U.S. Sues Robot Toy Maker Over Illegal Collection of Kids’ Data

The U.S. Department of Justice filed a lawsuit against Apitor Technology, accusing the Chinese toy company of allowing a third party to obtain children’s location data without parental authorization.

The complaint, following a referral from the Federal Trade Commission (FTC), says Apitor violated the Children’s Online Privacy Protection Rule (COPPA).

BleepingComputer, who first reported the story, notes that toy robot manufacturer Apitor markets its products to children between 6 and 14 years old, and provides a free Android application for toy control. The application requires children to activate location sharing.

However, the app contains JPush, a third-party software kit from Jiguang (also known as Aurora Mobile), which has collected precise geolocation data of children since at least 2022. The collected data remains open to any possible usage, including promotional activities.

“After Android users have enabled location permissions for the Apitor App, the app begins collecting their precise geolocation data in the background and transmitting it to JPush internet servers,” the complaint reads.

“At no point does Defendant disclose to users that the app allows a third party to collect precise geolocation data, nor does it seek verifiable consent from parents to collect precise geolocation data from their children,” the complaint adds

“Apitor allowed a Chinese third party to collect sensitive data from children using its product, in violation of COPPA,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection.

“COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent—even if the data is collected by a third party,” Mufarrige added.

The proposed settlement requires Apitor to verify that all third-party software meets COPPA requirements, to obtain parental consent before data collection, to notify parents about data collection, to delete personal information upon request, and to maintain data only when necessary.

The $500,000 penalty against Apitor remains suspended because of financial challenges, but will become active if the company provides deceptive financial information.

The DOJ submitted the complaint to the U.S. District Court for the Northern District of California, as part of the FTC’s ongoing efforts to safeguard children’s online privacy.