StoryToys: LEGO Bluey (IE), StoryToys: Peppa Pig (IE), StoryToys: Thomas & Friends (IE), StoryToys: Sesame St. Mecha (IE), StoryToys: LEGO DUPLO World (IE), StoryToys: Barbie Coloring (IE), StoryToys: Marvel HQ (IE), StoryToys: Disney Coloring (IE), StoryToys: Hungry Caterpillar (IE), StoryToys: Mother Goose Club (IE): Privacy & Security Findings

report - rfi-irfos
Skip to content

Permanent Disclosure Ledger

The discipline, demonstrated

On behalf of our research partners, we investigate publicly distributed Android and iOS apps: we decompile them, follow their code and data flows, and trace every connection to the servers it reaches. Hundreds of agents work through each app and join the technical evidence into one picture, which our specialists then review and verify.

387+
Android/iOS apps audited
Every app is decompiled at source-code level, not just scanned from outside.
1.04M+
Smali classes read
The full shipped code we have actually read, not an estimate.
262+
Critical findings recorded
Confirmed findings copied to regulators, not theoretical risks.
970+
Weak points found
Third-party tracking we have provably found inside the binary.
567+
Endpoints investigated
Real servers and countries where data actually flows.
132+
SDK instances mapped
Reusable libraries correlated across the entire corpus.
10 of 387 entries · sorted by elapsed ↓
Showing the report for StoryToys: LEGO Bluey (IE), StoryToys: Peppa Pig (IE), StoryToys: Thomas & Friends (IE), StoryToys: Sesame St. Mecha (IE), StoryToys: LEGO DUPLO World (IE), StoryToys: Barbie Coloring (IE), StoryToys: Marvel HQ (IE), StoryToys: Disney Coloring (IE), StoryToys: Hungry Caterpillar (IE), StoryToys: Mother Goose Club (IE).
OrganisationNotifiedStatusSevIntel (click to expand)StatutesResolvedDisclosureElapsedReport
StoryToys: LEGO Bluey (IE)
Private
2026-06-25
86d ago
ACK
High
A LEGO and BBC Studios app for children under five bundles ad-tracking tools that start running before the consent screen appears. When asked three direct questions about this, the company never answered.
AD_ID and Firebase tracking declared in a LEGO/BBC Studios app for children under five. FirebaseInitProvider auto-initializes before the consent screen. Three direct questions to the company went unanswered.
click to expand
GDPR Art. 8
Yes
Closed
Disclosure
86d 00h 00m 00s
Published
PDF
StoryToys: Hungry Caterpillar (IE)
Private
2026-06-26
85d ago
Waiting
Critical
A preschool reading app based on a classic children's book requests full read and write access to everything stored on the phone's shared storage, while also tracking before consent, reaching far beyond what a reading app for small children should need.
Full read/write access to shared device storage on a preschool literacy app, plus AD_ID and Firebase pre-consent tracking. The highest-severity finding in the StoryToys wave, on an Eric Carle-licensed title.
click to expand
-
Yes
Closed
Disclosure
85d 00h 00m 00s
Published
PDF
StoryToys: Peppa Pig (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A Peppa Pig app made for children under five requests an advertising identifier and starts Firebase tracking before the consent screen appears, before the phone is even unlocked, violating both US and EU child-protection rules.
ACCESS_ADSERVICES_AD_ID and Firebase auto-init before consent on a Peppa Pig licensed app for under-5s. COPPA §312.7 and GDPR Art. 8.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Thomas & Friends (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A Thomas & Friends app for toddlers sends an advertising identifier and device data to Google in the United States the instant it opens, before any parent has seen a consent screen, so a young child's activity is being profiled for ad targeting from the very first launch.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider (initOrder=100) pre-consent auto-init: advertising tracking on a Mattel/HIT Entertainment licensed toddler app. Firebase transmits to Google US before any parent consent screen is shown.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Sesame St. Mecha (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A Sesame Street-branded children's app quietly sets up advertising-tracking and attribution infrastructure before asking for any consent, building a systematic ad profile of a child using content aimed squarely at kids, in a way that runs against both US and EU child-protection rules.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider (initOrder=100) pre-consent: systematic advertising infrastructure on a Sesame Workshop licensed children's app. COPPA §312.3 + GDPR Art. 8.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: LEGO DUPLO World (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A LEGO DUPLO app aimed at the youngest children reads an advertising identifier and starts Google tracking before consent, and this is not an isolated case: the same pre-consent advertising setup repeats across all nine children's apps in StoryToys' portfolio that were checked.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider (initOrder=100) pre-consent + Firebase API key hardcoded. Part of 9-app systematic pattern: advertising identifier + pre-consent Firebase across the entire StoryToys licensed children's portfolio.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Barbie Coloring (IE)
Private
2026-07-17
64d ago
Waiting
Critical
On a children's colouring app based on Barbie, advertising identifiers and Google tracking start before consent, and an Amazon payment system is built in without being disclosed, so a child's play activity and any purchases flow to three separate US companies with little transparency offered to parents.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider pre-consent + Amazon IAP (undisclosed US processor). Mattel/Barbie licensed. Three US processors (Google Analytics, Firebase, Amazon) on a children's colouring app.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Marvel HQ (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A Marvel superhero app made for children requests your device's advertising identifier and starts Google tracking before any consent screen appears, and it also uses an undisclosed US payment processor, so a child's interests and purchases feed into ad profiling without a parent ever being told.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider (initOrder=100) pre-consent + Amazon IAP undisclosed US processor. Marvel/Disney licensed. Advertising identifier + pre-consent tracking on a superhero app for children.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Disney Coloring (IE)
Private
2026-07-17
64d ago
Waiting
Critical
A Disney coloring app for children starts advertising tracking before consent, the same pattern that already cost Disney a 174 million dollar settlement with US regulators in 2019 for violating children's privacy law. A practice Disney was already penalized for once is repeating here, on an app carrying the same company's brand.
ACCESS_ADSERVICES_AD_ID + ACCESS_ADSERVICES_ATTRIBUTION + FirebaseInitProvider (initOrder=100) pre-consent auto-init. Disney/Pixar licensed. Disney paid US FTC $174M COPPA settlement in 2019 - identical advertising identifier pattern documented here.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF
StoryToys: Mother Goose Club (IE)
Private
2026-07-17
64d ago
Waiting
Critical
On a nursery-rhymes app for toddlers, Meta's tracking switches on automatically the moment the app opens and sends device data to Facebook before a parent has any chance to consent.
FacebookInitProvider auto-initializes before consent on a nursery-rhymes app for toddlers, sending device data to Meta before any parent consent screen appears.
click to expand
-
Yes
Closed
Disclosure
64d 00h 00m 00s
Published
PDF

This ledger is updated in real time as companies respond. Silence is public. Severity is scored primarily by CVSS v4.0, we reserve the right to deviate based on blast radius.