invented for illustration. IMDA’s findings suggest that a store could re-rate or remove such an app after a mystery shopper flags it, regardless of the studio’s original self-declaration, and the studio would learn about it through the store’s process rather than its own monitoring. The practical response is to test the live product the way a reviewer would and to keep rating answers in step with what the app can actually produce.

How this fits the wider picture

Singapore’s approach is regulator-led and tested after the fact, using measured outcomes. The United States is moving through state laws that put duties on app stores and developers, such as the Texas App Store Accountability Act, covered in our report on the Supreme Court declining to block it. For a broader view of the technology and its risks, see our guide to age assurance technologies and standards. For Singapore data protection basics, the PDPA Singapore checklist is a starting point.

Where Captain Compliance fits

Captain Compliance does not provide age assurance technology, and nothing here is a claim that it can verify a user’s age. Its relevant work is around the data protection decisions. Its impact assessment service describes helping organizations decide when a data protection impact assessment is needed, guiding the assessment, documenting the results and identifying risks with recommended safeguards. Its privacy by design and default service covers privacy reviews at the planning stage of new products, privacy impact assessments before deployment, privacy-protective defaults aligned with data minimization, and assessments of cloud and technology vendors. Used on an age gate, that means documenting what the check collects, who handles it and how long it stays, which are the same gaps the PDPC pointed to. An assessment on paper does not prove the retention rule is actually enforced; that still needs a technical test.

Frequently asked questions

Does the report mean Singapore’s app stores violated the law?

IMDA said it found no systemic breaches of the Code of Practice. It found weaknesses in how several measures were carried out, and it said it will track improvements and may consider regulatory action if a store does not fix them.

Did age assurance work?

In IMDA’s words, the measures were present and well implemented on all five stores and generally could not be easily circumvented, with a limited exception on Huawei AppGallery. IMDA also said no age assurance method is completely foolproof, and the testing used a small sample.

Which stores had the most harmful apps?

By IMDA’s counts, Apple App Store had 30 of the 65 harmful apps removed. That figure reflects what the mystery shoppers found, not the size of each store’s catalog, and it should not be read as a safety ranking.

Does the report assess PDPA compliance?

No. The report says its data protection observations are based on the information provided for the review and are not an overall assessment of PDPA compliance by any store.

Does this affect app developers?

Indirectly, yes. The apps IMDA flagged were removed or re-rated by the stores. Developers that publish in Singapore should expect stores to enforce their own content policies and age-rating rules more closely, and the Code also expects stores to have policies for apps with user-generated content.

Is this relevant outside Singapore?

The legal duties are Singapore’s. The testing method, with test accounts, mystery shoppers and publication of results, is a model other regulators may borrow, and the data handling questions apply wherever age checks are used.

IMDA has now put a baseline on the public record, and the next annual report will show whether the checks that mostly held up this time still do. One number may be harder to explain than the 65 apps: all five stores reported zero or near-zero user reports of harmful content, in a review where IMDA’s own testers found dozens of apps worth reporting. Either the stores are cleaner than the testing suggests, or the report button is not being found.