Smart and internet-connected toys can gather a lot of info about your kid and send it to the manufacturer. Your child's data may end up in a lot of places.
The number of high-tech toys with internet connections and special software available for sale is growing every year. If you’re a parent, odds are one of these toys will show up on your kid’s wishlist some day. These toys come with some unique risks that you’ll want to keep in mind.
Once you stick a computer in something and give it an internet connection, that device suddenly has the capability to 1) gather a lot of information and 2) send it somewhere. Smart toys are no exception. These toys may gather more data about kids than parents may realize, and send it to the manufacturer. Anytime a company holds data about a kid, the odds that it will be exposed in a breach or hack increases. We’ve seen smart toy manufacturers expose the personal information of millions of kids online before – including sensitive data like photos and voice recordings. That’s pretty scary for parents to hear.
Smart toys may gather location data. Smart toys that have two-way conversations with kids may gather voice recordings. For example, we looked at the Fuzzible Friends Alexa-connected toy – a plush animal that lights up and when connected to an Amazon Echo Dot can talk and play games with children. In 2021, the Mozilla Foundation discovered that the manufacturer of the software that brings the toy to life states in its privacy policy that it may receive transcripts of your child’s interactions with the toy, contingent on parental consent. We confirmed that as of December 2022, this fine print still exists. If your child were to tell the toy their age, for example, then that would end up in the transcript.
Toy manufacturers may share your child’s data with others.
Smart toy manufacturers may partner with other companies to deliver the high-tech components of smart toys; the manufacturer may make the body of the toy, and a smaller, newer tech company may provide, for example, the integration with speech recognition or artificial intelligence programs. Your child’s data can go not only to the manufacturer, but all the companies involved in delivering a smart toy’s play function.
Some toy manufacturers reserve the right to share your child’s data with other entities, too. This can be particularly problematic when parents can’t tell exactly what companies are getting their child’s information. Some toy manufacturers in their privacy policy may state they share data with their “business partners” and give you no clue as to who those companies actually are. And those “business partners” may reserve the right to share your child’s data with their “business partners”. Before you know it, information about your kid may be ricocheting around the databases of companies you’ve never even heard of.
The more companies that hold your child’s data, the more likely it ends up a part of a breach or a hack.
What can parents do to make smart toys as safe as possible?
The number one thing parents can do is their homework. You want to look up the toy manufacturer online and make sure there are no news stories or bad reviews about the company’s spotty safety record. And you want to read the fine print. The terms & conditions and privacy policies of smart toy manufacturers is where you’re most likely to find important info – like what data is the toy collecting about your child, what is it being used for, and where all might it end up. Which sucks – privacy policies can be hard to read and companies should provide this information as clearly and simply as possible. But in the meantime, we’re here to help.
We have a tips guide to help you walk through the privacy policies and find the red flags that may mean you’re better off finding a different toy made by a different manufacturer.
You can find more tips for picking a safe toy and ensuring play is safe for your child in our full Smart Decisions about Smart Toys report.
Tell the FTC: Stop companies from selling our personal data
Did you know that hundreds of companies you’ve never heard of make billions of dollars every year selling people’s personal information online -- probably including yours?
Director, Don't Sell My Data Campaign, PIRG; Policy Analyst, Frontier Group
R.J. focuses on manipulative advertising and the commercialization of personal data online as a part of her work to advance PIRG’s New Economy program. In her work at Frontier Group, she has authored research reports on government transparency, predatory auto lending and consumer debt. She was previously the tax and budget advocate for PIRG. When she’s not protecting the public interest, she is an avid reader, fiction writer and birder.