Online Safety Assessment Report 2026: Designated App Distribution Services

Key Findings

• — IMDA's mystery shopper testing of over 7,000 apps detected 65 apps containing or facilitating harmful content that violated the stores' own policies (Apple App Store 30, Google Play Store 10, Huawei AppGallery 11, Microsoft Store 3, Samsung Galaxy Store 11); all 65 were removed after IMDA's reporting
• — Harmful sexual-content apps on Apple App Store and Google Play Store included 'AI chatbot/companion apps featuring sexually explicit content or interactions', gaming apps featuring AI-generated nude or pornographic content, and AI-powered apps with nudification or non-consensual intimate imagery functionalities
• — 24 apps containing 18+ content were rated below 18+ (Apple App Store 11, Google Play Store 10, Huawei AppGallery 3); on Google Play Store the mis-rated apps included 'AI chatbot/companion apps with “spicy” or “roleplay” elements'; all 24 were re-rated 18+ after IMDA's reporting
• — Age assurance measures were present and generally could not be easily circumvented; on Huawei AppGallery a small percentage of users could circumvent them, and Huawei reported that 7% of its users were affected
• — Children were restricted from downloading 18+ apps by default on all stores except limited instances on Huawei AppGallery and Microsoft Store, including a loophole in Microsoft Store's parental tools that let children turn off the restriction
• — No store fully notified users of the outcome of their reports; Google Play Store and Samsung Galaxy Store did not notify users who had downloaded an app in the previous six months when it was removed

Methodology Notes

Regulator assessment covering the reporting period 1 April 2025 to 31 December 2025. Sources: the five stores' annual online safety reports to IMDA, harmful apps reported to IMDA by the public, and IMDA's own testing. That testing used test accounts simulating Singapore child and adult users across device types, mystery-shopper detection and reporting of harmful and mis-rated apps through the stores' own user-reporting channels, and age-assurance circumvention testing on a small sample. The report does not break out how many of the 65 harmful or 24 mis-rated apps were AI chatbot or companion apps; they appear only as examples. Counts reflect apps IMDA detected, not prevalence. PDPC reviewed age-assurance data handling separately. IMDA's site returns a WAF shell to direct requests; the PDF (54 pages) was read through r.jina.ai and through a Wayback capture (20261027014942). Date: the IMDA asset was published 23 October 2026 (server Published Time 03:16 GMT; PDF created 22 October); coverage reports the accompanying media release as issued on Saturday 24 October.

Sources