Kids' talking toys accused of sharing their secrets

The My Friend Cayla doll may not be your friend at all, according to a complaint filed with the FTC.

Photo by Gensis Toys

That internet-connected talking toy you bought your kid may be putting their privacy at risk without your knowledge or consent, according to a coalition of consumer-interest organizations.

A complaint filed Tuesday with the US Federal Trade Commission alleges that Genesis Toys, the makers of “smart” kids toys — the My Friend Cayla doll and the i-Que Intelligent Robot — and speech-recognition software maker Nuance Communications are violating rules that protect children’s privacy and prohibit unfair and deceptive practices.

The complaint (PDF), filed by the Electronic Privacy Information Center and the Campaign for a Commercial Free Childhood, among others, alleges that the toys record conversations and transmit the audio files through an app to a remote server operated by Nuance without first getting parents’ consent. That, the coalition charges, violates the Children’s Online Privacy Protection Act of 1998, which requires Web sites to get parental permission before making any use of data provided by children younger than 13.

The coalition said it has also filed complaints with consumer watchdogs for the European Union, France, the Netherlands, Belgium, Ireland and Norway.

For many people, the allegations underscore the potential dangers associated with the Internet of Things, the notion of tying any and every thing into the Net through built-in censors such as cameras and microphones. Research firm Gartner expects sensors will be embedded in 6.4 billion devices of some kind or another this year alone, more than tripling to 20.8 billion connected things by 2020.

“As more toys are connected to the internet, we have to ensure that children’s privacy and security are protected,” Katie McInnis, technology policy counsel for Consumers Union, the advocacy arm of Consumer Reports magazine, said in a statement. “When a toy collects personal information about a child, families have a right to know, and they need to have meaningful choices to decide how their kids’ data is used.”

This isn’t the first toy accused of privacy violations. A flaw found last year in Mattel’s $75 Hello Barbie could allow hackers to pinpoint doll owners’ home addresses. Researchers discovered earlier this year that the Fisher-Price Smart Toy, a plush little teddy bear that can hold conversations with children, could leak parents’ and kids’ data.

Nuance said it hasn’t yet received an inquiry on the matter from the FTC but asserted that it takes data privacy very seriously.

“Our policy is that we don’t use or sell voice data for marketing or advertising purposes,” Richard Mack, a spokesman for Nuance, wrote in a blog post Tuesday. “Nuance does not share voice data collected from or on behalf of any of our customers with any of our other customers.”

Genesis Toys did not immediately respond to a request for comment.