Test accounts registered to a 13-year-old were able to download 135 apps capable of creating nude or sexualized images on Apple’s App Store and Google Play, including dozens of apps reached while parental controls were active, according to a Tech Transparency Project investigation released Monday.
The researchers created four U.S. accounts for a fictional 13-year-old boy: a default and parent-supervised account on each platform. The supervised Apple account could access 24 of the tested apps, while the supervised Google account could access 51. Apple and Google both prohibit apps that facilitate nonconsensual sexual imagery, but the test found that inaccurate age ratings, weak checks and paid features let harmful capabilities pass through controls designed for families.
The findings add direct testing to a problem that TechsCurrent covered in July, when San Francisco demanded stronger action against AI nudify apps. The new report is narrower and more practical: it examines what a young teen could actually find, install and buy, and what happened after stores removed offending listings.
How the teen-account test worked
TTP used the same age, gender and U.S. location for all four accounts. On one Apple account and one Google account, researchers enabled parental controls, restricted downloads to apps rated as suitable for a 13-year-old and required parental approval for downloads and in-app purchases.
Researchers then searched each store using 14 terms spanning obvious abuse language and ordinary editing queries, including “face swap,” “AI video generator,” “AI photo editor” and “AI try on.” Apple and Google blocked several explicit search terms, but less direct queries still returned apps that could alter uploaded images. TTP downloaded and tested the first 15 results for each query, including sponsored results, and also tested harmful apps advertised inside other apps.
The tests used AI-generated images of fictional adult women rather than photographs of real people. An app counted as nudify-capable if it could depict the person as nude, partially nude, in lingerie or in a bikini. That definition is broader than Apple’s stated interpretation: Apple told TTP it does not classify tools that change clothing to bikinis or lingerie as nudification, although the company separately bans nonconsensual intimate imagery.
| Test account | Nudify-capable apps accessed |
|---|---|
| Apple, default teen account | 61 |
| Apple, parent-supervised teen account | 24 |
| Google, default teen account | 47 |
| Google, parent-supervised teen account | 51 |
The figures overlap, so they should not be added together. Across all four tests, TTP identified 135 unique apps. Mobile analytics firm AppMagic estimated that those apps had accumulated 5.5 billion downloads and $3.9 billion in global revenue. Those totals include mainstream editing tools with legitimate uses as well as apps whose sexualized features were overt.
Age ratings were the main control failure
Both stores use questionnaires completed by developers to help assign app ratings. Parental controls can then block apps above a chosen maturity level. That structure breaks when an app’s rating does not reflect its behavior.
TTP found one iOS face-swap app rated for ages four and older that could produce a nude image from an ordinary photo and a text instruction. Another iOS app rated 9+ displayed sexual content at launch and advertised an undressing feature. On Google Play, an app rated Everyone generated a video matching a request to remove a woman’s top.
The supervised accounts were configured to require approval, but researchers approved apps that the stores presented as age-appropriate. This recreated the information problem facing a parent: the approval screen can show the developer’s rating and store description, not every model, template or paid feature that appears after installation.
TTP also reported a purchase-control gap. The test accounts used store gift cards to subscribe to paid features after approved apps were installed, and neither linked parent account received an alert. Apple said those purchases should have triggered approval and called the result unexpected behavior that it was investigating. Google did not answer the report’s question about the transactions.
Apple’s current parental-control guidance says Ask to Buy can require approval for downloads and purchases regardless of an app’s rating. Google’s Family Link documentation similarly lets parents approve downloads, block installed apps and set Play content restrictions. The investigation does not show that those tools have no value. It shows that approval is only as reliable as the listing a parent is asked to evaluate and the purchase events the system actually surfaces.
Removing an app did not disable it
As of September 28, Apple had removed 25 apps identified during the research and Google had removed six. Every removed app remained functional on the test phones, according to TTP. A store takedown can stop new downloads, but it does not necessarily revoke an installed app, cancel a subscription or shut down the developer’s remote service.
That distinction is important for families and schools responding to an incident. Finding that an app has disappeared from search does not establish that it has stopped working on a student’s device. Installed-app lists, subscriptions and saved media still need to be reviewed through the appropriate safeguarding process.
The report also recorded 13 nudify-app ads shown to the Apple accounts and five shown to the Google accounts. In some cases, sexualized advertising led directly to an app whose store page looked like an ordinary photo or video editor. TTP could not always determine whether Apple itself or a third-party ad network served a particular in-app ad, but the result exposed another discovery path that app-store keyword blocks do not cover.
Apple tightened its rules and Google removed apps
Three days after TTP contacted Apple for comment, Apple published revised App Review guidance on October 16. Rule 1.2 now explicitly requires platforms with user-generated or AI-generated content to prevent and remove nonconsensual intimate imagery. Rule 2.5.19 addresses developers that hide or add functionality after review, and Section 5 makes removal and alternative-distribution blocking explicit for apps tied to child exploitation.
Apple said it had acted on the remaining apps named in the report and argued that some were mainstream editors without nudification or deepfake capabilities. It described apps that reveal harmful features after approval as a bait-and-switch problem and said developers using that tactic can lose their accounts.
Google said it suspended violating apps and restricted related search terms. Its September developer guidance on nonconsensual intimate content says reviewers need full access to premium AI features, including tools behind subscriptions or geographic restrictions. It also tells developers to test explicit-editing and deepfake prompts, use separate input and output moderation, and monitor ads promoting their apps.
The enforcement challenge extends beyond apps openly marketed as “nudify” tools. A May systematic audit of 155 face-swap apps found that 70% lacked technical safeguards against nude face swaps. The researchers reported unrestricted results in 80% of tested iOS apps and 59% of tested Android apps. Ordinary photo editors, face-swap tools and virtual fitting rooms can carry the same abuse path even when their store listings appear benign.
What parents and schools can do now
- Require approval for every download and purchase. On Apple devices, verify Ask to Buy and age restrictions for the child’s account. On Android, set Family Link’s purchase and download approval to all content, then check that notifications arrive.
- Review installed apps, not only store ratings. Look for photo editors, face-swap tools, AI video generators and virtual try-on apps whose behavior changed after an update or subscription. Check subscriptions separately and cancel unwanted plans.
- Block the app on the device after a store takedown. Removal from a store does not guarantee that an installed copy stops working. Delete the app, revoke photo access where appropriate and review cloud or local output without redistributing abusive material.
- Handle school incidents as image-based sexual abuse. Preserve URLs, app names, account identifiers and relevant messages, but do not forward explicit files through informal chats or email. Follow the school’s safeguarding, evidence and law-enforcement procedures.
- Use a specialist removal service when appropriate. NCMEC’s free Take It Down tool can create an on-device hash of intimate images made when the depicted person was under 18, allowing participating public or unencrypted platforms to detect copies. The image does not leave the device. NCMEC warns users not to download or share an image solely to submit it.
Parental controls still reduce exposure when they are configured and monitored. The tests show why they cannot carry the entire safety burden. App stores also need behavioral review of paid features, accurate ratings, repeat checks after updates, ad enforcement and a response path that reaches already-installed software when an app is found to facilitate abuse.
