Roku Faces Multiple Lawsuits Over Children’s Data, What Parents Need to Know
Roku, the streaming platform found in nearly half of all American households, is facing a wave of legal actions over allegations that it illegally collected and sold children’s personal data to advertisers and data brokers — all without parental consent. Two state attorneys general have filed enforcement actions, a federal class action has been filed in California, and the company is simultaneously defending against a forced arbitration controversy that may limit some consumers’ legal options. Here is what the lawsuits allege, how they differ, and what parents should know.
What Is Roku and Why Is It Under Scrutiny?
Reaching more than 90 million households worldwide as of January 2025, Roku operates its own ad-based streaming service — The Roku Channel — and also offers various third-party channels. On the surface, Roku appears to be a straightforward streaming device. Behind the scenes, however, its business model depends heavily on advertising revenue rather than hardware sales.
In fiscal 2024, Roku lost $80.3 million on device sales, up from $43.9 million in device-based losses the prior year. Yet it made $1.9 billion profit from its platform business, which includes not just subscriptions but advertising. That advertising revenue depends on detailed data about what viewers watch — including children. Critics argue this creates a structural incentive to collect as much data as possible, regardless of the age of the viewer.
How Does Roku Collect Data? The ACR Technology Explained
At the center of the lawsuits is a technology called Automatic Content Recognition (ACR). Roku’s ACR technology captures thousands of images each hour from smart TVs, which can be used to help track viewing activity. This data is then used to build detailed behavioral profiles used for targeted advertising.
The lawsuits also allege that Roku goes further than ACR. Roku is accused of allowing third-party channels and data brokers to harvest children’s data for targeted ads and detailed behavioral profiles, and of retaining and disclosing children’s voice commands captured through Roku remotes and smart-TV microphones, despite FTC guidance that such recordings should be deleted immediately after use.
A key factor cited across all lawsuits is Roku’s lack of child-specific accounts. The platform does not provide parental controls beyond allowing users to set up a numerical Roku Channel Store PIN required to add new channels — meaning all viewers, regardless of age, are subject to the same data collection practices. Platforms like Netflix, Disney+, and Amazon Prime Video have long offered children’s profiles with separate privacy settings. Roku does not.
The Three Legal Actions — and How They Differ
1. Michigan Attorney General (April 2025 — Federal)
On April 29, 2025, the Michigan Attorney General filed a lawsuit against Roku alleging violations of the federal Children’s Online Privacy Protection Act (COPPA). The complaint alleges that Roku collects and processes — and allows third parties to collect and process — children’s personal information, including voice recordings, location data, IP addresses, and browsing histories without parental notice or verifiable consent.
The complaint also alleges that Roku monetizes children’s personal information by enabling third-party channels to collect this data, increasing Roku’s advertising revenue and making its platform more attractive to content providers and advertisers. In addition, the complaint asserts that Roku misleads parents about its collection of children’s personal information and creates confusion regarding parents’ rights to protect such information.
COPPA penalties can reach $50,120 per violation. With millions of users, Roku’s potential liability could be significant.
2. Florida Attorney General (October 2025 — State)
On October 14, 2025, the Florida Attorney General filed a lawsuit against Roku alleging the unlawful collection and sale of children’s personal data, including geolocation, voice recordings, and TV viewing habits. The lawsuit claims Roku failed to comply with requirements under Florida’s Digital Bill of Rights (FDBR) and the Florida Deceptive and Unfair Trade Practices Act (FDUTPA), including obligations around age verification, disclosure of data sales, and limits on re-identification of de-identified information.
This case is historically significant. The Florida lawsuit represents the first enforcement action brought under Florida’s Digital Bill of Rights, which went into effect in July 2024. This law imposes civil penalties of up to $150,000 per violation involving known children.
Florida’s legal standard is notably broader than COPPA. Roku’s “willful disregard” standard creates heightened liability exposure, as Florida argues platforms cannot claim ignorance when they actively market children’s content, partner with child-directed channels, and use obvious child-targeting features such as cartoon screensavers and age-based content categories.
3. Federal Class Action — California (October 2025)
A federal class action filed in California accuses Roku of embedding tracking pixels from Google, Facebook, YouTube, LinkedIn, CJ Affiliate, Innovid, New Relic, and Display & Video 360 to harvest sensitive viewing data from minors. The data collected is primarily used in ad targeting, the suit says, and Roku is fully aware of its obligations under COPPA but continues to collect this data.
What Does Roku Say?
Roku issued a statement saying it intends to challenge what it calls “inaccurate claims” in the suit: “We do not use or disclose children’s personal information for targeted advertising or any other purpose prohibited by law, nor do we partner with third-party web trackers or data brokers to sell children’s personal information.”
Roku has not publicly addressed the ACR data collection or voice recording retention allegations in detail. The cases are proceeding through discovery as of early 2026, and no settlements have been announced.
The Forced Arbitration Issue — A Barrier for Consumers
Separate from the children’s privacy cases, Roku attracted controversy in March 2024 when it pushed a mandatory Terms of Service update that disabled devices until users agreed to binding arbitration. Reports indicate the device became unusable until users agreed to the new arbitration clause, which waives the right to sue Roku or join a class action lawsuit. The moment a Roku TV connects and updates, HDMI inputs are locked out and users are forced to sign up for a Roku account and agree to terms.
The update did include a 30-day opt-out window — but only by sending a physical letter by mail. Consumers who clicked through without reading lost their right to join future class actions. This matters because attorneys general actions and class actions filed on behalf of children are generally not blocked by consumer arbitration clauses — but individual consumer claims may be.
What Should Parents Do?
If your household uses Roku devices and children watch content on them, there are practical steps worth taking:
- Review Roku’s privacy settings in your account and opt out of data sharing for advertising where available at my.roku.com/account/privacy.
- Check whether you signed the 2024 arbitration agreement — if you did not opt out within 30 days of receiving the March 2024 update, your individual legal options may be limited to arbitration rather than class action participation.
- Monitor what your children watch on Roku — the platform currently has no child-specific profile system, meaning all viewing is tracked the same way.
- Document your concerns — if you believe your child’s data was collected and used without consent, note specific dates and content accessed. This documentation may be relevant to future legal proceedings.
- Consult a qualified attorney if you believe your child’s privacy rights were violated. A consumer protection or children’s privacy attorney can assess your specific situation.
FAQs
What is Roku being sued for?
Roku faces multiple legal actions alleging it illegally collected children’s personal data — including location data, voice recordings, viewing histories, and IP addresses — and shared or sold that data to advertisers and data brokers without parental consent, in violation of federal and state privacy laws.
What is COPPA and does it apply to Roku?
COPPA is a federal law requiring parental consent before companies collect personal data from children under 13. Michigan’s Attorney General alleges Roku violated COPPA by collecting children’s data without the required parental notice and consent. COPPA violations can carry penalties of up to $50,120 per violation.
What is Florida’s Digital Bill of Rights and why does it matter?
Florida’s Digital Bill of Rights became effective July 2024 and imposes civil penalties of up to $150,000 per violation involving known children. The Roku case is the first major enforcement action brought under this law, making it a significant legal development for the broader tech industry.
Does Roku have parental controls?
Roku’s only parental control is a numerical PIN required to add new channels. The platform offers no child-specific profiles, meaning children and adults are tracked identically — a key argument in all three lawsuits.
What is the forced arbitration issue with Roku?
In March 2024, Roku pushed a mandatory Terms of Service update requiring users to agree to binding arbitration — waiving their right to join class action lawsuits — before their devices would function. Users had 30 days to opt out by mailing a physical letter. Those who did not opt out may have limited legal options for individual consumer claims.
Are there any settlements yet?
No settlements have been announced for any active Roku litigation as of February 2026. The cases are ongoing. A prior unrelated Roku data breach settlement from 2024 has closed to new claims.
What personal data does Roku allegedly collect from children?
Alleged collected data includes precise location data, IP addresses, viewing histories, and voice commands captured through Roku remotes and smart-TV microphones. The California class action also names tracking pixels from Google, Facebook, YouTube, and LinkedIn as tools used to harvest viewing data.
Disclaimer: This article is for informational purposes only and does not constitute legal advice. Laws and legal procedures vary by jurisdiction and may change over time. For advice regarding a specific situation, consult a qualified attorney or the appropriate authority.
About the Author
Sarah Klein, JD, is a licensed attorney and legal content strategist with over 12 years of experience across civil, criminal, family, and regulatory law. At All About Lawyer, she covers a wide range of legal topics — from high-profile lawsuits and courtroom stories to state traffic laws and everyday legal questions — all with a focus on accuracy, clarity, and public understanding.
Her writing blends real legal insight with plain-English explanations, helping readers stay informed and legally aware.
Read more about Sarah