On April 29, 2025, Michigan Attorney General Dana Nessel filed a lawsuit against Roku, Inc., alleging that the company collects and monetizes personal data from children without proper consent. The lawsuit claims that Roku’s practices violate the Children’s Online Privacy Protection Act (COPPA) and other privacy laws.

Michigan Attorney General’s Allegations

In its complaint, filed in the United States District Court for the Eastern District of Michigan, the Michigan attorney general, joined by plaintiffs’ firm Korein Tillery, alleges that Roku violated COPPA (15 U.S.C. § 6502), the Video Privacy Protection Act (18 U.S.C. § 2710), the Michigan Preservation of Personal Privacy Act (M.C.L. § 445.1711), and the Michigan Consumer Protection Act (M.C.L. § 445.901 et seq.) by:

  1. Collecting Data from Children: Roku collects personal information from children, including voice recordings, location data, and browsing histories, including via tracking pixels and cookies.
  2. Failing to Implement Parental Controls: Roku does not offer options for parents to create children’s profiles, ensuring that both parents and children are subject to the same data collection practices.
  3. Sharing Data with Third Parties: Roku shares collected data with third parties, including data brokers and advertising companies, without adequate parental consent.
  4. Misrepresenting Privacy Practices: Roku misleads parents about its data collection practices and the privacy protections in place for children.

The complaint also asserts common law claims for intrusion upon seclusion and unjust enrichment, and requests that Roku stop its allegedly illegal data collection practices and comply with federal and state privacy laws. It also aims to recover damages and penalties for Roku’s misconduct.

Roku’s Response

In response to the lawsuit, Roku stated it will challenge the lawsuit. “Roku strongly disagrees with the allegations in today’s filing, which do not reflect how our services work or our efforts to protect viewer privacy,” the company wrote. “We plan to challenge these inaccurate claims and look forward to demonstrating our commitment to trust and compliance.”

“Roku respects and values the privacy of our users. We do not use or disclose children’s personal information for targeted advertising or any other purpose prohibited by law, nor do we partner with third-party web trackers or data brokers to sell children’s personal information,” the statement continued. “We take the responsibility of creating a safe and trusted online environment seriously. Our viewers rely on Roku for engaging content, and we take pride in connecting our viewers to the streaming content they love every day.”

Takeaways

The Michigan attorney general’s complaint against Roku is the latest in a spate of state attorney general privacy enforcement actions, and businesses should take note that the wave of state enforcement may just be beginning. Further, the recent interest in COPPA enforcement may also be driven by the Federal Trade Commission’s (FTC) recent amendments to the COPPA Rule, which will take effect on June 21, 2025. The FTC’s amendments to COPPA include opt-in parental consent for advertising, enhanced direct notice requirements, and new data security and retention requirements. Companies subject to COPPA must comply with these new requirements by April 22, 2026.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Timothy A. Butler Timothy A. Butler

Tim Butler helps companies thrive by developing tailored strategies to address their regulatory compliance challenges and vigorously defending them in government enforcement actions and bet-the-company lawsuits.

A former prosecuting attorney for the Federal Trade Commission (FTC) and former senior official in the Georgia…

Tim Butler helps companies thrive by developing tailored strategies to address their regulatory compliance challenges and vigorously defending them in government enforcement actions and bet-the-company lawsuits.

A former prosecuting attorney for the Federal Trade Commission (FTC) and former senior official in the Georgia Attorney General’s Office, Tim has led the defense of dozens of government investigations and enforcement actions brought by the FTC, the Consumer Financial Protection Bureau (CFPB), and the various state attorneys general. Tim also regularly defends clients in bet-the-company lawsuits, including complex business disputes and consumer class actions alleging privacy, false advertising, and unfair or deceptive business practice claims.

Tim is an experienced guide for companies struggling with regulatory complexity. He offers clear advice that helps his clients meet the demands of the ever-growing set of laws and regulations governing data privacy and cybersecurity, advertising and marketing practices, and consumer financial products and services. Clients rely on Tim’s business-minded and practical strategies to address their most difficult regulatory compliance challenges.

A graduate of the University of Chicago and Stanford Law School, Tim is a prolific author and regularly speaks to industry and trade groups about the evolving privacy landscape, about cutting-edge issues affecting payments and fintech companies, and about developments at the FTC, the CFPB, and within the state attorneys general community.

Read more about Timothy A. ButlerTimothy's Linkedin Profile
Show more Show less
Photo of Matthew White Matthew White

Matt White guides clients through regulatory compliance challenges and represents clients in regulatory and civil investigations and litigation.

Matt has counseled fintech and payment companies on regulatory compliance matters, including those involving the Electronic Fund Transfer Act, the Fair Credit Reporting Act, the…

Matt White guides clients through regulatory compliance challenges and represents clients in regulatory and civil investigations and litigation.

Matt has counseled fintech and payment companies on regulatory compliance matters, including those involving the Electronic Fund Transfer Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, the Truth in Lending Act, and their respective implementing regulations (Regulations E, V, P, and Z). Adept with the Consumer Financial Protection Bureau’s (CFPB) Prepaid Rule, Matt has provided guidance regarding prepaid cards and related compliance.

Matt has also aided clients in developing regulatory compliant products and functionalities, including an earned wage access program, reimbursement prepaid card programs, new merchant cash advance products, and tokenized payment capabilities. In connection with products on which Matt advises, he has also negotiated high-stakes technology sales agreements involving complex regulatory issues, including compliance with data privacy laws, financial regulations, and card network rules.

Beyond helping clients strategize for regulatory complexity, Matt also helps clients navigate government investigations and enforcement actions brought by the Federal Trade Commission (FTC), CFPB, and state attorneys general.

Read more about Matthew WhiteMatthew's Linkedin Profile
Show more Show less
Photo of Tessa Cierny Tessa Cierny

Tessa Cierny advises companies on financial technology and data privacy issues. She has experience counseling companies on state and federal regulatory compliance, including existing and emerging privacy laws, such as the E.U.’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act

…

Tessa Cierny advises companies on financial technology and data privacy issues. She has experience counseling companies on state and federal regulatory compliance, including existing and emerging privacy laws, such as the E.U.’s General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as well as financial and banking regulations, such as the CFPB’s Section 1071 Small Business Lending Rule (Regulation B). In addition, she assists clients in defending business disputes and data breach litigation.

Prior to joining Greenberg Traurig, she served as global records manager for WestRock, where she developed and implemented email and data retention policies for global data privacy regulation compliance. In this role, she also advised on data privacy concerns related to data retention, data loss prevention, and data governance.

Read more about Tessa CiernyTessa L.'s Linkedin Profile
Show more Show less
Related Posts
fruits vegetables produce supermarket grocery store Shutterstock_2560984363
Maryland Enacts Food-Sector Personalized Pricing Law
May 6, 2026
click to cancel button computer Shutterstock_337846148
Eighth Circuit Vacates FTC’s ‘Click-to-Cancel’ Rule
July 11, 2025
data privacy 3
State Attorneys General Form Bipartisan Privacy Enforcement Consortium
April 30, 2025