Connecticut Attorney General William Tong announced a civil investigative demand into MediaLab.AI Inc., owner of the Kik Messenger app, over lax age assurance practices, content moderation, and child safety failures that advocates have dubbed a "predator's paradise." The action follows a July 2025 notice of violation under the Connecticut Data Privacy Act for privacy notice deficiencies and processing sensitive data — including health, biometric, and precise geolocation data — without proper consent, which the company has only partially addressed. The new investigation seeks records related to practices that may constitute unfair or deceptive acts or practices under the CTDPA and the Connecticut Unfair Trade Practices Act. No fine has been imposed to date.
The Attorney General has issued a new civil investigative demand requiring MediaLab to produce comprehensive information and records related to its data processing, content moderation, and age assurance practices. No monetary penalty or injunction has been imposed yet, but the company previously received a July 2025 CTDPA notice of violation that it has only partially remedied despite repeated inquiries.
In-house teams at companies operating messaging apps, social platforms, or any service used by or marketed to minors should audit user-facing agreements and internal policies for age-related consistency: the press release flags that MediaLab marketed Kik as appropriate for users 13+ even after claiming to restrict new users to 18+, and did not update its Terms of Service or privacy notice age restrictions until 2025 — so review Terms of Service, privacy notices, and app store rating representations for alignment. Vendor and data processing agreements should be checked for clauses governing sensitive data categories (health, genetic, biometric, precise geolocation, sexual orientation) to ensure proper opt-in consent is obtained before processing under the CTDPA, and for consumer rights mechanism obligations (notice accuracy, opt-out functionality). Contracts with content moderation, age assurance, and ad-tech vendors should be reviewed for minimum safety standards, effectiveness audit rights, and cooperation obligations in response to state AG civil investigative demands. Finally, companies with outstanding notice-of-violation remediation timelines should ensure corrective commitments are documented and enforceable in vendor and compliance agreements.
Entity
MediaLab.AI Inc.
Industry
Social Media"09/08/2026"
"MediaLab.AI Inc. (“MediaLab”)"
"today announced an investigation into MediaLab.AI Inc."
"first issued a notice of violation under the Connecticut Data Privacy Act (CTDPA) to MediaLab in July 2025"
"in violation of the CTDPA and Connecticut Unfair Trade Practices Act"
"the processing of sensitive data without first obtaining proper consent, including data related to race or ethnic origin, religious beliefs, health, sex life or sexual orientation, genetic data, biometric data, and precise geolocation data, among other violations"
$625K
Connecticut reached a $625,000 settlement with Frontier Communications Parent Inc. over an April 2024 breach in which compromised employee and vendor credentials were used to access internal systems and exfiltrate unencrypted personal information of 58,841 Connecticut residents. The settlement requires Frontier to strengthen its security program, implement specific safeguards and training, and obtain an independent third-party assessment.
$2.6M
Connecticut and New York found that Boston Children’s Health Physicians and its security vendor, XTIUM, failed to use reasonable safeguards, resulting in hackers accessing sensitive personal, medical, and employee information. The companies agreed to pay penalties totaling $2.64 million and implement enhanced cybersecurity measures.
Connecticut joined a coalition of state attorneys general filing a notice in Character Technologies, Inc.’s bankruptcy proceedings, raising concerns about the company’s safety and privacy practices and the sensitive information it holds. The states seek protections for children and consumers if the company’s business or assets are sold or transferred; the filing does not impose a fine or other remedy.
Attorney General William Tong and Consumer Counsel Claire Coleman petitioned PURA to review how Connecticut public utilities use artificial intelligence, citing potential data privacy and cybersecurity risks, algorithmic errors, and misleading outputs. The petition asks PURA to examine utility AI systems, safeguards, vendors, and data security practices; it does not report a finding of violation or an imposed penalty.
$2.0M
Connecticut Attorney General William Tong announced a settlement with RZ Smoke, Inc. over allegations that it distributed and sold high-potency cannabis products without a state license. The stipulated judgment is $2 million, with $375,000 payable to the State and $1.6 million suspended to ensure compliance; the company is barred from specified cannabis activities in Connecticut unless licensed.
$13.7M
Connecticut joined a coalition of states and the federal government in settling allegations that Takeda paid healthcare providers speaker honoraria and provided meals to induce prescriptions of Trintellix, leading to allegedly false claims to government healthcare programs. Takeda agreed to pay $13,670,921 plus accrued interest, with portions allocated to federal and state programs.