Parents who want to expose their children to the internet of things should beware of a possible problem: Smart toys can be so clever that they turn into spies on your home. Two internet-connected toys have been called out by international consumer protection groups for turning over data collected from conversations with children to companies without parents’ permission.
A worldwide coalition of watchdog groups filed complaints with various data privacy and consumer safety regulators for the EU, France, the Netherlands, Belgium, Ireland, Norway, and the US on Dec. 6, alleging privacy violations by toymaker Genesis Toys and voice-recognition software company Nuance Communications. Consumer advocates say parents have a right to know more about how these toys collect and use data.
Genesis Toys uses voice recognition technology from Nuance Communications in My Friend Cayla (which Walmart and Toys R Us sell for about $50) and the i-Que Intelligence Robot (sold by Amazon for about $90).
The My Friend Cayla doll asks several initial questions of its user: the child’s name, their parents’ names, their school, their hometown, and their physical location, according to Buzzfeed. By syncing with a smartphone and app, exchanges with the child are transmitted and recorded via bluetooth to Genesis. The toymaker passes on data to Nuance, ostensibly to improve its software. But consumer protection advocates worry about what else Nuance might do with the data, which they say is not clearly stated in its privacy policy.
I-Que Intelligent Robot also uses a smartphone app that requests access to the smartphone’s camera. The complaint says this action is “not necessary” for the toy’s use and not “explained or justified.”
The privacy policy for My Friend Cayla does not discuss how it collects, uses, or discloses data to third parties, according to the US complaint. It asks the Federal Trade Commission to investigate the toys for violating the Children’s Online Privacy Protection Act of 1998. The law requires websites collecting information from children under 13 to get parental consent for the data.
“By purpose and design, these toys record and collect the private conversations of young children without any limitations on collection, use, or disclosure,” the US complaint states. It argues that the toys subject “young children to ongoing surveillance and are deployed in homes…without any meaningful data protection standards.”
The collected data is stored on a server of Nuance Communications, and may also be stored on Google’s server, according to its privacy policy. According to the US complaint, Nuance markets its technology to “public and private entities” and contracts voice biometric technology to military, intelligence, and law enforcement agencies.
Genesis Toys’s 6,250-word terms-of-service contract doesn’t help, since parents aren’t likely to discover that children are being monitored and recorded, and that the data may be shared, without a lawyer who can wade through and translate reams of legalese.
The complaints filed internationally are based on a smart toy report commissioned by the Norwegian Consumer Council to investigate privacy violations in interactive playthings. That report also noted that Mattel’s interactive doll Hello Barbie won’t share recordings but may share transcripts with unspecified parties. Hello Barbie is made with technology from Pullstring Inc., formerly ToyTalk, which uses artificial intelligence to simulate conversations.
“Any internet-connected product for children should make abundantly clear exactly who a child’s sensitive data is being shared with and for what purpose.” Josh Golin of the Campaign for a Commercial Free Childhood, told The Boston Globe.
Two Dutch retailers have pulled from the shelves the smart toys, which have likely already sold in the hundreds of thousands, according to an estimate by app analytics firm Sensor Tower. The US senator who authored the children’s privacy act, Edward Markey, is demanding answers from the companies.
