Highlights
- Florida follows Michigan's lead in targeting streaming platforms for children's privacy violations, alleging in a new complaint that Roku willfully collects and sells children's personal data, including sensitive information such as precise geolocation data, without parental notice or consent.
- Like the Michigan complaint, Florida's complaint focuses heavily on Roku's partnerships with data brokers, such as Kochava, which allegedly enable tracking of children's physical movements and linking household Roku accounts to inpidual mobile devices.
- The Florida lawsuit represents the first enforcement action brought under Florida's Digital Bill of Rights (FDBR), which went into effect in July 2024. This law, which has narrow applicability criteria, imposes civil penalties of up to $150,000 per violation involving known children. Unlike the Michigan lawsuit, the Florida complaint does not allege any claims under the Children's Online Privacy Protection Act (COPPA).
- Roku's "willful disregard" standard creates heightened liability exposure, as Florida argues platforms cannot claim ignorance when they actively market children's content, partner with child-directed channels and use obvious child-targeting features such as cartoon screensavers and age-based content categories.
Florida filed an enforcement action against Roku Inc. on Oct. 13, 2025, in state court in Collier County alleging multiple violations of Florida's Digital Bill of Rights (FDBR).
Background
This case represents the second major state enforcement action against Roku in 2025, following Michigan's comprehensive Children's Online Privacy Protection Act (COPPA) and privacy lawsuit filed in April. These actions demonstrate a growing concern at the state level regarding the monetization of children's data through data sharing partnerships and digital advertising.
Florida's lawsuit is particularly significant because it is the first major enforcement action under the FDBR, which became effective in July 2024.
Factual Allegations
There are many similarities between the Florida and Michigan attorney general (AG) lawsuits. Both allege that Roku operates the dominant television streaming platform in the U.S., present in nearly half of American households. Similarly, they both allege that the platform offers content directed to children in a number of ways. Kids & Family on The Roku Channel, which is a service on Roku devices and a separate app, includes popular kids' shows and movies for free. Certain third-party apps similarly target children and teens. Roku promotes this content on its home screen, where it organizes children's content into age-specific categories and promotes it across platform pages with child-directed sections such as "Animated Adventures" and "Popular Free Kids Movies and TV Shows." Roku also enabled users to download a "Kids Theme Pack" and "Kids Screensaver" to customize their platform experience.
Despite these features and their successful performance, the Florida AG alleges that Roku willfully disregarded the presence of children on its platforms. Roku allegedly systematically collects, processes and sometimes sells personal information from children viewing content across its platform, including device identifiers, IP addresses, browsing histories, precise geolocation data and voice recordings created through voice-enabled remotes.
Both complaints extensively detail Roku's partnerships with data brokers. In particular, Roku's partnership with Kochava is also alleged to provide Roku advertisers access to sensitive data, including ethnicity and date of birth, about inpiduals to whom advertisements are delivered.
Alleged Violations of Law
Most of the provisions of the FDBR apply to a small set of companies – those with more than $1 billion in annual gross revenue that also 1) derive 50 percent or more of global gross annual revenues from the sale of advertisements online, 2) operate a consumer smart speaker and voice command component service with an integrated virtual assistant connected to a cloud computing service that uses hands-free verbal activation or 3) operate an app store or a digital distribution platform that offers at least 250,000 different software applications for download.
The Florida AG alleges that Roku meets the first and second criteria, including that its voice remote is a smart speaker connected to a cloud computing service that operates through voice activation. This complaint asserts three violations of the FDBR:
- Processing Personal and Sensitive Data Without Required Consent or Authorization, in Violation of FDBR, Sec. 501.71(2)(d). Data collected from a "known child" (e.g., an inpidual under 18 years old) is sensitive under the FDBR. Roku failed to conduct reasonable age verification when it knew there was a likelihood the user was a minor and did not take any steps to collect consent for processing.
- Failing to Provide Required Notices Regarding Sale of Sensitive Personal Data, in Violation of FDBR, Sec. 501.715. Roku failed to make a required disclosure that its platform may "sell your sensitive personal data." Though not explicitly stated, this violation may apply to the geolocation and biometric information of adults as well.
- Failing to Prevent Re-Identification of De-Identified Data Shared With Advertisers and Data Brokers, in Violation of FDBR, Sec. 501.714. When sharing de-identified data (of both children and adults), Roku failed to undertake reasonable measures to ensure third parties with which it shares de-identified data cannot use the data to re-identify inpiduals. It also did not contractually obligate recipients of such de-identified data to comply with this provision of the FDBR.
Potential Consequences for Roku
Under the FDBR, violations involving known children carry penalties of up to $150,000 per violation (triple the standard $50,000 penalty), but "violation" is undefined in the statute. Given Roku's market share, if a violation includes every Florida Roku user likely to be under 18 during a period of time, the fine amount could be significant.
Implications
The state enforcement actions establish several concerning precedents for platforms that offer entertainment content:
- "Willful Disregard" Standard. Platforms cannot claim ignorance about child users when they actively market children's content and maintain obvious child-directed features.
- Scrutiny of Third-Party Relationships. The complaint faults Roku for choosing to partner with Kochava, which is defending an action brought by the Federal Trade Commission (FTC) for improper disclosure of geolocation data. The Florida complaint implies that because Kochava is known for its widespread collection of geolocation information, it must be collecting such information through its Roku software development kit (SDK) without offering any technical evidence or explanation of how this may occur.
- User Profile Requirements. Failure to implement age verification or parental control systems may constitute willful disregard under privacy laws.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
