The Federal Trade Commission is taking action against robot toy maker Apitor Technology over allegations that its app enabled a third party in China to collect geolocation information from children without parental consent.

A complaint, filed by the Department of Justice upon notification and referral from the FTC, alleges that despite claims in Apitor's privacy policies that it complies with Children's Online Privacy Protection Rule (COPPA Rule), Apitor failed to notify parents and obtain their consent before collecting, or causing a third party to collect, geolocation data from children as required by COPPA.

"Apitor allowed a Chinese third party to collect sensitive data from children using its product, in violation of COPPA," said Christopher Mufarrige, Director of the FTC's Bureau of Consumer Protection. "COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents' consent-even if the data is collected by a third party."

China-based Apitor sells robot toys targeted to children ages 6-14 and includes a free companion mobile app that allows users to program and control the toys. The complaint alleges that:

• Users with Android devices are required to enable location sharing to use the Apitor app and connect their toy.
• Apitor integrated a third-party software development kit called JPush into its app that allowed JPush's developer to collect location data and use it for any purpose, including advertising.
• After Android users download the Apitor app, it begins collecting and sharing users' precise location data with JPush's servers, unbeknownst to child users and their parents.
• Throughout this process, Apitor failed to notify parents that a third party was collecting geolocation information and obtain parents' consent before collecting this data from children under the age of 13, as required by COPPA.

As part of a proposed ordersettling the allegations, Apitor will be required to ensure that any third-party software it uses is in compliance with the COPPA Rule. Other provisions of the proposed order include a $500,000 penalty, which will be suspended because of the company's inability to pay. Apitor will be required to pay the full amount if it is found to have lied about its finances. Apitor also will be required to delete any personal information the company collected in violation of COPPA unless it notifies parents and obtains their consent.

In addition, Apitor must comply with COPPA by:

• notifying parents before Apitor collects, or permits collection on its behalf, of personal information from children under 13;
• obtaining verifiable parental consent before Apitor, or another party acting on Apitor's behalf, collects, uses, or discloses personal information of children under 13;
• deleting a child's personal information at the request of a parent; and
• only retaining personal information collected from children for as long as it is reasonably necessary to fulfill the purpose for which the information was collected.

The Commission voted 3-0 to refer the complaint and the proposed stipulated order to the Department of Justice for filing. The DOJ filed the complaint and stipulated order in the U.S. District Court for the Northern District of California.

NOTE: The Commission authorizes the filing of a complaint when it has "reason to believe" that the named defendant is violating or is about to violate the law and it appears to the Commission that a proceeding is in the public interest. Stipulated orders have the force of law when approved and signed by the District Court judge.

The lead staffers on this matter are Shining J. Hsu and Evan Rose from the FTC's Western Region San Francisco office.