Loading story…
Florida Attorney General James Uthmeier has initiated legal action against Roku, a leading smart TV company, alleging that the firm collected and sold sensitive personal data belonging to children without proper notice or parental consent. The lawsuit, filed in Collier County Circuit Court, accuses Roku of violating Florida's Deceptive and Unfair Trade Practices Act and the state's Digital Bill of Rights. According to the complaint, Roku gathered a range of sensitive information, including children's online activity, viewing histories, location data, and voice recordings. The data was allegedly sold to third-party data brokers such as Kochava, which is itself under federal scrutiny for its handling of geolocation data, as well as to advertisers. The Attorney General's office claims that Roku failed to implement industry-standard user profiles or age verification mechanisms, despite knowing that a significant portion of its users are children. The complaint highlights that Roku's technology is present in about half of American households, reaching approximately 145 million people as of 2024, amplifying the potential scale of the alleged privacy violations. The state asserts that Roku continued to process and sell children's data even when users signaled their status as children by subscribing to kids-oriented programming and features. Furthermore, the lawsuit alleges that Roku misled consumers about the effectiveness of its privacy controls and opt-out tools, giving users a false sense of security regarding their data privacy. The Attorney General's Office of Parental Rights is seeking civil penalties, injunctive relief, and the implementation of stronger disclosure and parental-control mechanisms. The complaint also notes that four of the five most searched programs on Roku in 2024 were children's entertainment, yet the company did not take adequate steps to determine if users whose data was being sold were minors. The legal action underscores growing regulatory scrutiny over the handling of children's data by technology companies. Roku has not yet publicly responded to the allegations. The case brings attention to the broader issue of data privacy for minors in the digital age, especially as connected devices become more prevalent in households. The involvement of data brokers like Kochava, already facing federal action, adds another layer of complexity to the case. The outcome of this lawsuit could set important precedents for how companies collect, process, and monetize children's data in the future. The case also highlights the challenges regulators face in enforcing privacy protections in rapidly evolving technology ecosystems. If successful, the lawsuit may prompt other states to pursue similar actions against technology firms. The proceedings will be closely watched by privacy advocates, industry stakeholders, and policymakers concerned with children's online safety.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Florida sued Roku, alleging the company illegally sold children's personal data to advertisers and data brokers, including precise geolocation information. The case centers on alleged privacy violations involving minors using Roku's platform.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malwarebytes.com
Open sourcescworld.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Texas Attorney General has filed lawsuits against five leading smart TV manufacturers—Samsung, LG, Sony, Hisense, and TCL—alleging that their devices unlawfully collect and transmit users' personal data without consent. The lawsuits claim that these companies use Automated Content Recognition (ACR) technology to capture screenshots of what users are watching every 500 milliseconds, monitor viewing activity in real time, and send this information back to company servers. The data is then allegedly sold for targeted advertising purposes, raising significant privacy concerns, especially regarding sensitive information such as passwords and banking details that could be exposed. Texas is seeking damages under the Texas Deceptive Trade Practices Act, including up to $10,000 per violation and higher penalties for violations affecting seniors. The state also wants restraining orders to halt the collection, sharing, and selling of ACR data while the lawsuits proceed. Additional concerns have been raised about the potential for Chinese companies Hisense and TCL to be compelled to share U.S. consumer data with the Chinese government under China's National Security Law. The lawsuits emphasize that the collection of ACR data for advertising does not meet a consumer-necessity standard and constitutes an invasive breach of privacy.
Jun 29, 2026
**Samsung** reached a settlement with the **Texas Attorney General** to resolve allegations that its smart TVs collected and processed **Automated Content Recognition (ACR)** viewing data without Texans’ *express, informed consent*. Texas alleged Samsung’s ACR-based *Viewing Information Services (VIS)* captured viewing behavior (including claims it could capture on-screen content) and used it for targeted advertising, and a court initially found “good cause to believe” consumers were automatically enrolled via **dark patterns** that made privacy disclosures difficult to review. Under the agreement, Samsung will **revise privacy disclosures** and implement **clear, conspicuous disclosure and consent screens** so consumers can make an informed choice about data collection and use; Samsung said it does not concede wrongdoing and maintains its prior notices complied with state regulations, while emphasizing it does not “spy” on customers. Texas’s broader litigation against other smart TV manufacturers—**Sony, LG, Hisense, and TCL**—remains ongoing.
Jun 29, 2026
Disney has agreed to pay a $10 million settlement following allegations that it violated the Children’s Online Privacy Protection Act (COPPA) by failing to properly label thousands of its YouTube videos as directed at children. This mislabeling allowed Disney and its partners to collect personal data from children under 13 and serve them targeted advertisements without obtaining parental consent, actions that are explicitly prohibited under COPPA. The Federal Trade Commission (FTC) initially investigated the case before referring it to the Department of Justice (DoJ), which announced the settlement and emphasized the importance of protecting children’s privacy online. The settlement highlights the ongoing regulatory scrutiny of large content providers on platforms like YouTube, especially regarding compliance with child privacy laws. YouTube had previously updated its policies to require content creators to label videos as "made for kids" or not, following its own record $170 million COPPA settlement in 2019. The Disney case underscores the legal and financial risks for companies that fail to adhere to these requirements, reinforcing the government’s commitment to enforcing parental rights and safeguarding children’s data online.
Jun 29, 2026