Are free chat apps really free?

How Free Chat Apps Make Money (If Not Through Purchase)

The promise of “free” is incredibly appealing, especially for parents, educators, and SLPs working with limited budgets. But free chat apps almost always employ alternate business models to generate revenue. Understanding these is the first step to being an informed user or recommending technology ethically in clinical or educational settings.

• Advertising: Many free apps display “sponsored” content or targeted ads. Even child-focused apps may use advertisements based on user activity, preferences, or even location, unless there are strict legal safeguards in place.
• Data Monetization: Apps frequently collect personal and behavioral data, which is sometimes sold to third parties or used to build detailed user profiles for advertising purposes.
• In-App Purchases & Upgrades: The app itself is free to install, but communicating longer, unlocking features, removing ads, or accessing “premium” content may require payment.
• Affiliate Marketing & Cross-Promotion: Some apps promote partner services or products and receive commissions or referral fees.

What Kind of Data Do Free Chat Apps Collect from Children?

Many people assume an app collects only chat messages and usernames. However, especially for children under 13 and those using apps for learning or therapy, the data collected can be broad and invasive.

Here are common types of data collected by free chat apps:

• Full names, email addresses, phone numbers
• Profile pictures, voice messages, location data
• Device identifiers, IP addresses, and browsing activity
• Audio and video files (including a child’s voice or image)
• Usage patterns: when the app is used, for how long, and with whom
• Diagnostic and performance data from the child’s device

This information can be particularly sensitive when it pertains to children with special communication needs. Under U.S. and international privacy laws, items such as a child’s voice sample, photo, or recorded conversations are considered personal information and must be protected.

Why Should SLPs and Parents Worry About Free Apps?

The convenience of free chat and communication apps is undeniable, but that convenience can come with hidden dangers for children. Here is why you should be cautious:

• Privacy Risks: Children’s personal information is particularly valuable and vulnerable. If an app fails to follow strict data privacy laws, a child’s identity, voice, or behavioral patterns might be exposed or sold.
• Unregulated Content: Free apps, especially those that provide the ability for children to chat with strangers, often have weaker content moderation features. Inappropriate language, bullying, or even contact from adults can occur if oversight is poor.
• Data Security Threats: Not all free apps use modern security practices. Unencrypted data could be leaked in a breach, potentially exposing sensitive health or educational information, especially relevant for children using Augmentative and Alternative Communication (AAC) or similar tools.
• Inadvertent Consent: Many apps make it easy for kids (and parents) to agree to terms without truly understanding what they are consenting to, leading to data collection the family may not be aware of.
• Professional Liability: For SLPs, using or recommending an app that mishandles client data could violate professional ethics or even result in significant legal penalties.

The Legal Landscape: Laws Governing Free Chat Apps for Children

Understanding compliance is crucial for anyone who works with or cares for children with speech and communication needs. In the United States and increasingly worldwide, the following legal frameworks define how children’s data must be handled:

1. Children’s Online Privacy Protection Act (COPPA)
   COPPA applies to any online service directed at children under 13 or knowingly collecting information from them. It requires parental consent before data collection and spells out specific rules on what data can be collected, how it must be protected, and what parents have a right to review or delete.
2. Health Insurance Portability and Accountability Act (HIPAA)
   If the chat app is offered through a healthcare provider or SLP practice and used for therapeutic purposes, it may fall under HIPAA, requiring additional safeguards for any health or therapy-related information.
3. State-Level Privacy Laws
   Some states, such as California with their Age-Appropriate Design Code (AADC), add even more stringent requirements, extending protections to all minors (not just under 13), mandating design features that default to privacy, and restricting certain kinds of advertising and profiling.
4. International Regulations
   In Europe, the General Data Protection Regulation (GDPR) sets the age of digital consent at 16 in many countries and emphasizes clear, child-focused explanations of privacy practices with an emphasis on transparency and control for both parents and children.

What is Verifiable Parental Consent? How Do Apps Obtain It?

Verifiable Parental Consent (VPC) is the legal gold standard for protecting children’s data online. Before collecting any personal information from a child, the app must ensure that a parent, not the child, has truly authorized it.

Methods to Obtain VPC:

• Signed consent forms returned by mail or email
• Monetary transaction such as a nominal credit card charge
• Video conferences with trained personnel
• Knowledge-based authentication (questions only a parent can answer)
• Text-message verification with additional steps

If an app does not explicitly ask for and receive VPC via one of these methods, and it is directed to children or used in a clinical context, it is a major red flag for privacy compliance.

Main Privacy and Safety Concerns for SLPs and Parents

For anyone supporting children with communication challenges, the stakes for choosing a compliant app are even higher. Here’s what SLPs and parents should confirm, and the main risks to watch out for:

• Data Minimization: Ethical and legal best practices mandate that apps should only collect the data absolutely necessary for that child’s participation or progress and not anything more.
• Third-Party Data Sharing: Is any data being shared with outside parties for analytics, advertising, or other reasons? This can easily violate privacy laws if not controlled.
• Encryption Standards: Is all data (messages, media, and usage patterns) encrypted both in transit and at rest? Weak or absent encryption is a common failure in free or hastily built chat apps.
• App Store Compliance: Apple and Google impose strict requirements for child-directed apps, often stricter than federal laws. For instance, Apple’s Kids Category bans third-party tracking and requires human-reviewed ads, while Google’s Families program prohibits precise location or persistent identifiers from being collected from children.
• Easy-to-Understand Policies: Privacy policies must be easily accessible, written in clear language, and provide step-by-step instructions for parents to control their child’s information.
• Parental Controls and Gates: Features that prevent kids from accessing outside links or making purchases without adult approval are essential.

Checklist for SLPs and Parents Vetting a Free Chat App:

1. Does the app require verifiable parental consent to collect any personal information from children?
2. Is the privacy policy clear, accessible, and age-appropriate?
3. Does it use encryption and industry-standard protection for all data?
4. Are there robust parental controls or “gates” for any commerce or external links?
5. Is there transparency about any ads or third-party data sharing?
6. Can you easily contact the company with privacy questions or to manage/delete your data?

Special Considerations for SLPs: Ethics, ASHA Guidelines, and Professional Risk

The American Speech-Language-Hearing Association (ASHA) ethics code is explicit: maintaining confidentiality and protecting client information is not optional, whether in clinic, tele-practice, or through digital tools. SLPs must understand and comply with all privacy rules relevant to any technology they use, this includes ensuring any chat or communication app meets the highest standards expected by both law and ASHA’s professional standards.

• SLPs should only recommend or use apps that offer “enterprise-grade security” including robust user authentication and data encryption.
• Client data should never be exported, backed up, or transmitted through unsecure third-party tools.
• Consult with legal or compliance advisors if integrating with schools or health systems that trigger HIPAA requirements.

Case Study: What Happens When Chat Apps Are Not Compliant?

Many high-profile fines have been levied against companies whose apps failed children’s privacy requirements. Civil penalties can reach tens of thousands of dollars per violation under COPPA, and major platform bans or public backlash can devastate a company’s reputation overnight.

Smaller, lesser-known free apps may be even riskier, as they might not have the infrastructure or awareness to comply with evolving rules or to protect user data against attacks. If you are an SLP or parent, the safest path is to stick with apps that are proactively transparent and regularly update their compliance as laws and best practices evolve.

Global Trends in Privacy: Why International Laws Matter

Even if you are in the United States, you may be using apps developed overseas or distributing tools to families beyond national borders. European and Canadian data laws require even higher standards of consent and privacy. In the EU, the GDPR demands that notices be plain, concise, and enhanced with multimedia (icons, videos) when possible, so children can really understand them. Jurisdictions may set digital consent at age 16 or higher, broadening the list of apps needing strict scrutiny.

Summary Table: Legal Requirements at a Glance

Actionable Steps for Choosing Safe, Compliant Chat Apps for Kids

1. Read the privacy policy thoroughly and look for clear details about what is collected and who can access it.
2. Look for badges or mentions of COPPA-compliance, HIPAA-readiness, or equivalent international standards.
3. Check for user reviews or feedback from other families or practitioners regarding data privacy issues.
4. If possible, use paid versions or “pro” upgrades of trusted apps, as these typically reduce advertising and data harvesting.
5. Stay updated: regulations change, and an app that was safe last year may not meet evolving standards today.

Frequently Asked Questions (FAQ)

1. What is the difference between COPPA and HIPAA when it comes to free chat apps for kids?

COPPA regulates how commercial apps collect and use children’s personal information online, requiring parental consent for users under 13. HIPAA applies when those apps handle protected health information for therapy or are used through medical providers. In such cases, both laws may apply, and the app must meet the standards of the more stringent regulation.

2. Can a free chat app collect a child’s voice or picture without parental consent?

No. Under COPPA and similar international laws, collecting a child’s voice or image is considered obtaining personal information and is only lawful when verifiable parental consent is secured.

3. Are all kid-friendly apps in the App Store or Google Play Store safe for children?

Not automatically. Both Apple and Google have strong policies, but some non-compliant apps slip through, and rules change. Always double-check privacy policies and user reviews, and look for compliance verification within the app’s listings.

4. What should I do if I believe a free chat app is violating my child’s privacy?

You can contact the company directly and demand investigation or data deletion. In the US, you may also file a complaint with the Federal Trade Commission (FTC) or your state attorney general. Many other countries have similar watchdog agencies.

5. Is using a paid app always safer than a free one?

Not always, but paid apps have less incentive to monetize through ads or data sharing. Nevertheless, always verify that the paid version adheres to strong privacy and security standards before use in therapy or at home.