Summary

  • TTP investigation found 135 apps Apple and Google policies prohibit nonetheless reached accounts registered as 13-year-olds through the storefront search perimeter, age-rating fields, and a self-attestation bypass that let one subscription purchase go without parental notification.
  • Two accounts placed under parental controls permitting downloads only of apps rated suitable for 13 with signoff reached 24 Apple and 51 Google nudify applications, because those applications carried age ratings below the threshold the controls enforce.
  • Apple removed 25 of the 135 apps and Google removed 6 after contact; researchers continued using already-downloaded applications, and Movely remained functional and billed on Morgan Dorfman’s phone after its storefront removal.
  • The Radnor, Pennsylvania principal emailed “there was no evidence he had done anything inappropriate” days before Radnor police criminally charged the classmate with harassment, showing the same conduct characterized differently across administrative levels.
  • Most US states have criminalized possession of AI-generated child sexual abuse material, and governments “around the world have moved to ban nudify apps from app stores,” per the Guardian — yet accountability for material already in private circulation remains constrained by limits on search-and-seizure authority over personal devices.

A Tech Transparency Project investigation released Monday and shared exclusively with the Guardian found that test accounts registered as 13-year-olds downloaded 135 nudification applications from the Apple App Store and Google Play Store, even though both companies state policies prohibiting such applications. The applications reached the accounts through the storefront search perimeter, age-rating fields that placed them inside the download window parental controls are designed to police, and a self-attestation bypass that let an Apple account self-confirm an age of 17 despite its registered age being 13. TTP paired the testing with a December 2025 case in which a Radnor, Pennsylvania high-school classmate used the Movely app to generate sexual videos from images of Morgan Dorfman’s daughter and five other girls; Radnor police criminally charged the classmate with harassment days after the school principal emailed “there was no evidence he had done anything inappropriate.” Rating-to-storefront mechanics let the policy-prohibited applications reach adolescent accounts; the takedown gap leaves installed applications functional and billed after storefront removal.

The rating-storefront cascade that reached 135 applications

TTP configured the test in documented steps: four accounts — two Apple, two Google — registered as belonging to a 13-year-old; storefront searches using image-editing and face-swapping keywords including “AI video generator” and “adult AI”; installation and testing of applications featuring clothing removal or face-swap onto nude templates; per-application age rating recorded from the storefront label; and parental-control behavior logged when researchers had configured the controls. TTP researchers disrobed women in AI-generated images in tests rather than using photographs of real women.

The core finding runs through the rating step. Per the TTP report: “many nudify apps identified in the investigation were inaccurately rated as suitable for minors — meaning the teen users could access them even when parental controls were activated.” Two applications were rated for very young children. One face-swapping application, “advertised to researchers with an image of a woman performing oral sex,” was rated appropriate for ages four and up. Another, Image to Video Maker-Vidou AI, was rated appropriate for ages nine and older; “upon opening, users were greeted by an image of a topless woman on a bus,” and the application “had a feature that promised to digitally undress any person — and to demonstrate, it showed nude images of female celebrities.” Both companies state they prohibit nudification applications and age-gate applications with adult content; the per-application age label is supplied by developer self-attestation at the App Review stage. The age-rating field, in other words, sits upstream of the storefront perimeter that the parental-control feature is designed to enforce.

How parental controls functioned and where they didn’t

Two of the four TTP accounts — one Apple, one Google — were placed under parental controls that permitted downloads only of applications marked suitable for 13-year-olds and only with a parental signoff. The Apple account downloaded 24 nudification applications; the Google account downloaded 51. Per TTP, “neither Apple nor Google required or suggested parental signoff to acquire any of the nudification apps.” The mechanism is straightforward: when the rating places an application inside the threshold the controls enforce, the controls have no application to block, and the signoff step is not invoked.

Age-rated material outside the per-application field fared marginally better. When TTP researchers tried to download an adult-rated application from Apple’s storefront, they encountered a pop-up warning about “age-restricted material” but bypassed it by self-confirming an age of 17 or older, “which Apple allowed the account to do despite its registered age being 13.” The Google account without parental controls was blocked three times from downloading an age-restricted application but otherwise allowed researchers to download nudification applications self-reported as age-appropriate. TTP researchers were able to buy a subscription to the age-4+-rated face-swapping application from the 13-year-old-registered account “without an alert to a linked parental account.” The implication is layered: the per-application rating field is the primary filter, the pop-up warning is a secondary filter, and the parental-control feature is a downstream enforcement of the per-application rating. When the rating is wrong, every layer downstream is wrong with it.

What storefront removals delivered and what they didn’t

Apple removed 25 of the 135 nudify applications TTP identified; Google removed six. Per the article, Apple “taken action” on the remaining applications mentioned in the report after TTP’s contact, and Apple “implemented changes requiring developers to preemptively prevent and remove nonconsensual intimate imagery including AI-generated images.” Apple’s per-statement posture is that it “reviews every app before it is published and removes apps whose developers misrepresent features.” Google’s posture, per spokesperson Dan Jackson, is “proactive steps to detect and remove apps with harmful content” and “swift action, which in this case included suspending violating apps and restricting related search terms on our store.” The two characterizations — Apple emphasizing pre-publication review plus post-publication removal; Google emphasizing ongoing detection and search-term restriction — describe an enforcement cadence measured in days to weeks.

The persistence finding runs in the opposite direction. TTP researchers “could continue using the apps they had already downloaded.” The Dorfman case documents the same persistence at consumer scale. The Movely free version “promoted sexually suggestive templates including ‘clothes explosion,’ ‘brassiere unfasten,’ and ‘underwear drop’”; the paid version’s templates were “more explicit,” matching the situations in which, according to a classmate, Dorfman’s daughter had appeared. Dorfman downloaded Movely and “was immediately prompted to create suggestive videos using any image.” When she returned to the App Store to document Movely for a parent-education presentation, she found “the app was no longer available for download, but it remained fully functional on her phone, and she was still being charged for her paid subscription.” Substrate pattern from these instances: storefront removal cuts off new-install distribution but does not reach installed applications, does not interrupt subscription billing, and does not delete application-side caches of generated material.

Apple described the underlying developer pattern as “a malicious tactic known as bait-and-switch” — an application published with innocuous review-time functionality, then activating nudification or deepfake features after App Review approval. Apple’s after-contact developer requirement is a policy-layer response to bait-and-switch at the review boundary; whether the requirement has durable teeth is not visible from the article’s reporting (Evidentiary gap).

The Radnor case and the school-criminal divergence

The Pennsylvania case bundles the storefront, school, and criminal-law pathways into a single documented sequence. In December 2025, Morgan Dorfman was told that a student at her daughter’s Pennsylvania high school had used the Movely app to create sexual videos from images of her daughter and five other girls. “All the girls were very scared and confused about what to do next,” Dorfman told the Guardian. The principal sent “a school-wide email stating that the classmate had used the app to animate images of other students but that there was no evidence he had done anything inappropriate.” Days later, Radnor police criminally charged the classmate with harassment.

The school-administered response characterized the conduct as animation without an inappropriate act; the criminal-law pathway characterized the same conduct as harassment. Neither pathway addresses deletion of the generated material. On the school’s framing, Dorfman said: “The whole thing was dismissed as ‘it’s not real.’” On the criminal pathway’s limit, she said: “I just wanted someone to make him delete all of these videos.” On the evidentiary frame, she said: “I can’t tell [my daughter] those videos are gone or who had them. We can’t search everyone’s phones, and he deleted the app.” The “haunting trauma as a mom,” she added, is that she cannot tell her daughter the videos are gone or who had them. Guardian companion reporting indicates that students at high schools across the US are reporting similar cases with classmates generating nonconsensual pornographic or nude imagery using nudify apps.

State-law environment and the limits of statutory accountability

The Guardian-attributed inventory of state and international activity is broad: “Most US states have implemented laws criminalizing possession of AI-generated child sexual abuse material,” and “governments around the world have moved to ban nudify apps from app stores.” The Radnor harassment charge tests how statutes written before AI-generated imagery anticipate nonconsensual peer-to-peer use. Substrate-illustrated constraint on the statutory pathway: accountability for material already in private circulation remains bounded by practical limits on search-and-seizure authority over personal devices.

The platform-side pathway, by contrast, addresses new-install distribution but not installed applications, billing rails, or cached generated material. The Apple-side policy change after TTP contact addresses the post-review bait-and-switch boundary; the per-application age rating, the parental-control signoff step, the subscription billing cancellation pathway, and the installed-application wipe pathway are not addressed by the documented platform responses in substrate. Whether FTC or state-AG action under truth-in-advertising and child-design protections follows from the documented rating gap is a medium-term development projected from substrate — not substrate-attributed as filed enforcement.

Positions documented for each stakeholder

Apple’s posture, per spokesperson Adam Dema, classifies “a number of the apps in this report are mainstream photo and video editing tools with legitimate, widely used functionality, and do not have nudification or deepfake capabilities.” Apple’s enforcement model is pre-publication review plus post-publication removal; its after-contact policy change requires developers to preemptively prevent and remove nonconsensual intimate imagery including AI-generated images, and removes applications whose developers misrepresent features.

Google’s posture, per spokesperson Dan Jackson, is “proactive steps to detect and remove apps with harmful content” and “swift action, which in this case included suspending violating apps and restricting related search terms on our store.” Documented Google removals in this report total six of the 135 applications; the remaining 129 were not removed as of the article.

TTP frames the investigation through test-account methodology as a proxy for teen-age exposure and through the gap between stated policy and observed pathway: “many nudify apps identified in the investigation were inaccurately rated as suitable for minors” and “neither Apple nor Google required or suggested parental signoff to acquire any of the nudification apps.” The Guardian companion reporting documents the school-cluster prevalence and the state-law inventory.

The Movely developer pattern, per Dorfman’s demonstration reviewed by the Guardian, runs from free template-library prompts to paid-tier templates and to ongoing post-removal billing. Documented monetization interest, in other words, runs through template library, subscription tier, and billing rail that outlives storefront removal.

Parents as a group are internally heterogeneous in baseline awareness. Dorfman’s framing: “I knew what a deepfake was, but I thought it was like Taylor Swift and people using celebrities’ [images]. I didn’t know it was possible to take any picture or any screenshot of anybody that you have and do this.” Parents’ documented interest, as carried in the article, is cessation of distribution and deletion of generated material — neither of which the platform removal pathway, the school-administered pathway, or the harassment charge delivers. Subscribers’ documented interest is fee cessation on removal — neither automated by the storefront-removal pathway nor matched by a documented cancellation interface in substrate. Adolescent girls whose images appear in Movely’s or competitor templates’ libraries are documented as an affected class, although identification of specific women in the templates is not in substrate.

Projected consequences across horizons

Immediate-term (days to weeks). Continued exposure for accounts whose applications remain installed after storefront removal — TTP researchers and Dorfman’s Movely in the documented record. The self-attestation loophole on Apple’s storefront for age-restricted material persists per the TTP testing. Intermittent rather than systematic blocking on Google (three blocked downloads; remainder succeeded in the documented test).

Short-term (months to one year). Criminal-liability caseload formation: Radnor police harassment charge as one test of how statutes written before AI-generated imagery anticipate nonconsensual peer-to-peer use. Civil-dispute patterns projected from substrate: subscribers reporting ongoing billing on removed applications — Dorfman was still being charged for Movely after App Store removal — create refund and cancellation disputes, with potential class-action exposure for platforms that maintain payment rails for removed applications.

Medium-term (one to five years). Regulatory and legislative activity projected from substrate: FTC or state-AG action under truth-in-advertising and child-design protections, given the documented age-rating gap (not substrate-attributed as filed enforcement). Platform-level response projected from substrate: Apple’s after-contact developer requirement, if durable, would address bait-and-switch at the policy layer.

Long-term (five years and beyond). Substrate-illustrated trajectory: as biometric capture, face-morphing, and generative video mature, the substrate-reported assumption that a captured image remains under the subject’s control becomes untenable. Courts adjudicating harassment, defamation, and child-endangerment claims will need doctrine specific to AI-generated nonconsensual imagery. Substrate-illustrated evidentiary posture from the Dorfman case — “we can’t search everyone’s phones, and he deleted the app” — captures the limit that doctrine will need to address. Whether the long-term outcome is restorative, retributive, or neither follows from the evidentiary framework adopted (projected, not substrate-attributed).

The cross-domain gaps substrate surfaces

Four parallel gaps run through the substrate:

  • Rating gap. Two of 135 applications were rated for very young children (4+ and 9+), placing them inside the threshold parental controls enforce.

  • Parental-control backstop gap. 24 Apple-account and 51 Google-account nudify downloads reached accounts configured for apps rated suitable for 13 with parental signoff, because the rating system placed those applications inside the download window the controls enforce.

  • Self-attestation gap. The Apple account self-confirmed an age of 17 to bypass an adult-rated application pop-up despite its registered age being 13, leaving the age-gating pathway documented as a single-click override.

  • Takedown-payment gap. Storefront removals did not interrupt installed-application functionality (TTP researchers; Dorfman on Movely), did not interrupt subscription billing (Dorfman “still being charged for her paid subscription”), and did not delete application-side cached material (Dorfman: “I can’t tell [my daughter] those videos are gone”).

  • Administrative-legal gap. The school principal’s “no evidence he had done anything inappropriate” determination and the Radnor police harassment charge characterized the same conduct through different statutory frames; neither delivered deletion of the generated material.

The reinforcing dynamic the substrate documents runs from developer pattern through rating gap through storefront perimeter through takedown-payment gap through circulating cached material. The 135-app total TTP identified and the post-removal functional persistence on TTP and Dorfman devices indicate the dynamic continues operating. Whether the bait-and-switch developers — Apple characterized the pattern; substrate documents one documented instance (Movely) plus Apple’s general characterization, not multiple instances — republish under alternate developer identities at scale, and whether Apple’s after-contact developer requirement has teeth at that scale, is not visible from the article’s reporting.

Analytical techniques used in this piece

This analysis applies the methods below. Each links to a short, plain-English explainer you can read and reuse.

Consequences & Sequels
Plays a decision forward to its first- and second-order consequences.
Stakeholder Mapping
Charts the parties to a situation — their interests, power, and alignments.