Florida Called a $0 Fine a 'Resolution'

Introduction

Florida's attorney general sued Roku in October 2025, alleging in a 25-page complaint that the company sold children's voice recordings and precise geolocation to data brokers without parental consent. His office asked the court for civil penalties of up to $150,000 for every violation involving a child. Eight months later, eleven days after Roku agreed to sell itself to Fox for $22 billion, James Uthmeier's office closed the case for zero dollars in civil penalties and a "$25 million" figure that lives in a press release Roku then republished word for word on its own corporate newsroom.

If there's a Roku in your living room, nothing in the public description of that resolution reaches your data. What Uthmeier announced covers users Roku knows are children. The complaint's separate allegation about everyone else, that Roku processes and sells adult users' sensitive data including precise geolocation without their consent, goes unmentioned in every public account of the settlement.

The First Test of Florida's Privacy Law

The complaint, filed October 13, 2025 in Collier County circuit court, runs three counts, all styled as deceptive-trade-practice violations premised on breaches of the Florida Digital Bill of Rights. It alleges Roku collects and sells device identifiers, browsing and search history, voice recordings captured by its voice remotes, and precise geolocation, including from users the company "willfully disregards" are children. Paragraph 59 alleges the data reaches at least 75 known data brokers. One of them, per the complaint, is Kochava, the broker the FTC sued in 2022 over selling precise location data the agency alleged was "not anonymized."

The case was the first enforcement action ever brought under the FDBR, a law effective July 1, 2024 that reaches only companies clearing $1 billion in global revenue. Roku qualifies, per the complaint. Roku disputes the allegations and, per Communications Daily, initially vowed to fight. Its on-record position in the parallel Michigan case, reported by MediaPost, is a flat denial: "We do not use or disclose children's personal information for targeted advertising or any other purpose prohibited by law, nor do we partner with third-party web trackers or data brokers to sell children's personal information."

The prayer for relief asked for penalties up to $150,000 per FDBR violation and up to $10,000 per violation of the state's deceptive-trade-practices act. The state collected none of it. Florida's first test of its own privacy law ended with the regulator accepting the defendant's unaudited spending estimate in place of a penalty. That trade reads differently once you line it up against who the state hired to litigate the case, and against what a federal agency extracted from the same data broker seven weeks earlier.

A $25 Million Estimate No One Audited

The June 26 announcement is unusually clear about what it isn't. "This resolution does not include any finding of wrongdoing or civil fine," it says. On the money: "Roku has agreed to invest in the engineering resources necessary to implement these changes, estimated at $25 million, reflecting a significant financial and operational commitment to this effort." Estimated by whom, the release never says. Both versions keep that sentence passive, and for a number standing in for a penalty, the missing author is the part I'd want answered first.

Roku published that same release on its own newsroom, byte for byte, under the same Tallahassee dateline, with only the media-contact block changed. The text also has the regulator characterizing its own first-ever enforcement action under a law barely two years old: the parties "worked cooperatively throughout the resolution process and acknowledged each other's good-faith efforts in reaching an early and voluntary agreement."

There is no public settlement document. Court records and both parties' sites carry press releases and nothing else, no consent order and no assurance of voluntary compliance. The public record contains no monitor, no audit right, no reporting cadence, and no mechanism confirming the $25 million ever gets spent. Set against Roku's own numbers, the figure is small: FY2025 platform revenue was $4.145 billion, making the commitment about 0.6% of the segment the complaint says runs on the challenged practices. Roku spent $150 million buying back its own stock in 2025, and another $100 million in the first quarter of 2026, four times the settlement figure in the quarter right before it was announced.

Eleven Days After the Fox Deal

On June 15, 2026, Fox Corporation announced a definitive agreement to acquire Roku at $160.00 a share, an enterprise value of roughly $22 billion. Reuters reported that Roku's board had launched the sale process nearly two months earlier, around mid-April, and that founder and CEO Anthony Wood "stands to make as much as $3 billion on the sale." Florida's settlement landed eleven days after the Fox announcement, about ten weeks after Roku started shopping itself.

No source says the settlement was timed to the deal. But a pending state action alleging systematic sale of children's sensitive data is the kind of contingent liability that complicates a shareholder vote, and this deal is under live scrutiny. On July 17, Sen. Elizabeth Warren and six House Democrats sent the Justice Department a letter, reported by Deadline, warning that the combined company could "preference and steer viewers to Fox content for the 100 million Roku households." Fox targets closing in the first half of 2027.

Florida Hired the More Expensive Lawyer

Eight days before the settlement, the Miami Herald reported how Florida picked its outside counsel. Uthmeier's office solicited proposals in summer 2025 and got two. Israel David LLC, a firm with privacy class-action experience, proposed 20% of the first $15 million recovered, stepping down to 5% above $25 million. Grady Law of Naples priced its work at the state's statutory ceilings instead, which under Fla. Stat. § 16.0155(5) start at 25% of the first $10 million. By the Herald's math, Florida could pay Grady roughly $50,000 more than the competing bid on a $1 million recovery and roughly $750,000 more on anything recovered above $25 million.

Principal Thomas R. Grady's pitch led with his political résumé: former Republican state representative, former chairman of the Florida State Board of Education. He won the engagement.

In March 2026, six months into Grady Law's state contract and about three months before the case closed, eleven businesses that share the firm's address and list Grady or his wife as an executive each gave $3,000 to Uthmeier's campaign, $33,000 in total. Grady told the Herald the contributions followed a year of watching Uthmeier in office: "it was clear that he deserved our support." He said his bid "was submitted in complete accordance with state laws." Uthmeier's spokesman Jeremy Redfern called the Herald's reporting a "political hit job."

A contingency fee tied to recovery pays nothing on a zero-dollar outcome, so if the agreement works the way these deals normally do, Grady Law earned nothing for eight months of litigation. That doesn't answer why the state chose the pricier bid from a politically connected former officeholder over the cheaper one, and neither Grady nor Uthmeier's office has offered a reason.

Who Benefits

Roku gets cover, and it's the cheap kind. No finding of wrongdoing means the allegations in paragraphs 45 through 59 stay unadjudicated, never tested by a court. Roku's own quoted line in the release frames the changes as continuity rather than repair: "We are proud of the protections we have built and are pleased to continue strengthening them with today's announcement." Clearing a first-of-its-kind privacy suit during a $22 billion sale is worth more to the company than $25 million, and Wood's personal stake in that sale closing runs to $3 billion.

For Uthmeier, the benefit is the announcement itself. Gov. Ron DeSantis appointed him attorney general on February 17, 2025, and he has never held elected office; the August 18, 2026 Republican primary is his first campaign for the job, 53 days after the settlement. A "$25 million" headline works rhetorically like a fine while requiring no court findings and no disclosed verification that a dollar of it gets spent. The mechanism is the number: announce a figure big enough to read as accountability, attached to features the defendant was already building and marketing, and let the coverage carry it.

What the FTC Got From the Same Data Broker

Seven weeks before Florida's press release, the FTC resolved its own case against Kochava, the broker Florida's complaint cites twelve separate times. The May 4, 2026 stipulated final order bars Kochava and a subsidiary from selling sensitive precise-location data without affirmative express consent, runs ten years, requires quarterly accuracy assessments and a supplier program vetting where the data originates, and mandates incident reporting to the agency. Florida's complaint puts Roku at the front of that same chain, and the federal regulator came away with a decade of monitored obligations while the state regulator came away with a quote.

Florida's legal hand was weaker than the headline suggests. On March 31, 2026, a federal judge in Michigan dismissed five of seven counts in Michigan AG Dana Nessel's parallel suit against Roku, per Troutman Pepper Locke's analysis, reasoning that the state's theories largely mirrored private causes of action rather than a distinct statewide injury. Florida's complaint runs a structurally similar theory when it sweeps adult users' data into Counts I and II. Two things keep that from being the answer: the Michigan dismissal was without prejudice, and it turned on federal-court Article III standing doctrine, which does not govern a state-court action brought under Florida's express statutory enforcement authority.

Legal uncertainty explains a discount, not the absence of any verification. Nothing about an untested statute stopped Uthmeier's office from securing an audit right or a court-entered judgment, which is what the FTC obtained against a defendant with every incentive to fight. Troutman Pepper Locke, analyzing the Florida settlement in July, pushes back: rebuilt consent flows and data-broker restrictions "tend to become the baseline for all users," so a children's-data action may end up forcing a national product redesign. That's the firm's prediction. No settlement term requires it, and no document anyone can point to makes it enforceable.

The Bottom Line

The release says full nationwide deployment is anticipated within twelve months, which sets the deadline around late June 2027. Fox expects to have closed its acquisition by then, and Uthmeier will have won or lost an election. No public document names who checks the work, or what happens if the spending comes in at a fraction of the estimate.

Whoever Florida sues next under this law has a precedent now: the first defendant paid no fine and committed to a spending figure nobody will attribute. Whether that becomes the state's standard or its outlier is up to whoever holds the attorney general's office after August 18.