FTC fines toy manufacturer for allowing Chinese third-party to collect kids' data

The Justice Department on Tuesday filed a complaint against a robot toy maker which it said allowed a third-party in China to collect children’s geolocation data without the consent of their parents.

The complaint, which was filed after a referral from the Federal Trade Commission (FTC), alleges that the toy manufacturer Apitor published a privacy policy saying that it complied with the Children’s Online Privacy Protection Rule (COPPA Rule), but in reality violated the law by collecting the location data from children without parental consent.

Apitor, which is based in China, markets its toys to children between the ages of 6 and 14. COPPA requires parental notice and consent to collect data from children under the age of 13.

The FTC has proposed a $500,000 fine, which is “suspended” because Apitor cannot pay it.

The company’s product includes a free mobile app which children can program to control robots. Apitor requires users with Android devices to allow location sharing in order to use the toy’s companion app, according to an FTC press release. 

The manufacturer allegedly embedded a third-party software development kit, JPush, into the app. The kit allowed JPush to gather location data from children and use it as it wished, including for advertising. 

Parents and children were never told, the FTC says.

Apitor’s website does not include contact information for a spokesperson. A message sent to its support portal was not returned.

The proposed order to settle the allegations mandates that Apitor erase all of the data it collected unless it obtains parental consent. If Apitor is found to have misrepresented its finances, it also will be forced to pay the $500,000 penalty.

The FTC appears to be aggressively enforcing COPPA, which was made tougher in January. On Tuesday it announced a $10 million fine against Disney for violating COPPA by improperly collecting children’s data for advertising purposes. 

“COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent—even if the data is collected by a third party,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a prepared statement.

In May, FTC Chair Andrew Ferguson told Congress that “protecting children and teens online is … of paramount importance to the Trump-Vance FTC.”