The Federal Trade Commission (FTC) has taken action against Apitor Technology, a company that manufactures robot toys aimed at children between the ages of 6 and 14. The FTC alleges that Apitor’s mobile app allowed a third party in China to collect geolocation data from children without obtaining parental consent, in violation of the Children’s Online Privacy Protection Rule (COPPA).
According to a complaint filed by the Department of Justice after notification and referral from the FTC, Apitor claimed in its privacy policies to comply with COPPA. However, the company did not notify parents or obtain their consent before collecting or allowing a third party to collect location data from children as required by law.
“Apitor allowed a Chinese third party to collect sensitive data from children using its product, in violation of COPPA,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent—even if the data is collected by a third party.”
The complaint details that Android users must enable location sharing for the Apitor app to function with their toy robots. The app incorporated JPush, a software development kit developed by a third party in China, which collected precise user location data for purposes including advertising. This collection occurred without child users or their parents being aware.
Throughout this process, Apitor did not inform parents about this data collection or seek parental consent before gathering geolocation information from children under 13 years old.
As part of a proposed order resolving these allegations, Apitor will be required to ensure all third-party software it uses complies with COPPA. The order also includes a $500,000 penalty—suspended due to Apitor's inability to pay—which could be reinstated if false financial claims are discovered. Additionally, Apitor must delete any personal information collected in violation of COPPA unless proper parental notification and consent are obtained.
Further requirements state that Apitor must notify parents before collecting personal information from children under 13; obtain verifiable parental consent prior to any such collection or use; delete children's personal information upon parental request; and only retain this information as long as necessary for its original purpose.
The Commission voted unanimously (3-0) to refer both the complaint and proposed stipulated order to the Department of Justice for filing in U.S. District Court for the Northern District of California.
The lead staffers on this case are Shining J. Hsu and Evan Rose from the FTC’s Western Region San Francisco office.
The FTC continues its mission to promote competition while protecting consumers through education and enforcement actions.
