On 19 October 2026, a US digital advocacy group called the Tech Transparency Project published a test of the Apple and Google app stores. It set up accounts for a 13-year-old, switched parental controls on for some of them, and searched for "nudify" apps. These are apps that can take an ordinary photo of a person and make it look like they're undressed.
With parental controls on, the teen accounts could still reach dozens of them.
The test was done in the United States. But Australian children use the same two app stores. A day later, Australia's eSafety Commissioner told a parliamentary inquiry that these services see about 200,000 downloads by Australians a month. So here's what the test found, why the controls missed it, and what you can check tonight.
The researchers created four accounts, two on Apple and two on Google. Each was set up as a 13-year-old boy living in the US. One account in each pair was left on default settings. The other had parental controls turned on, limited to apps rated suitable for a 13-year-old, with every download and in-app purchase needing a parent's approval.
The results, as the report states them:
Yes, the supervised Google account reached more than the unsupervised one. The report points that out itself.
A few other findings matter for parents. Neither company required or even suggested parental controls when the teen accounts were set up. Both stores showed the teen accounts ads for nudify apps. When the supervised teen accounts bought subscriptions with a gift card inside apps already approved, the parent account wasn't alerted. Apple told the researchers that a purchase not triggering a request "would be unexpected behavior" and that it is investigating.
And removing an app from the store didn't switch it off. By 28 September, Apple had removed 25 of the apps and Google six, but every removed app kept working on the test phones.
Parental controls work off an app's age rating. On both stores, that rating comes from the developer's own answers to a questionnaire. The report calls it "essentially a self-reporting system". The Guardian, which covered the report the day it was released, put it the same way: the companies largely rely on developers to decide whether their apps suit certain ages.
So when a developer rates an app as fine for 9-year-olds, or for everyone, the controls let it through. Many of the apps in the test looked like ordinary photo editors, face-swap tools or outfit try-on apps on their store pages.
Both companies responded. Google said it suspended violating apps and restricted related search terms. Three days after the researchers contacted Apple, it added rules banning apps that generate "nonconsensual intimate imagery". Apple also told the Guardian that a number of the apps named are mainstream photo and video editors that don't have nudification capabilities.
The same iPhones, iPads and Android phones are in Australian homes, and the same stores sit on them. Speaking to the Joint Select Committee on Artificial Intelligence in Sydney on 20 October, eSafety Commissioner Julie Inman Grant said:
"These services represent about 200,000 downloads by Australians per month."
She also told the inquiry her office has taken legal enforcement action against eight nudify apps and services. And she described "increasing reports of deepfake image-based sexual abuse across Australian schools."
Parental controls are still worth having. The test simply shows they're a starting point, not the finish line.
If an image of your child has been made or shared, report it to eSafety at esafety.gov.au/report. Kids Helpline is there for them on 1800 55 1800, any time. In an emergency, call 000.
For the step-by-step on both phones, our iPhone vs Android parental controls guide is a good next read, and there's more at auntybea.app.
Read next: our guide →
Aunty Bea helps Australian families with what comes next, quietly. You'll never scroll your child's messages in Aunty Bea. You get a plain-English summary of what looked risky, and how to talk about it.
Get started free →