Despite the fact that Apple now requires users to enter passwords before making in-app purchases, Garen Meguerian says that minors can still easily make purchases on their parents' accounts....In other words, if parents choose not to implement a PIN to protect their accounts from being used by their children or choose to let their children know their account passwords, their kids will be able to make purchases through their accounts? No kidding.
Since the passwords for in-app purchases are the same as the main Apple passwords, kids who are "aware of such password may purchase Game Currency without authorization from their parents for that purchase," Meguerian argued.
From a legal standpoint, I'm wondering what's the distinction between this and the controversy from a few decades ago in which kids were calling 976 numbers without parental permission, resulting in significant charges to their parents' phone bills. I don't recall any phone companies being held liable for billing the parents, threatening to cut off phone service if the bills weren't paid, or in fact cutting off phone service over unpaid bills. The issue then, as now, would appear to be one of parental supervision and control over their kids - except it's actually much easier to exercise control over your passwords than it is over general use of your phone and, as previously suggested, it appears that at least since 2009 a concerned parent could have learned how to implement an additional layer of protection by implementing a PIN.
Ever since Apple enabled in-app purchases in 2009, parents have been able to restrict this feature with parental controls, behind a separate PIN.I am also left wondering whether the children were old enough to read and, if so and even assuming that they didn't have to enter their parent's password to do so, why it's more Apple's fault than the parent's that they chose to make purchases on the parent's account. No, I don't think parents can prevent all forms of misbehavior, but I do think that parents bear more responsibility for a child's deliberate misbehavior than is a remote third party who supposedly failed to prevent that misbehavior.