AGE ASSURANCE METHODS
In its report, IMDA also assessed age assurance methods for children, using information from the app stores’ annual online safety reports to the regulator and its own testing and data. The reporting period for app stores was between April and December 2025.
Age assurance methods include age inference, which uses credit card verification and behavioural signals such as search and watch history; age estimation through facial scans; and age verification through official documents such as Singpass. These measures must be implemented in accordance with the Personal Data Protection Act.
The regulator used test accounts to simulate and document the user journey at stages where age assurance may be triggered, testing the robustness of checks and ease of circumvention across device types.
It found that the age assurance methods deployed by app stores were present, and measures generally could not be easily circumvented
However, IMDA noted that no age assurance method is “completely foolproof”. A child can still circumvent these measures, such as by using their parent’s account to access age-inappropriate content.
Ensuring online safety, especially for young users, must be accompanied by measures such as public education and parental supervision, it added.
IMDA’s checks also found that children were largely restricted from downloading 18+ apps by default on all app stores.
However, on Huawei AppGallery and Microsoft Store, the tests uncovered a few instances where restrictions were absent or could be bypassed due to loopholes that let children turn them off. These have mostly been rectified after IMDA engaged the app stores.
App stores were also inconsistent in how they notified users of the outcomes of their reports via reporting channels. Google Play Store and Samsung Galaxy Store did not notify users who had downloaded an app within six months of its removal. Both have agreed to improve their notification processes after engaging with the regulator.
IMDA said it will continue to track progress of improvements and engage the app stores as necessary.
“Should any of the D-ADS (designated app distribution services) fail to satisfy IMDA that it has improved its measures to address the weaknesses, IMDA will not hesitate to explore further options, including potential regulatory action under the Broadcasting Act,” it said.
The regulator announced in January 2025 that it would require app stores to implement measures to protect children from inappropriate apps under the Code of Practice for Online Safety for App Distribution Services.
The code, issued under the Broadcasting Act, came into effect on Mar 31, 2025.
Speaking at the Digital for Life Festival at VivoCity on Saturday, Minister of State for Digital Development and Information Rahayu Mahzam said that while there was generally a “satisfactory baseline safety” observed through checks, there was room for improvement in age assurance for some of the apps, as well as the removal of harmful content.
“We have actually engaged with the designated app stores, and they have been forthcoming and indicated that they will continue to improve their efforts on this front,” she said.