A federal court in Michigan significantly narrowed Michigan Attorney General (AG) Dana Nessel’s privacy and consumer protection case against Roku, Inc. (Roku) dismissing all non-Children’s Online Privacy Protection Act (COPPA) claims for lack of standing while allowing the state’s privacy claims under COPPA to proceed. The decision highlights COPPA’s utility as a vehicle for state AGs to bring enforcement actions in federal court, while also underscoring the jurisdictional limits on bringing companion state privacy and consumer protection claims in the same forum.
Key Holdings and Court’s Reasoning
In April 2025, the Michigan AG filed a lawsuit alleging that Roku’s smart TV platform and streaming ecosystem collect and share a wide range of personal data from children and adults in Michigan in violation of COPPA and state privacy and consumer protection laws. Roku moved to dismiss the non-COPPA counts and challenged the AG’s parens patriae authority to assert many of the state law claims on behalf of Michigan residents in federal court.
In an opinion issued last week, the court held that COPPA’s express parens patriae provision gives the Michigan AG standing to sue in federal court on behalf of children. With regard to the COPPA claims, Roku argued that the AG did not allege that Roku collects information that “identifies any actual person.” The AG, however, alleged that Roku collects children’s personal information both within and outside the Kids and Family section on the Roku channel, including device identifiers, IP addresses, cookies, account and browsing information, precise geolocation, and visual and audio information. Taking the allegations as true and drawing inferences in the AG’s favor, the court held that Roku’s data collection practices could collect individually identifiable information and therefore, the AG’s claims were sufficient at the pleading stage to establish Article III standing.
However, the court concluded that the non-COPPA claims (including Video Privacy Protection Act claims, state privacy and consumer protection statutes, and common law theories) lacked a sufficient quasi-sovereign or sovereign interest to support parens patriae standing in federal court. The court reasoned that the state’s theories largely mirrored private causes of action available to individual Roku users rather than a distinct, statewide injury. The court further emphasized that state statutory authorization to enforce state law cannot itself create federal court standing.
Why It Matters
- Limits on bundling federal and state privacy claims in a single AG action. For non-COPPA privacy, consumer protection, and common law claims, the opinion signals that courts will demand a specific articulation of a quasi-sovereign interest separate from the interests of the particular private parties involved to clear the parens patriae bar.
- State statutory authority does not guarantee federal court standing. Even when state law expressly authorizes the AG to bring enforcement actions, that authorization does not automatically confer federal court standing. Companies facing multitheory AG suits can expect courts to scrutinize whether each claim has a jurisdictional footing.
- Continued litigation risk on children’s data practices. Although Roku successfully eliminated several claims at this stage, the core COPPA claims survived, and the case is proceeding to discovery.
The case serves as a reminder that companies that collect consumer data, especially those that potentially collect the data of children, should closely evaluate their collection and consent mechanisms, including situations where data is collected by third parties in their ecosystems, and align practices with COPPA’s parental consent, notice, and data-minimization requirements. The need for a compliance review is particularly acute where the services offer content targeted at children or where the company has actual knowledge that children are engaging with the platform.
