• by Wendy Davis , October 15, 2025

Florida Attorney General James Uthmeier claims in a new lawsuit that Roku is violating a state privacy law by allegedly processing childrens' data without parental consent, and adults' and teens' sensitive data without their consent.

Roku "is in nearly half of all households and earns billions of dollars each year by collecting data about its users (children and adults) and using that data to facilitate targeted advertising," the attorney general alleges in a complaint brought this week in Florida’s 20th Judicial Circuit in Collier County.

"In addition to Roku's widespread processing of data collected from known children, Roku also sells its data to third parties who subsequently reidentify Roku's data in order to deliver a detailed picture of Roku customers without implicating Roku directly," the complaint alleges.

The attorney general's complaint includes a claim that Roku is violating Florida's Digital Bill of Rights, a 2023 privacy law applicable to companies with more than $1 billion in revenue.

Among other provisions, that law requires businesses to obtain consumers' permission before processing their sensitive data. That term is defined to include all users' precise geolocation data, and any personal data from known children. The statute also provides that companies can't process minors' data without affirmative consent from minors themselves, if between the ages of 13 and 18, or from parents if the users are under 12.

The complaint alleges that Roku knows some users are underage, but "has consciously decided not to implement industry-standard user profiles to identity which of its users are children."

The attorney general adds that Roku allegedly "processes and sells" data from users who have signaled they are children -- such as by installing a "kids screensaver" or viewing material from the "Kids and Family" section of the streaming service.

In addition to allegations regarding children's data, the complaint alleges that Roku violates the 2023 privacy law by processing all users' precise geolocation data without explicit consent.

Some allegations in the complaint appear based on Roku's privacy policy, which lists the type of information the company collects, discloses and processes.

Uthmeier also alleges that Roku shares data with "intrusive data brokers, including Kochava."

Kochava was sued by the Federal Trade Commission in 2022 for allegedly selling the type of geolocation information that could expose sensitive information, such as whether people visited doctors' offices or religious institutions. Kochava contests the FTC's allegations, arguing that the geolocation data at issue isn't “personally identifiable,” and that the agency's allegations -- even if proven true -- wouldn't amount to unfair conduct.

Uthmeier is seeking an injunction against Roku and monetary penalties.

Florida isn't the only state to target Roku. Earlier this year, Michigan's attorney general sued Roku for allegedly collecting data from children younger than 13, and allegedly disclosing information about video-viewing history of users of all ages.

Roku is fighting that matter, which is pending before U.S. District Court Judge Stephen Murphy, III in the Eastern District of Michigan.

A Roku spokesperson said it "strongly disagrees with these allegations," adding that they do not reflect the company's efforts "to protect viewer privacy."

"We plan to challenge these inaccurate claims," the spokesperson said. "We take the responsibility of creating a safe and trusted online environment seriously."

Kochava has not yet responded to MediaPost's request for comment regarding the new Florida lawsuit.