Smart TVs & Connected Devices · Streaming platform / smart TV OS · Regulatory action + Data breach
Roku
Headline
Roku sits between the TV screen and the advertiser, and two state attorneys general now say it treats children the same way it treats everyone else on that screen.
Not independently verified. Verification status: Unverified - heuristic first draft. Publish state: draft unverified.
Roku sits between the TV screen and the advertiser, and two state attorneys general now say it treats children the same way it treats everyone else on that screen. Michigan (April 2025, COPPA and state law) and Florida (Oct. 2025, Florida Digital Bill of Rights) allege Roku collected children's viewing data, voice recordings and location without parental consent and fed it into its ad business; a federal court in Michigan let the COPPA claims proceed in March 2026 while dismissing five of seven counts. Separately, in 2024 credential-stuffing attacks took over roughly 591,000 Roku accounts, and fewer than 400 of those were used to buy subscriptions and hardware with stored payment methods. Roku is now being acquired by FOX.
- Severity
- Evidence tierUnassigned
- Claims confirmed
- Last verified2026-10-16
Primary source. www.sec.gov/Archives/edgar/data/1428439/000119312526377700/d413482ddefm14a.htm — Unverified - heuristic first draft.
Terms
Arbitration
Not verified this pass (Roku user agreement at docs.roku.com is JavaScript-rendered and could not be read).
Data sharing
STATE AG ALLEGATIONS (contested): Michigan alleges Roku collects children's voice recordings, location data, IP addresses and browsing histories and lets third-party channels collect them, monetizing children's data without verifiable parental consent; Florida alleges Roku made children's data available to advertisers and sold it to data brokers including Kochava, and ignored signals such as installs of kids' screensaver/theme packs. CONFIRMED 2024 ACCOUNT TAKEOVERS: ~15,000 accounts (first wave, notified early March 2024) plus ~576,000 accounts (second wave, April 2024) via credential stuffing.
Fees and billing
Fewer than 400 accounts in the second 2024 wave saw unauthorized purchases of streaming subscriptions and Roku hardware using stored payment methods; Roku said it would refund them. No separate fee/billing enforcement found this pass.
Contacts
Privacy contact. Not recorded.
Legal notice. Roku, Inc., 1173 Coleman Avenue, San Jose, CA 95110 (SEC EDGAR business address; Delaware corporation). Registered agent not verified this pass.
Mailing address. Not recorded.
Evidence
No claims have been itemized for this row yet.
Sources
| Source | Claim | Tier | Status | Quote |
|---|---|---|---|---|
| Law firm blog · 2025-05-09 www.hunton.com/privacy-and-information-security-law/michigan-attorney-general-files-lawsuit-against-roku-over-alleged-coppa-violations | whole row | Unassigned | confirmed | “obtain verifiable parental consent” Quote basis: not recorded. |
| Policy tracker · 2026-03-31 digitalpolicyalert.org/event/39123-eastern-michigan-district-court-dismissed-five-of-seven-claims-against-roku-in-data-privacy-lawsuit | whole row | Unassigned | confirmed | “On 31 March 2026, the Eastern District Court of Michigan granted Roku's partial motion to dismiss.” Quote basis: not recorded. |
| News report · 2025-10-16 www.malwarebytes.com/blog/news/2025/10/roku-accused-of-selling-childrens-data-to-advertisers-and-brokers | whole row | Unassigned | confirmed | “The State contends that Roku's practices violated Florida's privacy and consumer-protection laws” Quote basis: not recorded. |
| News report (quotes Roku statement) · 2024-04-12 securityaffairs.com/161765/data-breach/roku-second-data-breach.html | whole row | Unassigned | confirmed | “In less than 400 cases, malicious actors logged in and made unauthorized purchases” Quote basis: not recorded. |
| SEC filing (DEFM14A) · 2026-09-01 www.sec.gov/Archives/edgar/data/1428439/000119312526377700/d413482ddefm14a.htm | whole row | Unassigned | confirmed | “On June 14, 2026, FOX and Roku entered into an Agreement and Plan of Merger” Quote basis: not recorded. |
| SEC filing (10-K) · 2026-02-13 www.sec.gov/Archives/edgar/data/1428439/000162828026008114/roku-20251231.htm | whole row | Unassigned | confirmed | “credential stuffing attacks” Quote basis: not recorded. |
Source vault
Link status: Candidate - not yet fetched
| Document | Last fetch | |
|---|---|---|
| Privacy policy https://docs.roku.com/published/userprivacypolicy/en/us | Not fetched yet | NOT CONFIRMED |
| Terms of service https://docs.roku.com/published/useragreement/en/us | Not fetched yet | NOT CONFIRMED |
| Website https://www.roku.com | Not fetched yet | — |
| Primary source https://www.sec.gov/Archives/edgar/data/1428439/000119312526377700/d413482ddefm14a.htm Verification: Unverified - heuristic first draft | Not fetched yet | — |
Enforcement
No enforcement actions are linked to this row.
State statute
Headquarters on file: CA. Provisions of CCPA/CPRA on file:
| Provision | Type | Source |
|---|---|---|
| Right to Deletion Cal. Civ. Code § 1798.105 | hard | source |
| Right to Correction Cal. Civ. Code § 1798.106 | hard | source |
| Right to Know / Access Cal. Civ. Code § 1798.110 | hard | source |
| Right to Limit Use of Sensitive Personal Information Cal. Civ. Code § 1798.121; Cal. Code Regs. tit. 11, § 7027 | hard | source |
| Right to Data Portability Cal. Civ. Code § 1798.130(a)(3)(B)(iii) | hard | source |
| Privacy Policy / Privacy Notice Requirements Cal. Civ. Code § 1798.130(a)(5); Cal. Code Regs. tit. 11, § 7011 | hard | source |
| Sensitive Personal Information — Categories Cal. Civ. Code § 1798.140(ae) | hard | source |
| Service Provider and Contractor Contract Requirements Cal. Civ. Code § 1798.140(ag); Cal. Code Regs. tit. 11, § 7051 | hard | source |
| Applicability Threshold (2025 CPI-Adjusted) Cal. Civ. Code § 1798.140(d) | threshold | source |
| Privacy Risk Assessment — Mandatory for High-Risk Processing (Eff. Jan. 1, 2026) Cal. Civ. Code § 1798.185(a)(15); Cal. Code Regs. tit. 11, §§ 7150-7157 | hard | source |
| Right to Opt Out of Sale or Sharing Cal. Civ. Code §§ 1798.120, 1798.135 | hard | source |
| Sale vs. Sharing Distinction Cal. Civ. Code §§ 1798.140(ad), 1798.140(ah) | hard | source |
| Enforcement — CPPA and AG; Civil Penalties (2025 CPI-Adjusted) Cal. Civ. Code §§ 1798.155, 1798.199.90; Cal. Bus. & Prof. Code § 17206 | hard | source |
| Notice at Collection Cal. Code Regs. tit. 11, § 7012 | hard | source |
| Cybersecurity Audit — Annual Independent Audit Requirement (Eff. Jan. 1, 2026) Cal. Code Regs. tit. 11, §§ 7120-7124 | hard | source |
| Automated Decision-Making Technology (ADMT) — Notice, Opt-Out, and Access Rights Cal. Code Regs. tit. 11, §§ 7200-7222; Cal. Civ. Code § 1798.185(a)(16) | hard | source |