Nudify Apps Are Open to Teens: Parental Controls Aren't Enough

Nudify apps, which use AI to generate non-consensual nude images, are reaching teenagers despite Apple's and Google's parental controls. A test by the Tech Transparency Project exposes the weakest point in the two companies' "walled garden" defense: age checks effectively rely on what the user declares.

What happened?

The Tech Transparency Project set up test accounts that mimicked 13-year-old users. With these accounts, they downloaded 135 apps that include a feature for generating non-consensual nude images. The report's details also cover an incident at a high school in Pennsylvania. A student had used an app called Movely to create sexually explicit videos from the photos of six female classmates.

Why does it matter?

Apple and Google have made the same argument for years. While opposing third-party payment systems and sideloading, they say the closed store protects users from malware and inappropriate content. This defense rests on the assumption that vetting actually works. That a 13-year-old's account could reach more than a hundred nudify apps undermines that assumption.

The root of the problem lies in how age restrictions work. Age ratings in the stores are often set by the developer's own declaration. Parental controls, in turn, assume that the child's account was created with the correct age and linked to a family group. Rather than technically examining what an app does, the store trusts what the developer writes in a form. If an app describes itself as a "photo editor," its real function can stay hidden or be only implied in its marketing. In other words, there is a gap between the policy text and actual enforcement. Nudify apps thrive in that gap.

This is not the first warning, either. It has been shown before that similar apps were available in the stores and even carried ads. The stores remove specific apps, but new ones offering the same function return under different names before long. This is not a matter of cleaning up one app at a time; it is a structural problem. Because generative AI has made image editing so cheap, the barrier to building this kind of app has dropped as well.

Legal pressure is growing. In the US, the Take It Down Act expects platforms to remove non-consensual intimate images, including AI-generated ones, within a short time after notification. How far app stores fall under this scope is debatable. But when an app is plainly designed to produce exactly this content, the "we are just a distribution channel" defense becomes harder to sustain. In Europe, the Digital Services Act (DSA) expects very large platforms to take risk-mitigation measures to protect minors. The Digital Markets Act (DMA) recognizes the stores' right to defend their closed nature on security grounds only to the extent that this security is actually delivered.

Who is affected, and how?

The heaviest burden falls on families and schools. A family that turns on parental controls assumes their child cannot reach a harmful tool. The test shatters that trust. The victims, meanwhile, are mostly girls who never download these apps, but whose photos are used by a classmate. For them, parental controls are not a solution anyway. The real safeguard is that the app never makes it into the store at all.

From the platforms' perspective, the options can be compared as follows:

The conclusion from this table is clear: no single method is enough. Still, because Apple and Google sell strict vetting as a commercial advantage, they will be judged most by how consistent that claim is.

What's next?

Three developments are worth watching. First, the US state laws that mandate store-level age verification, and how they fare in court. Second, the European Commission's investigations and guidelines on the protection of minors under the DSA. Third, how quickly and how broadly Apple and Google carry out removals after the report. Rather than deleting apps one by one, they could make a difference if they introduce a rule banning this function along with automated scanning.

Here is my assessment: Apple and Google can keep defending the closed-store model on security grounds, but they will have to pay the price for it. The party that holds control is also held responsible for the consequences of that control. A declaration-based age system cannot bear that responsibility. If regulators don't close this gap, the companies' own arguments will be turned against them.