What the audit actually found
On 24 October 2026 Singapore's Infocomm Media Development Authority (IMDA) published its first Online Safety Assessment Report on the five designated app distribution services: Apple App Store, Google Play Store, Huawei AppGallery, Microsoft Store and Samsung Galaxy Store. It covers 1 April 2025 to 31 December 2025 and is the first test of the Code of Practice for Online Safety for App Distribution Services, which took effect on 31 March 2025.
IMDA's mystery-shopper testing of more than 7,000 apps found 65 that contained or facilitated harmful content in breach of the stores' own policies. By store: Apple 30, Google Play 10, Huawei 11, Microsoft 3 and Samsung 11. The report names sexual content, violent content and content facilitating vice and organised crime as the main categories. Examples include nudification apps, sexually explicit AI companion apps, and gambling apps with real-money or cryptocurrency payouts. All 65 were removed after notification. A further 24 apps with 18+ content were rated below 18+ on Apple (11), Google Play (10) and Huawei (3), and were re-rated to 18+ after IMDA flagged them.
The report also found:
- Age assurance: all five stores use IMDA-approved methods, which were "generally well implemented". A small percentage of Huawei AppGallery users could circumvent the checks on certain app versions. Huawei says only 7% of its users were affected.
- Microsoft Store: IMDA found a loophole in its parental tools that let children turn off the restriction on downloading 18+ apps. Microsoft has an interim fix and is working on a permanent one.
- User reporting: every store was inconsistent or absent in telling reporters what happened to their reports. Google Play and Samsung also did not tell users who had downloaded an app in the previous six months that it was later removed. Samsung has committed to push notifications or emails by Q3 2027.
Two caveats. The 59-of-65 sexual-content figure circulating in some summaries does not appear in the report's table, which lists content types per store but not per-type counts, so we do not rely on it. And IMDA's headline is deliberately mild: "no systemic breaches", but "weaknesses" in how measures were implemented.
The strongest case for tougher rules
The case for a harder line is serious. Even a small number of missed apps matters if a child finds one. Stores that profit from distribution have the strongest incentive and the best tooling to catch violations before publication, yet 65 apps got through and were removed only after IMDA's own testers flagged them. Misrated apps are arguably worse, because they mislead parents who rely on the label. And IMDA tested a sample, so the true miss rate is unknown and probably higher. On that logic, the regulator should penalise each miss rather than publish a report.
Why the report supports proportionate oversight
The data points the other way, for three reasons.
First, the base rate is low. Sixty-five confirmed violations among more than 7,000 tested apps is under 1%, and 24 misratings at the 18+ threshold is lower still. IMDA's own assessment calls the numbers small relative to the apps available and not indicative of systemic failure. A regulator that finds this and reports it honestly gives the public something to calibrate against. Treating each miss as a licence violation would push stores toward over-removal, where borderline apps from small developers vanish because the compliance risk exceeds their commercial value.
Second, the report is also a model of structured disclosure. IMDA scored each store on whether its measures were present, comprehensive and effective, named the store behind each gap, and attached specific follow-up actions. Huawei must keep reducing circumvention. Microsoft must finish its fix. Google Play, Huawei and Samsung must supply better metrics on how user reports are resolved, including turnaround times. That creates reputational pressure with no new penalty regime, and every fix the report mentions came after IMDA engaged. Naming each store is a more reliable lever than a blanket rule.
Third, the report treats privacy as part of the safety question. It notes that the Code requires age assurance to comply with the Personal Data Protection Act 2012. It records positive practices such as age-specific notices and consent mechanisms, and deletion or non-retention of the documents used for age checks. It also flags gaps in how previously collected account and payment data is reused, and in vendor roles and retention rules. This matters because the methods range from credit-card inference to facial age estimation to Singpass. Each one trades some data exposure for accuracy, and the report says plainly that no method is foolproof.
Where the model could go wrong
There are two risks. The first is that mystery-shopper sampling becomes a de facto target. If IMDA's tests drive the stores' remediation, stores will optimise to pass IMDA's tests, so IMDA should publish its sampling method and error rates in future editions. The second is scope creep. Reporting on the release says the government expects to table legislation in early 2027 requiring age checks on social media, with default limits on screen time, infinite scroll, autoplay and messages from strangers under consideration. That is a different, much more speech-sensitive problem than checking an 18+ app download. Age checks at the point of an 18+ download fit narrowly; mandatory checks on general-purpose speech platforms mean identifying every user. EFF's recent OHCHR submission argues that child-safety measures online must be judged against wider evidence of children's rights, including privacy and expression, not safety alone.
What to watch
The stronger test comes in the next annual report: whether Microsoft closes its parental-control loophole, whether Samsung and Google Play deliver removal notifications, and whether the metrics on user-report resolution improve. If the 65 falls without new mandates, that is evidence that transparent audits work. If it rises, the regulator can say so with data, which is a better basis for tightening than anecdote.