FTC sues robot toy maker Apitor over children’s privacy violations

The Federal Commerce Fee filed a lawsuit towards Chinese language robotic toy producer Apitor Expertise Co., Ltd. on September 2, 2025, alleging the corporate enabled unauthorized assortment of youngsters’s geolocation information via its cellular app with out acquiring correct parental consent. The Division of Justice criticism, filed within the Northern District of California, seeks everlasting injunctions and civil penalties for violations of the Youngsters’s On-line Privateness Safety Rule.

“Apitor didn’t notify mother and father and procure their consent earlier than gathering, or inflicting a 3rd celebration to gather, geolocation information from youngsters as required by COPPA,” the criticism states. The lawsuit facilities on Apitor’s integration of a third-party software program growth package referred to as JPush into its companion cellular app, which allegedly allowed the Chinese language analytics supplier to gather exact location info from customers below 13 years previous.

Robotic toys require location permissions

Apitor sells programmable robotic toys focused to youngsters ages 6-14 via on-line retailers together with Amazon. The corporate markets these merchandise as instructional instruments designed to show coding expertise via a companion cellular app referred to as Apitor Package. Youngsters should obtain and function this app to program and management their robotic toys, making it important for the product’s performance.

The criticism particulars how customers with Android gadgets encounter obligatory location sharing necessities when making an attempt to attach their toys. “Allow location info permission for customers to hook up with the robotic utilizing Bluetooth to regulate the robotic, or not to hook up with the robotic if permission is denied,” the app message reads. Customers who decline these permissions can’t connect with their bought robotic toys.

This requirement creates what the FTC describes as a coercive atmosphere the place youngsters should sacrifice privateness protections to make use of merchandise they’ve already bought. The Apitor App has been downloaded 1000’s of occasions from the Google Play retailer, probably affecting 1000’s of kid customers throughout the US.

Third-party information assortment via JPush

The central allegation entails Apitor’s integration of JPush, a software program growth package supplied by Jiguang (Aurora Cell Ltd.), a Chinese language cellular developer and analytics supplier. SDKs are widespread instruments that app builders use so as to add performance resembling push notifications or utilization analytics with out creating these options internally.

JPush’s privateness coverage explicitly states that its SDKs gather and use location info when app customers allow location permissions. The coverage grants Jiguang broad latitude to make use of collected information for varied functions, together with promoting and sharing with extra third events.

“After Android customers obtain the Apitor app, it begins gathering and sharing customers’ exact location information with JPush’s servers, unbeknownst to youngster customers and their mother and father,” the criticism alleges. This information transmission happens mechanically within the background as soon as location permissions are granted, with none extra disclosure or consent mechanisms.

The lawsuit emphasizes that oldsters and kids obtain no notification about this third-party information assortment. Apitor’s privateness coverage mentions gathering varied sorts of info from youngsters however fails to reveal that the app permits third events to gather geolocation information.

Privateness coverage contradictions

Apitor’s privateness coverage comprises a bit entitled “Youngsters’s Privateness” declaring, “We care about youngsters’s privateness. We’re dedicated to complying with the Youngsters’s On-line Privateness Safety Act (COPPA).” The coverage states that some private info is saved regionally on gadgets and “there isn’t a importing of such info to the online or Apitor servers.”

Nonetheless, the FTC alleges this illustration is deceptive given the JPush integration. Whereas Apitor could in a roundabout way add location information to its personal servers, the corporate enabled a 3rd celebration to gather this info via its app with out correct disclosure or parental consent.

The privateness coverage additionally claims Apitor will notify mother and father and procure verifiable consent earlier than “enabling sure information gathering options for his or her youngster.” The criticism argues this dedication was not fulfilled relating to geolocation assortment via JPush.

Customers registering for Apitor App accounts or utilizing the app as company obtain no prompts for verifiable parental consent relating to geolocation information assortment. This represents a major hole between acknowledged privateness practices and precise implementation.

COPPA compliance necessities

The Youngsters’s On-line Privateness Safety Act requires operators of internet sites or on-line companies directed to youngsters to satisfy particular necessities earlier than gathering private info from customers below 13. These embody offering clear discover to oldsters about information assortment practices and acquiring verifiable parental consent earlier than gathering, utilizing, or disclosing youngsters’s private info.

The COPPA Rule defines private info broadly to incorporate geolocation info adequate to establish road names and metropolis areas. This definition clearly encompasses the exact location information that JPush allegedly collected via the Apitor App.

Current COPPA rule amendments that took impact June 23, 2025, strengthened these necessities with enhanced consent mechanisms for third-party information sharing. The timing of the Apitor lawsuit coincides with this heightened regulatory scrutiny of youngsters’s privateness practices in digital environments.

Enforcement patterns emerge

The Apitor case represents a part of a broader FTC enforcement marketing campaign focusing on youngsters’s privateness violations throughout digital platforms. The Fee sued TikTok in August 2024 for alleged COPPA violations involving assortment of non-public information from youngsters below 13 with out correct parental consent.

Disney faced a $10 million penalty introduced September 2, 2025, for failing to guard youngsters’s privateness on YouTube by improperly labeling child-directed movies and enabling focused promoting to customers below 13.

These enforcement actions exhibit the FTC’s dedication to vigorous COPPA enforcement amid the digital promoting business’s adaptation to youngsters’s privateness laws. The instances collectively spotlight challenges dealing with firms that combine third-party applied sciences with out satisfactory privateness safeguards.

Technical and enterprise implications

The Apitor lawsuit illustrates dangers related to third-party SDK integration in youngsters’s apps. Software program growth kits typically present useful performance however can create compliance vulnerabilities after they gather information past the first app operator’s management or data.

Corporations creating youngsters’s merchandise should consider not solely their direct information assortment practices but in addition any info gathering enabled via third-party integrations. This consists of understanding the privateness insurance policies and information use practices of SDK suppliers, significantly these based mostly in jurisdictions with totally different privateness requirements.

The case additionally highlights tensions between product performance and privateness safety. Apitor’s Bluetooth connectivity requirement created a technical dependency on location permissions, which the corporate then leveraged via JPush for extra information assortment functions.

Advertising and marketing business impression

For the digital promoting business, the Apitor case reinforces the significance of COPPA compliance in age-directed companies. The lawsuit demonstrates how third-party analytics and promoting applied sciences can create legal responsibility for app operators who fail to supply correct discover and procure consent.

Google’s implementation of machine studying age detection methods displays business efforts to mechanically establish and shield youngster customers from inappropriate information assortment and promoting. These technological approaches intention to handle compliance challenges highlighted by instances like Apitor.

The case happens as marketing professionals navigate more and more advanced youngsters’s privateness necessities throughout a number of jurisdictions. Corporations should stability promoting income alternatives with regulatory compliance obligations and youngster security issues.

Authorized proceedings forward

The Northern District of California will hear the case below venue provisions that think about Google LLC’s Santa Clara County headquarters related to claims involving Android app distribution via the Google Play Retailer. This jurisdictional strategy displays the interconnected nature of recent digital commerce and promoting methods.

The FTC seeks everlasting injunctions stopping future COPPA violations, civil penalties for every violation of the rule, and extra aid deemed acceptable by the court docket. Civil penalties below COPPA can attain substantial quantities, significantly when violations have an effect on 1000’s of youngsters over prolonged intervals.

Apitor should adjust to a number of COPPA necessities together with notifying mother and father earlier than gathering youngsters’s private info, acquiring verifiable parental consent earlier than assortment or use, deleting youngsters’s info at parental request, and retaining private info solely so long as fairly obligatory.

The case timeline will depend upon Apitor’s response to the criticism and potential settlement negotiations. Current COPPA enforcement actions have typically resulted in consent agreements moderately than prolonged litigation, suggesting attainable decision paths for the events.

Regulatory atmosphere shifts

The Apitor enforcement motion happens amid important adjustments to youngsters’s privateness laws. The Interactive Advertising Bureau previously warned about proposed COPPA adjustments probably limiting youngsters’s on-line entry, although business issues haven’t deterred FTC enforcement efforts.

State-level privateness laws and worldwide frameworks proceed creating alongside federal COPPA necessities. Corporations working globally should navigate a number of regulatory methods with various approaches to youngsters’s privateness safety.

The cumulative impact of those enforcement actions and regulatory adjustments is reshaping how firms strategy youngsters’s digital services and products. Conventional enterprise fashions counting on in depth information assortment and third-party sharing face growing compliance prices and authorized dangers.

Timeline

• 2022: Apitor begins promoting app-enabled robotic toys directed to youngsters ages 6-14
• 2020-2025: Alleged COPPA violations happen via JPush SDK integration
• June 23, 2025: New COPPA rules take effect with enhanced third-party consent necessities
• August 2024: FTC sues TikTok for alleged COPPA violations
• September 2, 2025: Disney agrees to $10 million settlement for YouTube youngsters’s privateness violations
• September 2, 2025: Division of Justice information lawsuit towards Apitor Expertise Co., Ltd.

Abstract

Who: The Federal Commerce Fee sued Apitor Expertise Co., Ltd., a Chinese language company that develops programmable robotic toys for kids ages 6-14.

What: The lawsuit alleges Apitor violated the Youngsters’s On-line Privateness Safety Rule by enabling unauthorized assortment of youngsters’s geolocation information via a third-party software program growth package referred to as JPush with out acquiring correct parental discover and consent.

When: The criticism was filed September 2, 2025, overlaying alleged violations occurring since no less than 2022 when Apitor started promoting its robotic toys via retailers like Amazon.

The place: The lawsuit was filed within the U.S. District Court docket for the Northern District of California, with jurisdiction based mostly on Google LLC’s Santa Clara County headquarters the place the Apitor App was distributed via the Google Play Retailer.

Why: The FTC acted as a result of Apitor allegedly collected exact geolocation information from 1000’s of youngsters via obligatory location permissions required for Bluetooth connectivity, then enabled JPush to make use of this information for promoting and different functions with out parental consciousness or consent, violating elementary COPPA necessities designed to guard youngsters’s on-line privateness.