How children's apps and connected toys can share data

A toy can have a phone-app data trail

The FTC's September 2025 Apitor announcement alleged that a robot-toy companion app required Android location sharing and included the JPush software kit. According to the complaint, that third party received precise location information without the required notice and parental consent. This describes the allegations in a named case, not a claim about every connected toy. FTC: alleged toy-app data sharing

The current case page lists Apitor as under order, with an October 1, 2025 update and a linked court document. That later status is distinct from the announcement's proposed-order wording. FTC: Apitor case and status

The linked document says Apitor neither admits nor denies the allegations, with the stated jurisdictional exception. Its injunction addresses notice, consent, deletion and limited retention. The provisions do not prove that every past copy has actually been deleted or that every current product is compliant. FTC court document: Apitor order

What parents can ask about collected data

The FTC's May 2026 guide explains COPPA coverage for child-directed online services and general-audience services with actual knowledge of collection from children under thirteen. Covered personal information includes location, images, voice, biometric information and persistent identifiers. Notice, consent and parental choices have legal scope and exceptions; a child-friendly label alone is not proof of compliance. FTC: parents and children's privacy rights

The FTC's connected-toy questions focus on cameras, microphones, default settings, storage, sharing, access and deletion. Ask about both the physical toy and its companion app, including other companies receiving the data. The dated guidance is a checklist, not a current audit of a particular toy. FTC: questions about connected toys

Family controls have device and account boundaries

Apple's updated iOS 27 family controls require the supported software and family setup. Content/privacy restrictions and app approval help manage access; they should not be treated as an audit of what each developer has already collected. Apple: current family privacy controls

Google documents Family Link app-permission management for supported supervised Android devices and Chromebooks. Choosing parents-only permission decisions does not change grants already made, so current permissions still need review. Google: supervised-device app permissions

Google expressly says many Family Link controls do not work when a child uses Google apps on an iPhone or iPad, including device location, app blocking/permissions, screen-time limits and Chrome restrictions. A Google sign-in is not equivalent to supervised Android-device coverage. Google: limits on iPhone and iPad

Third-party account connections are another scope. Google warns that a connected app can request sensitive account information, and removing its access may still require a separate request to delete data it already received. Google: third-party account access

Choose settings with the child and the product in view

The FTC recommends family conversations alongside controls and says settings should cover the devices a child actually uses. Start with the child's needs, the app's functions and a specific permission or sharing choice. A purchase approval, usage limit and data-deletion request solve different problems. FTC: choosing and discussing parental controls