[co-author: Stephanie Kozol]*
On April 29, Michigan Attorney General (AG) Dana Nessel filed a lawsuit against Roku, Inc. (Roku), the smart TV and device provider and streaming service, alleging Roku violated the Children’s Online Privacy Protection Act (COPPA), federal and state privacy laws, the Michigan Consumer Protection Act, and other laws by collecting children’s personal data and selling it without proper parental consent. The lawsuit sought damages and equitable relief on behalf of Michigan consumers who subscribed to Roku’s streaming service. More information regarding this lawsuit can be found here.
On July 14, Roku responded by filing a motion to dismiss, seeking to dismiss the state’s claims except for the COPPA claims. Roku argued that the AG did not have standing to pursue the non-COPPA claims and that those claims fail as a matter of law because they are not sufficiently pled. Roku did not seek dismissal of the COPPA claims through a pre-answer motion.
Roku Contests Alleged Collection and Sharing of Children’s Data
The Michigan AG’s lawsuit alleged Roku systematically collected children’s personal data and allowed third parties to collect such data. Roku’s motion contested the basis of these allegations and asserted that the claims were not sufficiently pled. Roku argued that the state misrepresents how its services operate and how the company works to protect user privacy. Roku further argued it does not use or disclose children’s personal information for targeted advertising or other prohibited purposes and does not partner with third-party trackers or data brokers to sell children’s data.
Roku asserted that the company only allows Roku devices or mobile applications to be used through accounts created by registered users who are 18 or older and who have agreed to Roku’s terms of use. Roku also emphasized that it “does not currently offer options for sub-accounts or profiles,” so it relies on an adult parent or guardian to manage and control how their children use Roku accounts. Roku argued that it is impossible for it to have actual knowledge of whether activities and data generated within an account are attributable to a child because it “does not use individual user profiles or know the identity of those users outside of the registered [adult] account holder.” Roku further argued that it is not reasonably foreseeable that an ordinary person could identify an individual from the user data it currently processes.
Finally, Roku refuted the Michigan AG’s allegations that it violated the Michigan Consumer Protection Act because it provided clear explanations about its data sharing practices to adult account holders. Roku further argued that its “Do not share or sell my personal information” setting, a feature required by California law, was not misleading for Michigan users. It argued that the accompanying explanatory text clarified that this setting’s scope was limited to restricting “cross-context behavioral advertising” or “targeted advertising,” which was sufficient to prevent a reasonable user from assuming a broader limitation on data sharing as alleged by the Michigan AG.
Roku Also Refuted the Michigan AG’s Standing
Roku also challenged the Michigan AG’s standing to pursue a lawsuit under the doctrine of parens patriae. The doctrine of parens patriae authorizes AGs to pursue civil actions on behalf of the residents of their states in cases where those individuals cannot protect themselves.
Roku argued that while states can assert parens patriae in certain situations, it is a limited exception to the rule that a litigant must bring their own claims. Roku claimed that the specific circumstances of the AG’s claims did not justify the use of parens patriae because the Michigan AG’s office was seeking individual claims for damages.
Roku argued that a “quasi-sovereign” interest, such as the physical or economic interest of the state’s residents, must be involved for a state to utilize its parens patriae authority to bring claims on behalf of its residents. Roku asserted that the Michigan AG’s lawsuit, which focused on the alleged disclosure of Roku users’ personal video watching history, failed to identify a quasi-sovereign interest. Therefore, Roku contends that AGs are generally not permitted to bring damage claims for their residents in the manner the Michigan AG attempts in this case.
Roku also cautioned against potential issues if states were broadly allowed to utilize their parens patriae authority in the manner proposed by the Michigan AG. Roku alleged that this approach is tantamount to consolidating numerous individual plaintiffs into a class action suit without adhering to the inherent safeguards and due process requirements of a formal class action. In a formal class action, a representative plaintiff brings a claim on behalf of many others while providing notice and the opportunity to be heard to other potential class members; whereas, in the parens patriae claim, Michigan residents do not have the opportunity to be heard or to allege their harms with any particularity as the AG’s office is pursuing the claims. Pursuant to the briefing schedule stipulated by the parties, the AG’s opposition to the motion to dismiss is scheduled to be filed on or before August 18.
*Senior Government Relations Manager
