The privacy cost of monitoring apps

A monitoring app on a child’s device is a data collection system with two endpoints. The child is the primary subject. The parent is the registered account holder. The vendor is the third party in the data flow.

This page is about the privacy cost of running the system, and about what happens when the system breaches.

Risk

A privacy-cost risk is the chance that a monitoring product will collect more data than the parent expected, retain it for longer than the parent expected, or expose it to a third party the parent did not choose.

The risk is amplified by the structural fact of the category: the parent’s question about a product is “what does it filter”, and the child’s data question is “what does it collect”. The two questions are not the same.

The 2020 Stiftung Warentest comparison found that Wondershare FamiSafe was rated “ausreichend” (sufficient) and was explicitly compared to spyware by the testers for the depth of its chat, photo, and location access [source: www-familienhandbuch-warentest-summary].

The 2025 Stiftung Warentest risk article catalogued the structural privacy risks of the category as a regulator sees them [source: test-de-2025-risks].

That is the institutional view. The empirical record is the documented incident history.

Three documented incident classes

The category has produced three repeat classes of documented privacy incidents. Each is a probabilistic statement, not a generalisation: many products have never had a documented incident. The ones below have.

1. Stalkerware-class breaches

mSpy, a stalkerware-class product, has been breached three times — 2015, 2018, and 2024. The 2024 breach exposed millions of customer support emails and ticket contents, including data from monitored minors [source: mspy-techcrunch-2024] [source: mspy-theregister-2024].

The Coalition Against Stalkerware draws the line between parental-control software and stalkerware at covert installation and non-consensual monitoring. mSpy sits on the stalkerware side of that line [source: stopstalkerware-coalition-stalkerware-en].

The 2015 breach was the first documented one. The 2018 breach re-exposed messages from monitored targets. The 2024 breach re-exposed customer support data [source: mspy-bbc-2015] [source: mspy-mozilla-monitor].

The pattern is what matters. A vendor that has been breached twice has, in the public record, had a security failure twice. A vendor that has been breached three times has done so again. The probability is not zero.

A parent who installs a monitoring app installs a vendor’s security posture too.

2. Geo-data broker sales

Life360, a family-location app, was the subject of a 2023 proposed class action over selling precise location data to data brokers, and a January 2025 FTC order to halt the sale of sensitive precise location data. Life360 disclosed a 2024 breach affecting 442,519 users [source: life360-moneypilot-2026] [source: life360-markup-2023] [source: life360-classaction-complaint].

The class action was filed in the Northern District of California in early 2023. The FTC order was issued in January 2025. The 2024 breach was disclosed in 2025. The three events are distinct in time and in scope; secondary coverage sometimes blurs them [source: life360-moneypilot-2026].

The lesson is not “Life360 is unsafe”. The lesson is that a location-first product, by definition, holds location data, and the data has a market.

A parent who has not read the privacy policy of the location app they have installed has not made an informed decision.

3. Vendor-side vulnerabilities

Wondershare FamiSafe 1.0 for Windows has a CVE-2022-50902 privilege-escalation vulnerability, assigned CVSS 8.4 (“High”) and published to the NVD in January 2026 [source: famisafe-cve-sentinelone] [source: famisafe-cve-deepaegis].

The vendor’s marketing positions the product as an AI-monitoring solution. A privilege-escalation in the client is a data-exfiltration risk on the parent’s side, not just the child’s.

The CVE was technically discovered in 2022 and first published to NVD in January 2026. The patch status as of the latest check is unclear [source: famisafe-cve-sentinelone] [source: famisafe-cve-opencve].

A documented CVE is a fact. A vendor’s “no known vulnerabilities” banner is a claim. The CVE database is the difference.

What the products collect

The products collect at least the data category the parent is trying to control: location, app usage, screen time, web history. Most collect more.

Bark’s product page describes message-content scanning as the core feature. The vendor’s own disclosure says the product reads messages on the monitored device [claim: bark-app-page].

Wondershare FamiSafe’s pricing page describes “AI sexting detection”, “30+ social media apps”, and “alert scanning across text messages, WhatsApp, Instagram, TikTok, Discord” [claim: famisafe-pricing].

These are vendor claims. The independent record on the message-monitoring category is, at the time of writing, empty: no test body has published a methodology that compares message-monitoring accuracy across vendors.

The data collection is what the vendor says it is. The data protection is what the vendor’s own security history shows it is.

What the parent does not see

A parent who has installed a monitoring app sees the parent dashboard. The parent does not see the back-end data flow.

The data flow runs:

• from the monitored device to the vendor’s servers,
• through the vendor’s processing pipeline,
• back to the parent dashboard,
• and onward to the vendor’s data retention, the vendor’s processors, and the vendor’s incident-response readiness.

A breach at any point in that flow exposes the data the parent entrusted to the product. The parent’s dashboard shows the collected data. It does not show the integrity of the pipeline.

The Austrian Safer Internet Centre describes four layers where technical child protection can be configured: OS-level tools, ISP or mobile-carrier add-ons, third-party apps, and in-app or browser settings. The third-party-app layer is the one where the parent trades the most data for the most control [source: saferinternet-technischer-kinderschutz].

What the regulator sees

The 2025 Stiftung Warentest risk article frames the category as a system that has moved beyond the parent’s reasonable expectation. The article does not pick a winner. It catalogues the structural risks [source: test-de-2025-risks].

The U.S. Federal Trade Commission treats parental controls as one layer of protection, not a complete solution [source: consumer-ftc-parental-controls].

The Coalition Against Stalkerware treats the category as a boundary: most consumer products on the legitimate side, a small class on the stalkerware side [source: stopstalkerware-coalition-stalkerware-en].

The regulator’s stance is the same as the test catalog’s. The category is not invisible. It is undersurveilled.

Countermeasures

The countermeasures below are the ones the parent can take without moving to a different product or a different family rule.

1. Read the privacy policy before installing

The privacy policy is the answer to “what does the product collect and where does it store it” in the vendor’s own words.

Qustodio’s privacy policy, for example, names the legal entity (Barcelona, Spain), the regulator (the Spanish data-protection authority, AEPD), and the categories of data collected [source: qustodio-privacy-family] [source: qustodio-legal-notice].

A parent who has not read the policy has not made an informed choice. The policy is the contract.

2. Search the CVE database for the product and its parent company

A documented CVE is a fact. The vendor’s “no known vulnerabilities” banner is a claim. The CVE database is the difference.

A parent who searches vendor-name in the OpenCVE database or in the NVD CVE database will spend two minutes and find the published findings [source: famisafe-cve-opencve].

3. Search the regulator’s enforcement feed

The Spanish AEPD, the UK ICO, the German BfDI, the Irish DPC, and the U.S. FTC each publish enforcement actions. A product that has been the subject of an enforcement action is documented.

A parent who has not searched the relevant feed has not seen the regulator’s view.

4. Search the breach record

The Mozilla Monitor, Have I Been Pwned, and the Identity Theft Resource Center publish breach histories. A product that has been breached is documented.

The 2024 mSpy breach is a documented case. The 2024 Life360 breach is a documented case. A parent who has not searched the breach record has not seen the vendor’s incident history [source: mspy-mozilla-monitor] [source: life360-moneypilot-2026].

5. Hold the rule in the family, not the device

A parent who has named the rule to the child, in the child’s own terms, has a conversation that the monitoring app cannot have. A parent who has not named the rule has outsourced the relationship to a vendor.

The Coalition Against Stalkerware draws the line at covert installation. Holding the rule in the family means the installation is not covert. The child knows what the app is and what it does [source: stopstalkerware-coalition-stalkerware-en].

6. Plan the end of the subscription

Most monitoring products stop filtering on the day the subscription ends. The data they have collected does not end on the same day.

A parent who plans the end of the subscription plans the end of the data collection. The vendor’s policy on deletion is part of the contract. Read it before paying [source: test-de-2025-risks].

What the page does not say

This page does not name a “best” monitoring product. The incident record above is not a leaderboard.

It does not say “do not use monitoring apps”. The category has products that perform the function the parent is paying for, within the limits the OS permits.

It does say: the privacy cost is real, the data the product collects is at least the data the parent is trying to control, and the documented incident history is part of the price.

Sources

This page draws on regulator publications, security advisories, documented incident reporting, and the public records of the public breaches. Vendor descriptions of their own data collection are noted as [claim].

Documented incidents:

• [source: mspy-techcrunch-2024] — TechCrunch, “Data breach exposes millions of mSpy spyware customers” (2024-07-10).
• [source: mspy-theregister-2024] — The Register, “Stalkerware vendor mSpy breached for a third time” (2024-07-14), with the breach history.
• [source: mspy-bbc-2015] — BBC, “MSpy admits hacking and data theft” (2015-05-20), the first documented breach.
• [source: mspy-mozilla-monitor] — Mozilla Monitor breach record for mSpy.
• [source: life360-moneypilot-2026] — Moneypilot legal-news coverage of the current status of the Life360 FTC order and the 2024 breach (2026-04-06).
• [source: life360-markup-2023] — The Markup investigative reporting (2023-05-31) on the Life360 location-data sales.
• [source: life360-classaction-complaint] — E.S. v. Life360 Inc., primary class-action complaint filing.

Security advisories:

• [source: famisafe-cve-sentinelone] — SentinelOne vulnerability database entry for CVE-2022-50902.
• [source: famisafe-cve-deepaegis] — DeepAegis advisory for the same CVE.
• [source: famisafe-cve-opencve] — OpenCVE CVE database entry for Wondershare FamiSafe.

Regulator and framework bodies:

• [source: stopstalkerware-coalition-stalkerware-en] — Coalition Against Stalkerware.
• [source: test-de-2025-risks] — Stiftung Warentest, “Kinderschutz-Apps: Kinderüberwachung mit Risiken” (2025-04-13), the institutional risk-overview update.
• [source: www-familienhandbuch-warentest-summary] — Independent secondary summary of the 2020 Stiftung Warentest test, with the “spyware” comparison for FamiSafe.
• [source: saferinternet-technischer-kinderschutz] — Austrian Safer Internet Centre, the layered-defence guidance for technical Kinderschutz.

Vendor disclosures cited as structural evidence for the data collected:

• [source: qustodio-privacy-family] — Qustodio Family Privacy Policy, the legal entity and the regulator.
• [source: qustodio-legal-notice] — Qustodio Legal notice, the Barcelona seat and AEPD jurisdiction.

Vendor claims used only for vendor description, not as evidence:

• [claim: bark-app-page] — Bark product page describing message-content scanning.
• [claim: bark-pricing-support] — Bark pricing/support page describing subscription tiers.
• [claim: famisafe-pricing] — Wondershare FamiSafe pricing page describing the “30+ app” monitoring claim.

The following sources were reviewed during the research and are deliberately not cited on this page, because they publish star ratings or “best of” rankings without a published methodology: review listicles on Safewise, TechRadar, PCMag, Airdroid, SafetyMode, TechSafeForKids, HyperJar, Kidgy-forum, Phone-Safety. They are documented in the underlying research note RAW/research/f-third-party-tests.md and excluded here by editorial policy.

[source: mspy-techcrunch-2024] [source: mspy-theregister-2024] [source: mspy-bbc-2015] [source: mspy-mozilla-monitor] [source: life360-moneypilot-2026] [source: life360-markup-2023] [source: life360-classaction-complaint] [source: famisafe-cve-sentinelone] [source: famisafe-cve-deepaegis] [source: famisafe-cve-opencve] [source: stopstalkerware-coalition-stalkerware-en] [source: qustodio-privacy-family] [source: qustodio-legal-notice] [source: saferinternet-technischer-kinderschutz] [source: test-de-2025-risks] [source: www-familienhandbuch-warentest-summary]