China-based STEM toy maker collected private data on US children without permission

Apitor Technology, best known for its child-friendly STEM robot kits, has agreed to a $500K settlement with the FTC for allegedly allowing a third-party company in China to collect the geolocations of American kids without parental consent.

The US Federal Trade Commission (FTC) announced the action against the kid robot “designer, developer, producer, and seller” earlier this week.

“Apitor allowed a Chinese third-party to collect sensitive data from children using its product, in violation of COPPA,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection.

Under the 1998 US Children's Online Privacy Protection Act, or COPPA, commercial websites and platforms must obtain parental consent before collecting or processing the personal information of any child ages 13 and younger.

In settling the allegations, Apitor will be required to ensure it complies with the COPPA Rule /2

undefined FTC (@FTC) September 3, 2025

“COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent – even if the data is collected by a third-party,” Mufarrige said.

Apitor’s high-level educational coding robots – many sold on Amazon – are targeted to children ages 6 to 14 and include a free companion mobile app that allows users to program and control the toys, the FTC states. At least eight educational robot kits are advertised on the company’s website, among other STEM products.

“Building instructions, remote control, and programming all in one App!” Apitor promotes on the site.

According to the complaint, Android users who buy the robot kit are required to enable location sharing to use the Apitor app and connect their toy.

Parents were unaware that the apps' integrated third-party software development kit (SDK), named “JPush,” and its developers' servers, would then collect their children’s precise location data and use it for any purpose, including advertising.

The FTC says when consumers downloaded and opened the Apitor App for Android, they were offered two options: register for an Apitor account or use the app as a guest.

“In neither case are users prompted to provide verifiable parental consent to the collection of a child user’s geolocation information, “ the FTC complaint said.

The software developer Jiguang, also known as Aurora Mobile Ltd., is the third party said to have provided the SDK package for the Apitor App. Kids could also use it for other interactive activities, such as playing online games with other users.

Based in Shenzhen, Aurora Mobile is one of China's "leading mobile big data analytics and software solutions providers," according to its website.

As part of the settlement, Apitor, which has not admitted to any wrong doing, has agreed to adhere to COPPA rules moving forward, and additionally:

• Notify parents before collecting or permitting a third-party representative to collect the personal information from children under 13
• Obtain verifiable parental consent before Apitor or a third-party representative collects, uses, or discloses personal information of children under 13
• Delete a child’s personal information at the request of a parent
• Only retain the personal information collected from children for as long as it is reasonably necessary to fulfill the information’s intended purpose

The $500,000 penalty issued by the FTC will be waived on account that Apitor says they are unable to pay.

However, the FTC notes the company will be “required to pay the full the full amount if it is found to have lied about its finances.”