A Chinese toy manufacturer accused by U.S. regulators of illegally collecting children’s location data is also selling its products to Canadian consumers.
Apitor Technology, based in Shenzhen near Hong Kong, produces Lego-style robotic building kits marketed as STEM learning tools. The toys are controlled through a smartphone app, which U.S. authorities say allowed a third party in China to collect sensitive data from children without parental consent.
The U.S. Federal Trade Commission (FTC) and Department of Justice (DOJ) allege that Apitor’s app violated the Children’s Online Privacy Protection Act, a federal law requiring companies to inform parents and get their approval before collecting children’s personal information.
“Apitor allowed a Chinese third party to collect sensitive data from children using its product,” said Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection. “Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent — even if the data is collected by a third party.”
The data was reportedly transmitted to Jiguang (Aurora Mobile), a Chinese mobile developer and analytics firm whose privacy policy allows it to use collected data for advertising and to share with other third parties.
Apitor toys are currently available through several major online retailers in Canada. The Office of the Privacy Commissioner of Canada (OPC) told CTV News it has not received any complaints about Apitor but will reach out to the FTC “to better understand the situation and determine next steps.”
The OPC enforces Canada’s privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), which requires organizations to inform users — including parents — about data collection practices and obtain consent. Earlier this year, Privacy Commissioner Philippe Dufresne launched consultations to develop a new children’s privacy code for Canada.
The U.S. Department of Justice announced Tuesday that a federal court order has resolved the case against Apitor. The company must delete all improperly collected personal data and implement stricter parental consent procedures. A US$500,000 civil penalty has been suspended due to Apitor’s reported inability to pay.
“The DOJ will vigorously work to ensure businesses respect parents’ rights to decide when their children’s personal information can be collected and used,” said Assistant Attorney General Brett A. Shumate.
Apitor has not responded to requests for comment.