€33,748 in kid purchases: stop trusting defaults and lock it down

How many times can a seven-year-old tap "Buy" before someone notices? In one German household the answer was 1,210. The bill: €33,748. And the father who got it could not pass it back to the platform.

The Regional Court of Karlsruhe (case 2 O 64/23) ruled on September 24, 2025, according to Tarnkappe.info, that the father must bear the costs. Between February 2021 and September 2022, his son made purchases ranging from €0.99 to €109.99 through a Google Play account with the father's credit card on file. The father had told the boy not to buy anything. He had not enabled protections, set up a child account or set spending limits. He only noticed when he looked at his card statement in September 2022.

The ban that didn't count

The most uncomfortable detail is that the father did the "parenting" part. He set rules and limited screen time. heise online notes that his ban on purchases was irrelevant to the outcome. The legal mechanism is the Anscheinsvollmacht, or apparent authority. If you let someone transact through your account for a long time and could have noticed and stopped it, the platform may treat those transactions as yours. Android Digital adds that the child's age did not change this.

Our view: the ruling is harsh, but its logic is easy to follow. To the platform, a verbal rule doesn't exist. A password prompt does.

It is also not a blank check for the industry. Android Digital stresses that this is a single regional court decision, not a Federal Court of Justice precedent, and that lawyers point out brief unauthorized use typically would not create the same appearance of consent. Duration clearly mattered: about 20 months. Nobody can promise another court would rule the same way. But betting your savings on that is a poor strategy.

Defaults still favor the checkout

Here is where we part ways with the court's tidy moral. Yes, the father was negligent. But a system where a stored card plus a handed-over tablet can produce more than a thousand charges without friction is a design choice. The legal commentary at recht24-7 suggests that in-app purchases should perhaps be blocked by default unless an adult explicitly agrees. We think that is the right direction.

Apple shows it can be done in part. Android Digital cites the consumer advice center in saying that for children under 13, the "Ask to Buy" request is on by default, so a parent approves each purchase. For older kids you have to set it up through their own Apple ID. Even that is a partial answer: it depends on the child having their own account. Hand over a parent's logged-in device and, in our reading, the protection may not apply.

So the platforms are not innocent. A €109.99 purchase should not be as frictionless as a €0.99 one, and repeated spending in a month should trigger something louder than an email that gets ignored. According to Tarnkappe.info, the father checked neither his card statements nor his emails. If a notification can go unread for 20 months, we think it is a weak safeguard.

Ten minutes today, and one habit

Until the platforms change, the burden lands on you. The practical list is short:

• Require authentication for every purchase, not just the first.
• Set up a child profile (Family Link on Android, a child Apple ID on iPhone) instead of lending your own logged-in account.
• Consider prepaid balances rather than a linked credit card, as consumer advocates cited by Mein Bavaria recommend.
• Look at your card statement monthly. Android Digital reads the Karlsruhe verdict as punishing a lack of control as much as a lack of locks.

If you spot surprise charges, act immediately. Android Digital notes that the longer they go unchallenged, the more it looks as though you tolerate them.

Our verdict: don't read this story as a freak accident or as pure parental failure. It is both a warning and an indictment of lax defaults. But a courtroom is a bad place to find out which one the judge will emphasize. Turn the controls on tonight. It costs ten minutes, and the alternative has a price tag with five digits.