Chinese toymaker accused of violating children’s privacy in U.S., products also sold in Canada

Chinese toymaker Apitor Technology is accused by U.S. authorities of illegally sharing children’s location data. They are also selling app-controlled toys in Canada. (Apitor Technology)

A Chinese toymaker accused by U.S. authorities of illegally sharing children’s location data is selling app-controlled toys in Canada.

Headquartered near Hong Kong in Shenzhen, Apitor Technology sells Lego-like building kits for robots that are programmed and controlled through a smartphone app. According to the company’s website, Apitor markets the toys as STEM education tools that help “kids learn and grow in science, technology, engineering and math.”

According to the U.S. Federal Trade Commission (FTC) and U.S. Department of Justice (DOJ), Apitor’s app allowed a third party in China to collect location data from children without notifying parents or obtaining their consent. By doing so, U.S. authorities say Apitor violated what’s known as the Children’s Online Privacy Protection Act.

“Apitor allowed a Chinese third party to collect sensitive data from children using its product,” Christopher Mufarrige, director of the FTC’s Bureau of Consumer Protection, said in a news release. “Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent — even if the data is collected by a third party.”

• Have you or a family member purchased one of these toys? CTVNews.ca wants to hear from you. Share your story by emailing us at [e-mail] with your name, general location and phone number in case we want to follow up. Your comments may be used in a CTV News story.

The third party that received the data is a Chinese mobile developer and analytics provider known as both Jiguang and Aurora Mobile. Jiguang’s privacy policy allows it to use the data it collects for any purpose, including advertising and sharing it with other third parties.

In Canada, Apitor’s toys are available through several large online retailers.

CTVNews.ca reached out to Office of the Privacy Commissioner of Canada, which said it has not received any complaints about Apitor.

“The Office will be reaching out to the U.S. Federal Trade Commission to better understand the situation and determine next steps,” a spokesperson said.

The office is responsible for overseeing compliance with Canada’s privacy laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA). The act requires organizations to provide information about data collection and seek user consent.

The privacy watchdog previously published tips for parents about internet-connected toys. In May, Privacy Commissioner Philippe Dufresne announced a consultation to help inform the development of a new children’s privacy code.

“Organizations must provide privacy information to young people (and their parents/guardians as appropriate) in a concise, prominent and clear manner suited to the maturity of the young person,” the privacy office spokesperson said. “They should also be transparent about any privacy risks associated with using their product or service.”

On Tuesday, the DOJ announced that a U.S. federal court order had resolved the allegations against Apitor. Apitor has been ordered to delete any personal information that was improperly collected, and it must also now make reasonable efforts to directly notify and obtain verifiable parental consent before gathering or using data from children. A court-ordered civil penalty of US$500,000 has been suspended due to Apitor’s alleged inability to pay.

Apitor did not respond to a request for comment.

“The (DOJ) will vigorously work to ensure businesses respect parents’ rights to decide when their children’s personal information can be collected and used,” U.S. Assistant Attorney General Brett A. Shumate said in a news release. “We will continue to work with the (FTC) to stop unlawful intrusions on children’s privacy.”