Post

Conversation

🇺🇸 FTC is taking action against robot toy maker 🇨🇳 Apitor Technology over allegations that its app enabled a third party in China to collect geolocation information from children without parental consent. A complaint, filed by the Department of Justice upon notification and referral from the FTC, alleges that despite claims in Apitor’s privacy policies that it complies with Children’s Online Privacy Protection Rule (COPPA Rule), Apitor failed to notify parents and obtain their consent before collecting, or causing a third party to collect, geolocation data from children as required by COPPA. China-based Apitor sells robot toys targeted to children ages 6-14 and includes a free companion mobile app that allows users to program and control the toys. The complaint alleges that: •Users with Android devices are required to enable location sharing to use the Apitor app and connect their toy. •Apitor integrated a third-party software development kit called JPush into its app that allowed JPush’s developer to collect location data and use it for any purpose, including advertising. •After Android users download the Apitor app, it begins collecting and sharing users’ precise location data with JPush’s servers, unbeknownst to child users and their parents. •Throughout this process, Apitor failed to notify parents that a third party was collecting geolocation information and obtain parents’ consent before collecting this data from children under the age of 13, as required by COPPA. As part of a proposed order settling the allegations, Apitor will be required to ensure that any third-party software it uses is in compliance with the COPPA Rule. Other provisions of the proposed order include a $500,000 penalty, which will be suspended because of the company’s inability to pay. Apitor will be required to pay the full amount if it is found to have lied about its finances. Apitor also will be required to delete any personal information the company collected in violation of COPPA unless it notifies parents and obtains their consent. In addition, Apitor must comply with COPPA by: •notifying parents before Apitor collects, or permits collection on its behalf, of personal information from children under 13; •obtaining verifiable parental consent before Apitor, or another party acting on Apitor’s behalf, collects, uses, or discloses personal information of children under 13; •deleting a child’s personal information at the request of a parent; and •only retaining personal information collected from children for as long as it is reasonably necessary to fulfill the purpose for which the information was collected. ftc.gov/news-events/ne therecord.media/chinese-toy-ma