Connecticut Attorney General William Tong announced on September 8 that his office is investigating MediaLab.AI Inc., the parent of the messaging app Kik. The office has issued a civil investigative demand for records on data processing, content moderation, and age assurance. Tong said those practices may be unfair or deceptive under the Connecticut Data Privacy Act and the Connecticut Unfair Trade Practices Act.
He placed Kik in a line of Connecticut actions: the $17.1 billion multistate Meta settlement announced in late August, notices to TikTok, YouTube, and Snap, and an open Roblox investigation. “If Roblox is a predator’s playground, Kik has become a predator’s paradise,” he said at a news conference. He also said Kik has “no parental controls. Zero. Zippo.”
What the office says Kik does not do
Tong’s office alleges Kik uses no technological tools to watch for underage users. Moderation, the office says, is reactive: reported or manually found content. The company has not audited whether its age-determination process works.
As late as September 2024, Kik’s website still called the app appropriate for children over 13. Google Play listed a “Teen” rating as of February 8, 2025. MediaLab did not change its terms of service to restrict minors until February 5, 2025, and did not put an age restriction in the privacy notice until June 2025. The site still described Kik as an app for “young adults” until after February 2026.
The National Center on Sexual Exploitation has listed Kik on its “Dirty Dozen.” Tong cited NCOSE’s report that a test account named “Im12BeNice” drew sexual solicitations within seconds, and that NCOSE found no working filters against explicit images. In June 2026 Sen. Marsha Blackburn wrote MediaLab CEO Michael Heyward asking how Kik verifies users are 18, what stops adult-minor contact, and how many accounts it has closed for child sexual abuse material.
Kik’s current public line is that users under 18 should not register and that suspected violations lead to a ban. Tong called that insufficient: “No age gating, no effective supervision.”
The privacy file predates this CID
In July 2025 the Attorney General issued a CTDPA notice of violation to MediaLab. The notice listed gaps in privacy notices and consumer-rights tools, and processing of sensitive data without required consent. The categories named include race or ethnic origin, religious beliefs, health, sex life or sexual orientation, genetic data, biometric data, and precise geolocation. Tong said the company has only partly fixed those problems after repeated follow-up, and that the answers raised new questions about minors on the app.
The new demand is broader than the 2025 notice. It reaches age assurance design, how accounts are created and stay anonymous, and whether statements about a 13-plus or teen product were accurate while the terms later claimed 18-plus.
Why messaging apps sit in the CTDPA box
Connecticut’s privacy statute treats certain data as sensitive and requires consent before it is processed. A chat app that collects precise location, biometric identifiers, or data about sex life without that consent is already a CTDPA problem, separate from whether the product is safe for children. CUTPA then lets the AG treat a safety claim that does not match the product as a deceptive trade practice.
Age assurance is the hinge. If the company cannot tell who is under 18, it cannot run parental controls, night-time notification rules, or the minor-specific defaults in Connecticut’s newer social-media statutes. Tong’s theory is that “we ban you if we catch you” is not a system.
This is an investigation, not a finding. MediaLab had not issued a detailed public response in the local coverage on announcement day. Companies in the same posture should expect the next CID to ask for the age model, false-positive rates, store-listing history, and the paper trail from the July 2025 notice to now.