The U.S. Department of Justice filed a lawsuit against toy manufacturer Apitor Technology. U.S. authorities believe the company allowed a third party from China to collect children’s geolocation data without their knowledge and without parental consent.
In a lawsuit filed by the Department of Justice following a notice from the Federal Trade Commission (FTC), it is alleged that the company violated the Children’s Online Privacy Protection Act (COPPA), failed to notify parents about data collection, and did not obtain consent before collecting location information.
Apitor Technology sells robot toys for children aged 6–14 and also provides users with a free Android app for control. To connect and use the toys, you must grant permission to transmit location data.
The app also includes the built-in JPush — a third-party SDK developed by Jiguang (aka Aurora Mobile), which has been used since 2022 to collect precise location data on thousands of children. These data are then used for various purposes, including targeted advertising.
“After Android users grant the Apitor app permission to access their location, it begins collecting their precise geolocation data in the background and sending it to JPush’s servers,” the complaint states. “The defendant does not inform users at all that the app allows a third party to collect precise geolocation data, and does not obtain parents’ consent to collect their children’s precise geolocation data.”
According to the proposed settlement, Apitor will be required to ensure that any third-party software it uses complies with COPPA, and will also pay a fine of $500,000.
Additional requirements from the authorities include notifying parents about the collection of their children’s data, obtaining their consent, deleting all collected personal information, and retaining data only when necessary.
“COPPA clearly states: companies that provide online services to children must notify parents if they collect their children’s personal information and obtain parental consent — even if the data is collected by a third party,” the FTC says.