The U.S. Department of Justice has sued toy maker Apitor Technology for allegedly allowing a Chinese third party to collect children’s geolocation data without their knowledge and parental consent.

A complaint filed by the Justice Department, following a notification from the Federal Trade Commission, alleges that Apitor violated the Children’s Online Privacy Protection Rule (COPPA) by failing to notify parents or obtain their consent before collecting their children’s location information.

Apitor, which sells robot toys for children aged 6-14, provides users with a free Android app that helps control the toy robots. To connect and use the toys, the users must enable location sharing.

However, the app also embeds JPush, a third-party software development kit (SDK) developed by Jiguang (also known as Aurora Mobile), which has been used to collect the precise location data of thousands of children since at least 2022 for any purpose, including targeted advertising.

“After Android users have enabled location permissions for the Apitor App, the app begins collecting their precise geolocation data in the background and transmitting it to JPush internet servers,” the complaint reads.

“At no point does Defendant disclose to users that the app allows a third party to collect precise geolocation data, nor does it seek verifiable consent from parents to collect precise geolocation data from their children.”

Under a proposed settlement, Apitor will be required to ensure that any third-party software it uses also complies with COPPA and pay a $500,000 penalty. Although the penalty will be put on hold due to Apitor’s ongoing financial difficulties, the company will have to pay the full amount if it was dishonest about its finances.

Additional requirements include notifying parents before collecting data, obtaining their consent, deleting all collected personal information, and retaining data only as necessary.

“Apitor allowed a Chinese third party to collect sensitive data from children using its product, in violation of COPPA,” said Christopher Mufarrige, Director of the FTC’s Bureau of Consumer Protection, on Wednesday.

“COPPA is clear: Companies that provide online services to kids must notify parents if they are collecting personal information from their kids and get parents’ consent—even if the data is collected by a third party.”

On Tuesday, the FTC also announced that Disney will pay a $10 million civil penalty to settle claims that it enabled the collection of kids’ personal information without their consent or notifying their parents by mislabeling videos for children on YouTube.