Shad, an app built by Iran’s Education Ministry for online learning during the pandemic, reported more than 18 million active users in October 2021. HRW’s analysis of its code found it can collect children’s precise location, including current and last known location, Wi-Fi network name, IP address, contacts and any saved photos of those contacts. HRW lists Shad as having no privacy policy, and Iran has no data protection law; a draft act pending since 2018 has no specific protections for children.