Test accounts posing as 13-year-olds downloaded 135 'nudify' apps

Researchers posing as 13-year-olds downloaded 135 apps capable of generating nonconsensual nude imagery on devices running Apple's and Google's parental controls, according to a new report from the Tech Transparency Project.

The number is the story. These weren't fringe downloads hunted down on obscure forums. The test accounts set up by the watchdog group reached the apps through the mainstream mobile app stores, despite the parental control systems both companies ship specifically to keep minors away from adult content. The exclusive findings were first reported by The Guardian.

Why does this matter? Because parental controls are the last line of defense most families rely on. If a 13-year-old with restrictions enabled can still install software designed to "nudify" photos of real people, the control layer isn't doing the job its name promises.

The stakes are not hypothetical. They have a name, a date, and a school.

What happened in Pennsylvania?

In December 2025, Morgan Dorfman learned that a student at her daughter's Pennsylvania high school was creating AI-generated pornographic material using her daughter's image.

The tool was an AI image-editing app called Movely. According to the report, the student used it to create sexual videos from pictures of Dorfman's daughter and five other girls.

That detail deserves a pause. One app, one student, six victims. The harm didn't require technical skill or access to underground tools. It required photos that any teenager's social media account already contains, plus an app that turned them into sexualized material without the consent of anyone in the images.

Takeaway: the Pennsylvania case shows how ordinary photos plus an ordinary app become nonconsensual pornography.

How did the test actually work?

The Tech Transparency Project built test accounts that presented as 13-year-olds — the minimum age for many mainstream platform accounts under US rules. Researchers then tried to find and download apps with features for generating nude imagery of real people.

The result: 135 successful downloads. The parental control settings meant to gate adult or inappropriate content did not stop them.

That's the mechanism worth understanding. Parental controls on iOS and Android generally work by filtering content categories, enforcing age ratings, or requiring adult approval for installs. The Tech Transparency Project's findings indicate that apps offering "nudify" features were classified, packaged, or described in ways that slipped through those filters — at least across the 135 cases the researchers documented.

The report's implicit question is blunt: if the category of app is known, the harm is documented, and the victims are minors, why are the apps reachable at all for a 13-year-old profile?

Takeaway: the controls failed not once or twice but across more than a hundred separate downloads.

Why should readers outside the US care?

The report is US-focused, and the case study is a Pennsylvania high school. But the apps run on global software distribution channels. Apple's App Store and Google Play serve users in nearly every country, and the underlying problem — image-generation tools that can strip clothing from photos of real people — does not respect borders.

For regulators, the findings arrive at a moment when both platform operators and lawmakers are under pressure to prove that age-assurance and safety systems actually work rather than exist as marketing copy. A documented failure rate of this scale gives policymakers a concrete number to point to.

For parents, the report undercuts a common assumption: that enabling family controls on a child's iPhone or Android device means adult-oriented AI tools are out of reach. The Tech Transparency Project's testing says otherwise.

Takeaway: this is a measured, documented gap between what parental controls promise and what they delivered.

What's at stake for Apple and Google?

Both companies position themselves as safety leaders, and both have made public commitments around child protection, app review, and responsible AI. A report showing 135 nudify-capable apps reaching a 13-year-old's account puts direct pressure on those commitments.

The Dorfman case adds a human dimension that's harder to deflect. When Morgan Dorfman got the news in December 2025, the harm had already been done — sexualized videos made from her daughter's pictures and those of five classmates. No parental control setting, and no app store policy, reversed it.

That's the pattern advocates have warned about for the past two years as image-generation AI has spread: the tools scale faster than the safeguards around them. A single app in one teenager's hands produced six victims. The Tech Transparency Project's download count suggests the exposure surface is vastly larger than one school in one state.

Takeaway: the report shifts the debate from whether these apps are accessible to minors to who bears responsibility for the fact that they are.

What happens next?

The findings put the ball in Apple's and Google's court. The companies face calls to explain why apps with nonconsensual nudity features passed their review and filtering processes, and whether the 135 apps identified remain available.

For the families already affected, like Morgan Dorfman and her daughter, the question is more immediate and more personal. The report documents what happened; it doesn't undo it.

The broader signal for the AI industry is hard to miss: as long as nudify tools sit within a few taps of a 13-year-old's test account, the industry's safety assurances will keep colliding with its own app store data.