A new report from the Tech Transparency Project has exposed a systemic failure in the app-store gatekeeping model that Apple and Google sell to parents as protection. Researchers created four test accounts — two Apple, two Google — registered as belonging to 13-year-olds. Using ordinary search terms like "AI video generator" and "adult AI," they downloaded 135 apps capable of stripping people of their clothes or swapping faces onto nude bodies. This was not a dark-web operation. It was the front door of the world's two dominant app stores. The core mechanism of failure is delegation. Both Apple and Google prohibit nudification apps on their platforms and offer parental controls that restrict downloads by age rating. But they rely on developers themselves to rate their apps. The result is predictable: one face-swapping app advertised with an image of a woman performing oral sex was rated appropriate for ages four and up. Another, Image to Video Maker-Vidou AI, rated for nine-year-olds, greeted users with a topless woman and offered to digitally undress any person. The parental controls filtered nothing because the apps lied about what they were. The Apple account with parental controls activated could still download 24 nudify apps; the Google account with controls, 51. When Apple's system did flag one app as age-restricted, a 13-year-old account simply confirmed they were 17 and the download proceeded. Apple's age-gate is a single checkbox honor system applied to a child's account whose age Apple already knows. This is not a bug. It is architecture that prioritizes friction-free commerce over the safety claims the platform makes to parents. The human cost is already materializing in schools across America. Morgan Dorfman learned in December 2025 that a student at her daughter's Pennsylvania high school was using an app called Movely to generate pornographic videos from images of her daughter and five other girls. The free version offered templates including "clothes explosion" and "brassiere unfasten"; the paid version delivered explicit pornographic scenarios. Dorfman's school initially downplayed the incident — the principal emailed parents that there was no evidence of anything inappropriate. Days later, Radnor police criminally charged the student with harassment. Removal from the app store does not equal removal from the device. Apple took down 25 nudify apps during TTP's research period; Google removed six. But researchers could continue using every app they had already downloaded, fully functional. Dorfman discovered the same: Movely vanished from the App Store but remained operational on her phone, still charging her subscription. The app-store model's kill switch does not actually kill anything already installed. After TTP contacted Apple, the company updated its developer guidelines to require preemptive prevention of nonconsensual intimate imagery. Google said it takes "proactive steps" and "swift action." These are reactive patches to a structural problem: a duopoly that controls app distribution for billions of devices, monetizes that control through developer fees and in-app purchase commissions, and then outsources the most consequential safety decision — who can access what — to the developers paying those fees. The incentive structure rewards volume and self-certification over genuine review. The twenty-year trajectory here is grim. Generative AI capabilities are improving faster than platform governance. Every month that the self-certification model persists, the installed base of nudification tools on minors' devices grows. The harm is irreversible by design — once an image is generated and shared, no app removal, no criminal charge, and no school email can recall it. As Dorfman put it: "The haunting trauma as a mom is that I can't tell my daughter those videos are gone or who had them."
