Connecticut Attorney General William Tong announced a civil investigative demand into MediaLab.AI Inc., owner of the Kik Messenger app, over lax age assurance practices, content moderation, and child safety failures that advocates have dubbed a "predator's paradise." The action follows a July 2025 notice of violation under the Connecticut Data Privacy Act for privacy notice deficiencies and processing sensitive data — including health, biometric, and precise geolocation data — without proper consent, which the company has only partially addressed. The new investigation seeks records related to practices that may constitute unfair or deceptive acts or practices under the CTDPA and the Connecticut Unfair Trade Practices Act. No fine has been imposed to date.
The Attorney General has issued a new civil investigative demand requiring MediaLab to produce comprehensive information and records related to its data processing, content moderation, and age assurance practices. No monetary penalty or injunction has been imposed yet, but the company previously received a July 2025 CTDPA notice of violation that it has only partially remedied despite repeated inquiries.
In-house teams at companies operating messaging apps, social platforms, or any service used by or marketed to minors should audit user-facing agreements and internal policies for age-related consistency: the press release flags that MediaLab marketed Kik as appropriate for users 13+ even after claiming to restrict new users to 18+, and did not update its Terms of Service or privacy notice age restrictions until 2025 — so review Terms of Service, privacy notices, and app store rating representations for alignment. Vendor and data processing agreements should be checked for clauses governing sensitive data categories (health, genetic, biometric, precise geolocation, sexual orientation) to ensure proper opt-in consent is obtained before processing under the CTDPA, and for consumer rights mechanism obligations (notice accuracy, opt-out functionality). Contracts with content moderation, age assurance, and ad-tech vendors should be reviewed for minimum safety standards, effectiveness audit rights, and cooperation obligations in response to state AG civil investigative demands. Finally, companies with outstanding notice-of-violation remediation timelines should ensure corrective commitments are documented and enforceable in vendor and compliance agreements.
Entity
MediaLab.AI Inc.
Industry
Social Media"09/08/2026"
"MediaLab.AI Inc. (“MediaLab”)"
"today announced an investigation into MediaLab.AI Inc."
"first issued a notice of violation under the Connecticut Data Privacy Act (CTDPA) to MediaLab in July 2025"
"in violation of the CTDPA and Connecticut Unfair Trade Practices Act"
"the processing of sensitive data without first obtaining proper consent, including data related to race or ethnic origin, religious beliefs, health, sex life or sexual orientation, genetic data, biometric data, and precise geolocation data, among other violations"
$500K
Connecticut Attorney General William Tong announced settlements with SunRun, Inc., Elevate Solar Solutions, and two salespeople over allegations of deceptive solar sales, including impersonating consumers and locking homeowners into long-term contracts without consent. SunRun must pay $300,000 and provide consumer relief; Elevate and the salespeople face a stated $200,000 penalty, with $100,000 suspended subject to ongoing compliance.
$8.0M
Connecticut announced an $8 million settlement with Mylan over allegations that it used agreements to delay generic EpiPen competitors and took other actions that inflated prices. Mylan also agreed to provide 10,000 free EpiPens; the release states that Mylan denies wrongdoing.
Connecticut Attorney General William Tong joined a coalition of 22 attorneys general in filing an amicus brief challenging DHS’s policy and practice of conducting warrantless civil immigration arrests. The press release describes a court challenge, not a privacy enforcement action or monetary penalty.
$625K
Connecticut reached a $625,000 settlement with Frontier Communications Parent Inc. over an April 2024 breach in which compromised employee and vendor credentials were used to access internal systems and exfiltrate unencrypted personal information of 58,841 Connecticut residents. The settlement requires Frontier to strengthen its security program, implement specific safeguards and training, and obtain an independent third-party assessment.
$2.6M
Connecticut and New York found that Boston Children’s Health Physicians and its security vendor, XTIUM, failed to use reasonable safeguards, resulting in hackers accessing sensitive personal, medical, and employee information. The companies agreed to pay penalties totaling $2.64 million and implement enhanced cybersecurity measures.
Connecticut joined a coalition of state attorneys general filing a notice in Character Technologies, Inc.’s bankruptcy proceedings, raising concerns about the company’s safety and privacy practices and the sensitive information it holds. The states seek protections for children and consumers if the company’s business or assets are sold or transferred; the filing does not impose a fine or other remedy.