The Federal Trade Commission has once again reminded the mobile ecosystem that compliance obligations under the Children’s Online Privacy Protection Act (“COPPA”) do not stop at an app developer’s door. In a recent enforcement action, the Commission
announced a settlement with Apitor Technology Co., Ltd., a toymaker whose companion app for robot toys allegedly allowed a third-party software development kit (“SDK”) to gather children’s geolocation data without first securing verifiable parental consent. Although the FTC focused its press release on Apitor, the message is unmistakable: when you embed someone else’s code, you inherit that party’s privacy risks—and, if children are involved, the FTC’s spotlight.
Below is a quick summary of the facts and five practical steps to keep your own house in order.
What the FTC Said
- The conduct. Apitor’s coding team plugged a third-party SDK into its child-directed app. That SDK, according to the Commission, quietly collected precise location information from kids using Android devices.
- The violation. Collection of geolocation data is plainly “personal information” under COPPA. That means the operator (here, Apitor) must give parents clear notice and obtain verifiable consent before any such data is gathered. Apitor allegedly did neither.
- The settlement. To resolve the charges, Apitor agreed to a monetary penalty, deletion of improperly collected data, a COPPA-compliant privacy program, and ongoing reporting obligations. The order drives home that outsourcing functionality does not outsource liability.
Lessons for App Developers
- Inventory Every SDK—Continuously. COPPA starts with knowing what information is collected. Maintain an up-to-date manifest of all third-party code modules, their data flows, and their default settings. Make SDK review part of every release cycle; “set-it-and-forget-it” is an invitation to an FTC complaint.
- Treat Geolocation as High-Risk Data. Location data has always been sensitive, but the regulatory heat is rising. If your app is even arguably child-directed, assume geolocation collection is off-limits absent robust, tested parental consent mechanisms.
- Build Vendor Diligence Into Contracts—Not Just Policies. COPPA requires operators to take “reasonable steps” to ensure service providers can protect kids’ data. Translate that into contract language: data-flow diagrams, audit rights, indemnities, prompt breach notification, and an obligation to flow down COPPA safeguards to any sub-processors.
- Adopt a ‘Separate Consent’ Mindset Now. The 2025 COPPA rule revisions will demand a distinct opt-in for sharing children’s data with third parties for anything other than an “integral” purpose. should begin structuring apps to capture that additional consent track and storing granular consent records.
- Do Not Rely Solely on an Age Gate. The FTC’s FAQs emphasize that a neutral age screen is helpful but not a shield. If the content, marketing, or user base skews toward kids, regulators may treat the service as child-directed regardless of an age-up prompt. Conduct a holistic “child-appeal” assessment covering app imagery, advertisements, influencer campaigns, and app-store category selections.
The Bottom Line
Apitor’s experience is a textbook example of how a line of third-party code can upend a product launch and invite years of FTC oversight. As the FTC finalizes its strengthened COPPA rule—and state attorneys general ramp up parallel enforcement—mobile developers should view privacy due diligence as an engineering requirement, not a legal afterthought.
