Justice Department sues toy maker Apitor over illegal collection of children’s location data

The U.S. Department of Justice has filed a lawsuit against Apitor Technology, accusing the toy manufacturer of allowing a Chinese third party to collect the precise geolocation data of children without parental consent. The complaint, brought after a referral from the Federal Trade Commission, alleges the company violated the Children’s Online Privacy Protection Rule.

Apitor, which markets robotic toys for children ages 6 to 14, offers a free Android app to control the devices. The app requires users to enable location services for connectivity. However, federal investigators say the app also embedded JPush, a software development kit from Chinese firm Jiguang, which has been harvesting children’s location data since at least 2022. According to the complaint, this data could be used for any purpose, including targeted advertising, without parents’ knowledge.

“After Android users have enabled location permissions for the Apitor App, the app begins collecting their precise geolocation data in the background and transmitting it to JPush internet servers,” the filing states. Officials say Apitor failed to disclose this practice or obtain verifiable parental consent.

Under a proposed settlement, Apitor must comply with COPPA by ensuring all third-party software partners follow the law, notify parents before collecting personal information, obtain consent, delete previously collected data, and retain records only as necessary. The company has also been ordered to pay a $500,000 civil penalty, though payment will be suspended because of reported financial hardship. The penalty will become due in full if Apitor is found to have misrepresented its financial situation.

“Apitor allowed a Chinese third party to collect sensitive data from children using its product, in violation of COPPA,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection. “COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent—even if the data is collected by a third party.”

The action comes as regulators intensify scrutiny of children’s online privacy. On Tuesday, the FTC announced that Disney agreed to pay a $10 million civil penalty to resolve allegations that it mislabeled YouTube videos for children, enabling the collection of kids’ personal data without parental notice or consent.