Yes, Roku improperly shared smart TV viewing data with third-party advertisers and data brokers without adequate notice or consent, according to lawsuits filed by the Michigan Attorney General, Florida’s Office of Parental Rights, and a federal class action. The company collected detailed personal information—including precise location data, IP addresses, voice recordings, browsing histories, and persistent tracking identifiers—and enabled third parties like Google, Facebook, YouTube, and advertising networks to access this information for targeted advertising purposes. Multiple enforcement actions filed between April and October 2025 allege that Roku failed to obtain proper parental consent before collecting and monetizing data from children, violated federal and state data protection laws, and refused to implement the same child safety protections that competitors Netflix and Disney+ offer. As of February 2026, no settlements have been finalized in any of these active litigation cases, and the exact compensation available to affected consumers remains undetermined.
Table of Contents
- What Personal Data Did Roku Allegedly Share Without Proper Consent?
- Which Laws Did Roku Allegedly Violate in These Cases?
- Why Are Children’s Privacy Violations at the Center of These Cases?
- How Did Third-Party Advertisers and Data Brokers Access the Viewing Data?
- What Are the Current Lawsuit Statuses and Enforcement Actions?
- What Compensation or Settlements Are Available?
- What Specific Data Sharing Practices Did Roku Use, and What Should Consumers Know?
What Personal Data Did Roku Allegedly Share Without Proper Consent?
According to the Michigan Attorney General’s lawsuit filed on April 29, 2025, Roku collected a comprehensive profile of personal information from users that went far beyond typical TV viewing patterns. The company gathered precise geolocation data pinpointing where users were located, IP addresses that can be used to identify devices and networks, voice recordings captured through voice-controlled features, complete browsing histories showing what content users searched for and viewed, and persistent identifiers designed to track individual users across the internet and across multiple websites and services. The Federal COPPA class action filed in October 2025 specifically details how Roku embedded tracking pixels into its platform that allowed third parties to collect and monetize this viewing data.
Unlike basic analytics that count how many people watch a show, these tracking pixels enabled the creation of detailed individual profiles linked to specific users. For comparison, Netflix and Disney+ both offer child-safety profile options that either disable data collection entirely or require explicit parental authorization before enabling personalized advertising—features Roku allegedly refused to implement despite knowing these industry practices existed. The scope of this data collection is significant because it wasn’t limited to what users watched on Roku; the company’s tracking mechanisms enabled data brokers and advertising partners to link Roku data with other information collected about the same users from other websites and services, creating comprehensive behavioral profiles used for targeted marketing and sold to other companies.
Which Laws Did Roku Allegedly Violate in These Cases?
Three separate legal frameworks form the foundation of the enforcement actions against Roku. The Michigan Attorney General charged violations of the Children’s online Privacy Protection Act (COPPA), a federal law that requires verifiable parental consent before collecting personal information from children under 13 and places strict limits on how that data can be used. Roku allegedly violated COPPA by collecting data from children without proper parental notice and without obtaining consent that meets the law’s “verifiable” standard, which typically requires documented parental approval through email, credit card verification, or similar mechanisms.
The Michigan lawsuit also alleges violations of the Video Privacy Protection Act (VPPA), which restricts how companies can disclose or use information about the videos people watch, and Michigan’s Consumer Protection Act, which prohibits unfair and deceptive business practices. The Florida enforcement action, filed on October 13, 2025, marks the first major enforcement under Florida’s Digital Bill of Rights, which became effective in July 2024. Florida alleged that Roku violated that law by (1) collecting and processing personal data from children without parental authorization, (2) failing to disclose that it sells sensitive personal data including geolocation information, and (3) enabling advertisers to relink shared data back to individual users, defeating supposed anonymization. A critical limitation in consumer protection is that even settled COPPA cases rarely involve enormous per-person payouts—prior similar settlements have ranged from $20 to $60 per affected child—so the total recovery available may be spread across thousands of families if Roku ultimately settles.
Why Are Children’s Privacy Violations at the Center of These Cases?
Children’s data receives heightened legal protection under federal law because younger users are less able to understand privacy implications and have greater difficulty protecting their own personal information. COPPA exists specifically because regulators recognized that companies had incentive to collect extensive data from children for advertising purposes without meaningful parental knowledge. Roku’s alleged conduct—collecting precise location data, voice recordings, and browsing histories from children, then sharing that data with advertising networks—exemplifies the exact conduct COPPA was designed to prevent.
The Florida Attorney General’s October 2025 filing framed Roku’s practices as the kind of sophisticated data exploitation that newer privacy laws like the Digital Bill of Rights aim to address. The filing identified Roku’s strategy of refusing to implement child safety features that competitors already offered as particularly egregious; Netflix and Disney+ both allow parents to create restricted profiles that disable personalized advertising and data collection, presenting a direct comparison showing the conduct was avoidable. Florida seeks penalties of up to $150,000 per violation involving children and up to $50,000 per violation affecting individual Florida adults, reflecting the legal system’s view that children’s data warrants stronger protection. The practical challenge for families is that children using Roku-enabled smart TVs in their homes may not be aware their viewing habits are being tracked and monetized, and parents may not realize this is occurring unless they actively investigate the device’s privacy settings and data sharing practices.
How Did Third-Party Advertisers and Data Brokers Access the Viewing Data?
The federal COPPA class action names eight companies that Roku allegedly enabled to access collected data: Google, Facebook, YouTube, LinkedIn, CJ Affiliate, Innovid, New Relic, and Display & Video 360. The mechanism was tracking pixels—invisible code embedded in Roku’s platform that collected viewing information and transmitted it to these third parties in real time. This isn’t passive data sharing in response to requests; the pixels actively funnel information to advertising networks as users watch content.
For example, when a user watched a children’s show about dinosaurs, the tracking pixel would register that behavior and send it to Google and Facebook’s advertising systems, which then use that interest signal to target the user (or the household) with dinosaur-related products and services across the internet. Roku also allegedly shared data with data brokers and enabled these third parties to reidentify supposedly anonymized data—meaning even if Roku stripped a user’s name from a data set before sharing, the receiving companies could use other information in that data set to figure out which specific household or individual it came from. The consequence is that Roku users’ viewing data fed directly into the behavioral advertising ecosystem, allowing companies like Google and Facebook to incorporate Roku viewing patterns into their broader profiles used for targeting ads across YouTube, Facebook, Instagram, search results, and third-party websites.
What Are the Current Lawsuit Statuses and Enforcement Actions?
Three separate enforcement actions remain active as of February 2026. The Michigan Attorney General’s lawsuit, filed April 29, 2025, in U.S. District Court for the Eastern District of Michigan is proceeding through the normal litigation process. The Florida Attorney General’s enforcement action, filed October 13, 2025, represents the first major test case of Florida’s Digital Bill of Rights and carries significant symbolic weight as a bellwether for how this new law will be enforced.
The federal COPPA class action filed in October 2025 is currently in the discovery phase, where both sides exchange documents and evidence in preparation for potential trial or settlement. One important limitation to understand is that the existence of lawsuits does not mean compensation is guaranteed. Roku could defend these cases, file motions to dismiss, or seek appellate review, potentially delaying resolution for years. No settlements have been finalized in any of these active litigation matters, and no settlement amounts have been announced. The absence of materialized legal contingencies in Roku’s SEC filings as of March 31, 2026, suggests the company has not yet set aside funds to resolve these claims, which may indicate either early litigation stages or confidence in defending the cases.
What Compensation or Settlements Are Available?
As of February 2026, no settlements have been finalized in the Michigan, Florida, or federal COPPA cases against Roku, and no compensation has been distributed to affected consumers. A previous Roku settlement did exist in 2025, but the deadline to submit claims in that settlement has passed.
For consumers who were affected by improper data sharing, compensation depends entirely on the outcome of current litigation and any settlement agreements that result. Historical data from similar COPPA settlements provides context: past cases have typically resulted in per-child compensation ranging from $20 to $60, though these figures are estimates from comparable cases and not confirmed amounts for Roku. If Roku ultimately settles multiple cases or loses in court, the total compensation could be distributed among thousands of affected children and families, potentially reducing individual payouts further.
What Specific Data Sharing Practices Did Roku Use, and What Should Consumers Know?
Roku’s data sharing operated continuously through embedded tracking mechanisms rather than as a discrete, disclosed data sale that users might understand. The Michigan Attorney General’s filing details that Roku collected, processed, and disclosed children’s personal information through third-party channels and data brokers specifically for advertising monetization purposes.
Voice recordings captured through Roku’s voice remote feature were included in this data sharing, meaning conversations users had with their TV may have been processed by advertising networks. The Florida filing identified three specific violations: Roku collected from “known children” (children Roku could identify or reasonably should have identified as children) without parental authorization, failed to disclose its practice of selling sensitive personal data including geolocation, and failed to prevent reidentification of supposedly anonymous data shared with advertisers. Consumers who owned Roku smart TVs during the period covered by these lawsuits and whose viewing data was collected without proper consent or parental authorization may be eligible for compensation if the cases settle or Roku loses in court, though no claims process is currently available.
- —
You Might Also Like
- Venmo Privacy Class Action Claims User Transaction Data Was Shared Improperly
- Netflix Privacy Class Action Claims Viewing Data Was Shared Without Proper Consent
- Willow TV Privacy Class Action Claims Subscriber Data Was Shared With Meta
Open Settlements You Can Claim Now
Browse current class action settlements accepting claims — several require no proof of purchase: