Singapore App Store Audit Finds 65 Harmful Apps and 24 Age Rating Failures

More than 7,000 apps checked across five stores

Singapore ordered the removal of 65 apps containing harmful content and secured corrected age ratings for another 24 after its first assessment of five major app stores. Sexual content accounted for 59 of the removed apps, including artificial intelligence tools that turn photographs of clothed people into sexually explicit images without their consent.

The Infocomm Media Development Authority (IMDA) published its Online Safety Assessment Report 2026 for Designated App Distribution Services on October 24, 2026. The assessment examined Apple App Store, Google Play Store, Huawei AppGallery, Microsoft Store and Samsung Galaxy Store, drawing on checks of more than 7,000 apps and annual safety reports covering April 1 to December 31, 2025.

IMDA found basic protections in place across the five stores, with age checks generally difficult to bypass. Its testing nevertheless uncovered harmful apps that had escaped removal, adult content carrying unsuitable age ratings and gaps that allowed some children to download apps rated 18+.

IMDA, Singapore's regulator for the media and digital sectors, said the stores would remain responsible for reducing exposure to harmful material and applying age ratings correctly.

"We will continue to hold designated app distribution services responsible for ensuring that users' access or exposure to harmful content on their services is minimised, and that age ratings are applied accurately and consistently," said IMDA.

The findings bring together three practical problems for families: whether an app belongs in a store at all, whether its age label accurately describes its content, and whether a child's account actually blocks access to adult material. Singapore's assessment found weaknesses at each of those points.

What the removed apps contained

Sexual content dominated the removal findings. Alongside the 59 apps in that category, IMDA identified four containing violent content and two containing material that facilitated vice and organised crime. Examples included a game featuring excessive violence and murder, and a gambling app offering payouts in cryptocurrency or real money.

Nudification tools were among the most intrusive examples. These apps use AI to generate an explicit image from an ordinary photograph. The person pictured can become the target of a fabricated sexual image without agreeing to either its creation or its circulation.

Apple's store accounted for 30 of the 65 apps identified for harmful content, about 46 per cent of the total. The assessment covered five stores, but the figures released do not provide an equivalent breakdown of how many apps were checked on each platform.

All 65 apps were removed after IMDA notified the stores. The authority did not identify the individual apps or publish how many people in Singapore had downloaded or used them. For families trying to understand past exposure, those missing details leave the scale of actual use unknown.

Why 24 apps needed adult ratings

Another 24 apps could remain available but needed an 18+ rating under the stores' own rules. Fourteen contained sexual content, three contained violent content and seven contained material facilitating vice and organised crime. These apps came from Apple, Google and Huawei.

Examples included AI chatbots with sexualised prompts, games involving adult sexual experiences, a game featuring weapons in a school setting, and a role playing game built around crime and drug use. The stores corrected the ratings after IMDA intervened.

Sexual content represented about 91 per cent of the removal cases, calculated from 59 out of 65, compared with about 58 per cent of the rating corrections, or 14 out of 24. Material involving vice and organised crime formed a larger share of rating corrections, seven out of 24, than removals, two out of 65.

Age ratings are a working part of parental controls. A child's account may be configured to block adult apps, yet an adult app carrying a younger rating can pass through that filter. Accurate labels also help parents decide whether to approve a download.

How Singapore tested age checks

IMDA used test accounts across different types of devices to follow the steps users encounter when an age check is triggered. It examined both the checks themselves and how easily someone could get around them, alongside information submitted by the stores.

Age assurance is the broad term for establishing whether someone falls within an age group. Verification checks an identity document or another verified record. Estimation uses signals, such as facial analysis, to judge a likely age range. Inference draws on information such as account activity, search history or viewing patterns.

The stores used combinations of identity documents, Singpass, credit card information, facial scans and behavioural signals. Microsoft offered verification through Singpass, an identity document or facial selfie analysis. Google used account activity to estimate age, while Samsung and Huawei relied on linked credit cards.

IMDA found that the methods were generally implemented well and were difficult to circumvent. A child using a parent's account remained a practical way around protections, making account supervision another part of keeping adult content away from children.

Personal information collected for these checks falls under Singapore's Personal Data Protection Act. Guidance from the Personal Data Protection Commission says information collected for age assurance should not be retained once that purpose has been fulfilled, including for later content targeting. Close to 80 per cent of parents consulted by the government supported age verification or estimation, while also wanting privacy safeguards and limits on data collection.

Huawei and Microsoft faced access gaps

Huawei AppGallery had technical limitations on particular versions that allowed some users to bypass age checks. About 7 per cent of its users were affected by that version issue. Huawei has since resolved the problem, according to IMDA.

Testing also found limited instances in which children could download apps rated 18+ through Huawei and Microsoft. Restrictions were either missing or could be switched off. Microsoft's parental tools contained a gap that allowed children to disable restrictions.

Microsoft introduced an interim solution and was working on a permanent fix. IMDA did not give a completion date for that work. Across the stores, children were otherwise largely blocked from downloading apps rated 18+ by default.

These findings show why an age check and a download restriction need to work together. A store first determines the user's age, then applies the appropriate access settings. If the second step is absent or can be disabled by the child, knowing the user's age offers little practical protection.

Users were left without enough follow up

All five stores offered channels for reporting harmful apps and problems such as fraudulent reviews. They were inconsistent, or failed entirely, in telling users what happened after a report.

Google Play Store and Samsung Galaxy Store also failed to implement the notification requirement for users who had downloaded a removed app during the preceding six months. Both agreed to improve their processes after discussions with IMDA.

A removal notice can tell a user that an app they previously trusted has breached store rules. Feedback on a complaint also lets the person who raised it know whether the store investigated and acted.

Google, Huawei and Samsung were asked to provide better data measures in their next annual safety reports. Those reports are intended to help IMDA assess how well protections work, rather than simply record which tools exist.

IMDA said it would track the promised improvements and consider regulatory action under the Broadcasting Act if a store failed to address its weaknesses. Minister of State for Digital Development and Information Rahayu Mahzam said the checks showed a satisfactory baseline, while identifying room to improve content removal and age protections.

How the rules developed

Singapore announced the Code of Practice for Online Safety for App Distribution Services on January 15, 2025. Issued under Section 45L of the Broadcasting Act 1994, it requires designated stores to moderate harmful content, provide accessible reporting channels and submit annual safety reports.

The code covers six categories: sexual content, violent content, suicide and self harm, cyberbullying, content endangering public health, and content facilitating vice and organised crime. Its age assurance requirements began a year after the code itself took effect.

• January 15, 2025: Singapore announced the app store safety code.
• March 31, 2025: The code took effect.
• April 1 to December 31, 2025: The reporting period covered by the stores' first safety reports.
• April 1, 2026: Age assurance requirements began.
• October 24, 2026: IMDA published its first app store safety assessment.
• Early 2027: The government expects to introduce proposed legislation on safer social media access for teenagers.

Stores that fail to comply can face directions to meet the requirements or fines of up to S$1 million under the Broadcasting Act. Developers distributing apps through those stores also face closer scrutiny of their content descriptions and age classifications.

Overseas testing exposed similar weaknesses

Testing in the United States using four accounts registered to a boy aged 13 found access to 135 apps capable of generating sexualised images. The testing used one ordinary teen account and one account with parental controls on each of Apple's and Google's platforms.

The Apple accounts accessed 61 apps without parental controls and 24 with them. The Google accounts accessed 47 and 51 respectively. The investigation used a broad definition of nudification capability, covering generated nudity as well as images showing a person in underwear or a bikini.

Apple and Google both showed the teen accounts advertisements for such apps. By September 28, Apple had removed 25 identified apps and Google six, yet previously downloaded copies still worked on the test phones. That finding makes notification after removal especially relevant to people who already have an app installed.

Apple tightened its rules against apps generating intimate images without consent and against hidden capabilities revealed after review. Its rules also require apps hosting user content to filter objectionable material and provide reporting and account blocking tools.

Google spokesperson Dan Jackson said the company prohibits apps that allow users to nudify images of people. He said enforcement included suspending apps that violated its rules and restricting related search terms. Singapore's assessment adds a regulatory check on whether store policies translate into functioning protections.

Lessons for children and proposed rules for teenagers

Singapore is expanding online safety education alongside its app store regulation. An E-Bridge pilot involving more than 100 Kindergarten 2 pupils will expand from December 2026 to nearly 3,000 Kindergarten 1 and Kindergarten 2 children across 30 centres.

Skool4Kidz introduced the curriculum to 800 Kindergarten 2 pupils across 35 centres in September. Sessions run once a week for 15 minutes, using stories, role play and games to teach children to recognise inappropriate content and seek help from a trusted adult. The curriculum focuses on boundaries, thinking before acting, reporting problems and support from parents.

The Ministry of Digital Development and Information also engaged more than 2,000 parents and young people between June and August 2026 through focus groups, school dialogues and a CrowdTaskSG survey. About 80 per cent of parents and nearly 70 per cent of young people supported access that changes with age rather than an outright social media ban.

Participants favoured no social media access for children aged six and below, with protected access for those aged seven to 15. Young people generally supported greater independence from age 16. About 84 per cent of parents placed exposure to inappropriate content among their leading concerns.

Proposed legislation expected in early 2027 could require age checks and safer platform design. Measures under consideration include daily time limits and restrictions on autoplay, infinite scrolling and messages from strangers. Infinite scrolling continuously loads more content, while autoplay starts the next video without requiring a fresh choice.

Parents wanted flexibility to adjust safeguards, while young people worried that rigid time limits could interfere with schoolwork and other legitimate activities. Prime Minister Lawrence Wong warned in August that platforms failing to protect teenagers from addictive features might be required to raise their minimum age above 13. The proposed measures have yet to be settled.

Key Points

• IMDA checked more than 7,000 apps across five stores and identified 65 harmful apps and 24 with incorrect age ratings.
• The 65 apps were removed, and all 24 age ratings were corrected.
• Sexual content accounted for 59 removals and 14 rating corrections.
• Huawei resolved an age check problem; Microsoft introduced an interim fix while developing a permanent solution.
• Google and Samsung agreed to improve notifications about removed apps.
• Online safety lessons are expanding in preschools, with proposed legislation on teenage social media safety expected in early 2027.