The state of New Mexico is suing Google, Twitter, Tiny Lab, and other app developers for illegally gathering data on users under the age of 13 without parental consent.

New Mexico Attorney General Hector Balderas stated tech companies including Google, Twitter, and other app developers are violating the 1998 Children’s Online Privacy Protection Act (COPPA), by gathering and selling data on child users.

“These apps can track where children live, play, and go to school with incredible precision,” said Balderas in a press release. “These multi-million-dollar tech companies partnering with app developers are taking advantage of New Mexican children, and the unacceptable risk of data breach and access from third parties who seek to exploit and harm our children will not be tolerated in New Mexico.”

The lawsuit, filed on September 12, follows a University of California, Berkeley study which analyzed just under 6,000 children’s apps. According to the study, many of the apps tested were found to potentially violate COPPA.

The lawsuit also accuses app industry companies including Twitter subsidiary MoPub, AerServ, InMobi PTE, AppLovin, and IronSource of gathering data on child users without permission.

Google spokesman Aaron Stein told the New York Times that app developers are responsible for revealing if a product is created for children, and the Google Play store “must comply with more stringent policies.”

A Twitter spokesperson claimed MoPub, the social media giant’s ad platform, prohibits the collection of information from children’s apps for the use of targeted advertising, adding that the company suspended the creator of “Fun Kid Racing” in 2017 for violating its policies.

Founder of Tiny Lab Jonas Abromaitis believes his company follows the law as the app asks for the age of each user and tracks information for those over the age of 13.

“COPPA covers operators of general audience websites or online services only where such operators have actual knowledge that a child under age 13 is the person providing personal information,” Abromaitis wrote in a press release. “The rule does not require operators to ask the age of visitors. However, an operator of a general audience site or service that chooses to screen its users for age in a neutral fashion may rely on the age information its users enter, even if that age information is not accurate.”

Balderas warned parents to adjust settings on their children’s apps to limit data collection and ad tracking.

“As technology advances, more and more children are gaining access to the Internet and the Internet of things,” Balderas notes. “These games, downloaded from the Internet and connected to the Internet during and sometimes even after play, pose a unique risk to children.”