24 OCT 2026 — Singapore's online safety regulator found 65 apps carrying harmful content and 24 adult apps rated as suitable for children across the five app stores it regulates, in its first formal assessment of them. The Infocomm Media Development Authority (IMDA) published the findings on 24 October in its first Online Safety Assessment Report on the app stores it designated under a 2025 code of practice. Every flagged app was taken down or re-rated, but only after IMDA reported it.
The five are Apple's App Store, Google's Play Store, Samsung's Galaxy Store, Huawei's AppGallery and the Microsoft Store. IMDA found no systemic breaches of the code and said all five have baseline safety measures in place. Its own testing still turned up gaps in app review, age ratings and how the stores answer people who report a problem.
What the regulator tested
The report covers 1 April to 31 December 2025, the first months after the Code of Practice for Online Safety for App Distribution Services took effect in March 2025. IMDA drew on the annual safety reports each store must file, and added its own work. It set up test accounts to see what a child account could reach, and ran what it calls mystery shopper tests on more than 7,000 apps, reporting suspect ones through each store's ordinary user channels and recording what happened next.
The 65 apps were not found by the stores themselves. According to the regulator's press release, "These apps were only removed or re-rated after IMDA notified the D-ADSs", which it read as a sign of "some weaknesses" in the stores' app review.
Nudification and gambling apps among finds
Sexual content was the most common problem. Violence came next, then material IMDA classes as facilitating vice and organised crime. The full assessment report lists the examples by store. On the Apple App Store and Google Play Store they included AI chatbot or companion apps with sexually explicit interactions, games built around AI-generated pornography, and AI apps with "nudification or non-consensual intimate imagery functionalities".
Huawei AppGallery's 11 removals included a jackpot gambling app with real-money pay-outs, horror games and dating apps with a sexual emphasis. Microsoft Store removed three, among them a blackjack game paying out in cryptocurrency. IMDA did not name any of the apps.
The report does not overstate the result. It says the number was small relative to the stores' catalogues and does "not indicate any systemic failure, but the findings show that some harmful apps may still slip through existing safeguards."
Wrong ratings on three stores
The 24 mis-rated apps sat on three stores: 11 on Apple, 10 on Google Play and three on Huawei. All should have been rated 18+ under each store's own rules. Apple's and Google's contained sexual content or content facilitating vice and organised crime, and Huawei's three were violent. Each was moved to 18+ after IMDA's reports.
IMDA treats a wrong rating as a separate failure because the default block on children applies to apps rated 18+. The report warns that a mis-rated app can reach children it is unsuitable for and can mislead parents about its content.
Age checks mostly hold up
IMDA judged age assurance, the checks a store uses to decide whether a user is under 18, the strongest area it tested. Methods across the five stores include credit cards, Singpass, government ID, facial age estimation and behavioural signals. Sample tests found they generally could not be easily circumvented, though the press release adds that "there is no AA method that is completely foolproof".
Huawei AppGallery was the exception. A small share of users could get around its check on certain versions of the app because of technical limitations, and Huawei told IMDA that 7% of its users were affected. IMDA also found limited cases on Huawei and Microsoft where the default block on 18+ downloads for children was missing or could be switched off. Huawei has resolved the download issue. Microsoft has an interim fix and is working on a permanent one, including for a loophole in its parental tools that let children turn the restriction off.
Reports that go unanswered
All five stores give users ways to flag a harmful app, from in-store buttons to webforms and hotlines. None of the five consistently told people who reported an app what happened, so users could not tell whether anything had been done. The stores also reported zero or near-zero user reports on harmful content in their own metrics.
Google Play and Samsung Galaxy Store did not alert users who had downloaded an app in the previous six months when it was later removed for a violation, which the code requires. The report says Google cited implementation challenges and is required to put a notification process in place. Samsung has committed to push notifications or emails by the third quarter of 2027. Google, Huawei and Samsung must also supply better metrics on how they handle reports in their next annual filings.
Wider push on children's online safety
IMDA released the report alongside a factsheet from the Ministry of Digital Development and Information (MDDI) on its consultations about a tiered approach to social media access, under which platforms would have to give young users age-appropriate experiences. According to the ministry's factsheet, its engagements with more than 2,000 parents and young people from June to August 2026 found more than 80% of parents and nearly 70% of youths in support. Neither group favoured an outright ban.
The proposal is not yet law, and IMDA gave no date for it. For the app stores, the next test is their second annual safety report, where the regulator will look for the notification processes and metrics it has asked for.
View author profile → · Editorial policy
