I see Nadia's briefing on this franchise-operated stalkerware. The legal picture is patchwork at best — different frameworks apply in different jurisdictions, but the franchise model specifically exploits gaps in territorial enforcement.
United States: CFAA but not enough tools
Under the US Computer Fraud and Abuse Act (18 U.S.C. § 1030), stalkerware distribution can indeed be prosecuted — 18 U.S.C. § 1030(a)(2) covers unauthorized access to obtain information, and § 1030(a)(5) covers damage to protected computers. However, the CFAA requires the device to be a "protected computer" (essentially any device used in or affecting interstate commerce) and the DOJ's 2022 policy guidance clarified they won't bring cases based solely on contract violations. The real enforcement gap is domestic violence statutes — only a handful of US states have updated their domestic violence laws to explicitly include tech-facilitated abuse, leaving prosecutors stuck with general cybercrime statutes that don't capture the intimate partner violence context. California's SB 1305 (2024) is an example of recent progress, but most states lack this specificity.
European Union: ePrivacy Directive and the "spyware regulation" gap
The EU has been drafting spyware legislation under the European Media Freedom Act and revised ePrivacy Directive proposals, but as of late 2024, there's no dedicated anti-stalkerware regulation comparable to the upcoming AI Act's scope. The GDPR applies if personal data is processed — Article 5 requires lawful basis, Article 6 requires consent, and Article 8 specifically addresses children's data (relevant given the "KidsProtect" branding). But the distributor can claim they're selling a "parental control" tool with legitimate purposes. Under the e-Privacy Directive Article 5(3), storing or accessing information on user devices requires consent — a clear hook for stalkerware distributors, but enforcement has been weak because the directive primarily targets cookies, not surreptitious device compromise.
United Kingdom: Investigatory Powers Act and Computer Misuse Act
The UK Investigatory Powers Act 2016 (IP Act) creates obligations for telecommunications operators but applies primarily to lawful interception. More relevant is the Computer Misuse Act 1990 — specifically Section 1 (unauthorised access) and Section 3 (unauthorised acts with intent to impair). The UK has prosecuted stalkerware distributors under CMA, notably the 2023 case against a spyware developer who received a suspended sentence. However, the franchise model complicates this — UK prosecutors struggle with jurisdictional reach when the developer is in one country, the franchisee rebrander is in another, and victims are distributed globally.
Turkey under KVKK
Under Turkey's Law No. 6698 (KVKK), Article 4 requires legal basis for data processing, Article 5 requires consent or legitimate interest, and Article 12 imposes data security obligations on data controllers. Notification to the DPA is required within 72 hours of breach detection under KVKK Article 12(5). Stalkerware would almost certainly violate the "lawfulness and fairness" principle of Article 4, but enforcement against foreign distributors is practically nonexistent.
Mobile OS vendor obligations: the regulatory gap you identified
This is where the frameworks truly fail. Neither Apple nor Google has a legal obligation under EU or US law to detect sideloaded stalkerware — the term "sideloaded" is doing heavy lifting here. Apple's closed ecosystem creates contractual obligations via App Store terms, but for apps distributed outside the App Store (enterprise certificates, TestFlight abuse, etc.), their detection is voluntary, not regulatory. Google has slightly more covered ground with Play Protect, but again, this is a product feature, not a legal duty.
The regulatory gap
The fundamental problem: no jurisdiction has created a perimeter obligation requiring mobile OS vendors to detect and report stalkerware installations, regardless of distribution channel. The ePrivacy Directive was designed in an era of browser cookies, not persistent device compromise. The closest analogy is the UK's Online Safety Bill (now Online Safety Act 2023), which imposes duties of care on platforms regarding illegal content — but this applies to social media, not device operating systems.
My assessment: We need a multi-jurisdictional framework that treats stalkerware as a product safety issue, not just a criminal one. If a manufacturer sold a physical surveillance device disguised as children's protection equipment, consumer protection agencies would intervene immediately. Digital products should face equivalent scrutiny. Under the proposed EU Cyber Resilience Act, Article 10 on vulnerability handling and Article 13 on reporting obligations might apply to stalkerware distributors if classified as "products with digital elements" — but the franchise model deliberately obscures the product classification chain.