Roku accused of selling children’s data to advertisers and brokers

The state of Florida has accused Roku, which powers many smart TVs and streaming devices, of selling children’s data to third parties without their consent. According to the Florida Attorney General James Uthmeier, Roku collected viewing habits, voice recordings, and precise geolocation from kids without approval from parents.

Roku, which reaches around 145 million people across half of US households, allegedly gathered children’s data despite clear signals that the viewers were minors, the AG said.

After collecting the data, Roku made it available to advertisers and sold it to data brokers, including Kochava, according to the Florida government. Kochava is already facing its own lawsuit from the Federal Trade Commission, which claims the company sells highly sensitive consumer information.

Uthmeier’s office said in a news release:

“The State contends that Roku’s practices violated Florida’s privacy and consumer-protection laws by failing to obtain parental consent before selling or processing children’s data and by misrepresenting the effectiveness of its privacy controls and opt-out tools.”

In the complaint filed in court, the AG’s office accused Roku of turning a blind eye to the collection of minors’ data.

“Roku knows that some of its users are children but has consciously decided not to implement industry-standard user profiles to identify which of its users are children.”

The lawsuit claims Roku ignored obvious indicators, such as when users installed its Kids Screensaver or Kids Theme Pack products.

Uthmeier’s office also said that although Roku sells deidentified data to brokers (that is, data that has identifying information removed), it’s still possible for brokers like Kochava to reidentify users. Brokers often have troves of information of their own, such as device IDs linked to potentially identifying information, which can allow them to match records to specific people.

Florida has filed the lawsuit under the Florida Digital Bill of Rights (FDBR), which came into effect on July 1, 2024. The law protects Florida residents’ privacy, including children’s data rights, and gives parents the ability to opt out of data processing for their kids.

The penalty for violating the FDBR is up to $50,000 per violation, but that triples for violations where the consumer involved is a known child. That includes cases of “willful disregard of a child’s age.”

This isn’t the only case that Roku must navigate in court. In April, Michigan Attorney General Dana Nessel also sued Roku for similar violations, accusing it of violating laws including the Children’s Online Privacy Protection Act (COPPA), along with federal and state privacy laws. Roku is fighting the suit.

Smart TV advertising is big business in the US. So much, in fact, that Roku appears to sell its devices at a loss to power its platform revenues, which include not just subscriptions, but advertising. In fiscal 2024, it lost $80.3 million on device sales, up from $43.9 million in device-based losses the prior year. Yet it made $1.9 billion profit from its platform business, up from $1.567 billion in 2023.

According to reports, Roku’s Automatic Content Recognition (ARC) technology captures thousands of images each hour from smart TVs. These can be used to help track viewing activity.

In January, Roku launched its Data Cloud, a service that allows its partners to use the company’s proprietary TV data. It was the latest step in a multi-year strategy to build out its data offering. In 2022, it launched a ‘clean room’ product that allowed other companies to combine their data with Roku’s own, conducting queries about viewer behavior while preserving privacy (this is how companies access its Data Cloud). Then, in 2024, it launched Roku Exchange—an advertising hub for partners.

We don’t just report on data privacy—we help you remove your personal information

Cybersecurity risks should never spread beyond a headline. With Malwarebytes Personal Data Remover, you can scan to find out which sites are exposing your personal information, and then delete that sensitive data from the internet.