Children's digital privacy on fast-food and dine-in restaurant mobile applications

Children are targeted by unhealthy food marketing on digital media, influencing their food preferences, intakes and non-communicable disease risk. Restaurant mobile applications are powerful platforms for collecting users' data and are popular among children. This study aimed to provide insight into the privacy policies of top dine-in and fast-food mobile apps in Canada and data collected on child users. Privacy policies of the top 30 fast-food and dine-in restaurants in Canada were reviewed. A convenience sample of 11 English-speaking Canadian residents aged 9-12 years with fast-food apps on their mobile phones were recruited to use ≥1 fast-food restaurant mobile app(s). Children used the app(s) for 5-10 minutes and placed food orders. Parents submitted a Data Access Request (DAR) on their child's behalf to the food company. Descriptive analysis and a flexible deductive approach to content analysis evaluated data collected through DARs. Overall, 26 privacy policies were analyzed. The intended age of app users was indicated by 12 (46%) food companies, 10 (39%) of which specified it as ≥13 years. No company had a compulsory age verification process. Twenty-four (92%) companies disclosed the data collected on app users: 23 (89%) did not distinguish between information pertaining to children or adults, and 21 (81%) described a protocol for action if they inadvertently collected data on children. Twenty-four DARs were sent to companies; 11 (45.8%) of which were fulfilled by companies, and 4 (16.7%) resulted in the receipt of children's data. All responding food companies were found to collect sociodemographic information on child participants (e.g., name, email). Some collected other information, such as order details and available promotional offers. This study demonstrates current fast-food and dine-in restaurant privacy policies are insufficient and provides insight into data collected on children via fast-food apps. Policies must be strengthened to ensure children's privacy and protection online.