Are these toys spying on your kids?
Loading...
Finn Myrstad makes his living reading the听cryptic privacy policies that most consumers give merely a passing glance before opening an app or plugging in internet-connected gadgets.听
And much of the language he encounters in those dense and lengthy contracts is the same whether it's for or . But when Mr.听Myrstad, head of Norway's national consumer protection agency,听examined the privacy policies for two popular internet-connected toys, he听noticed something particularly striking.
The terms and conditions for听My Friend Cayla and I-Que Intelligent Robot听allows toymaker听Genesis Toys to capture and store kids' voices while they play with the toys and share data from those recording with third parties. In turn, companies can use that information to target kids with ads.听Myrstad says that information about the ad-targeting is buried deep in those terms 鈥 where most users can't find them.听
"I'd love companies to be much more transparent in plain language about how they collect data," Myrstad says. "You pay once with your actual money, and you pay another time with your data. We think that鈥檚 unacceptable."
Using Myrstad's research, a group of consumer advocacy and privacy groups听听(FTC) claiming the two talking dolls violate federal privacy laws by collecting children's voices and data without parental consent. The groups put forward similar complaints to regulators in the European Union, France, the Netherlands, Belgium, Ireland, and Norway.听
"This toy is essentially spying on children, recording their conversations, and storing their voices talking to the doll and sharing those conversations with unknown third parties," said听Josh Golin, executive director of听Campaign for a Commercial Free Childhood, one of the groups that filed the complaint. "When children play with a doll, they tend to reveal secrets 鈥 it鈥檚 very concerning that that information is being captured, stored, and shared."
The case illustrates growing concerns among privacy groups and technologists about the increasing number of children's products that record and store about kids.听Although internet-connected gadgets represent just 1 percent of total US toy sales according to research firm the NPD Group, purchases听boomed by 79 percent for the 12 months ending in October.
The rapid growth of that industry has led privacy experts to worry that as more toys seamlessly connect to the internet, those devices could begin collecting data before users have a chance to secure their privacy.
"There's not going to be a user interface 鈥 or there's going to be a very small or disconnected user interface," Julie Brill, a partner at law firm Hogan Lovells and until recently a Federal Trade Commissioner, said听at a Passcode event on the future of connected toys in July.听"All of the rules and laws we have will apply, but it鈥檚 a question of how will we get user permission? How will we obtain consent for collection of sensitive information and things like that?"
Campaign for a Commercial Free Childhood, one of the US groups behind Tuesday鈥檚 complaint,听launched a petition听last year calling on Mattel to halt sales of the popular internet-connected Hello Barbie toy, claiming the doll could share children's conversations with other companies or strangers.
"Mattel is committed to safety and security, and Hello Barbie conforms to applicable government standards, including the Children鈥檚 Online Privacy Protection Act," the company said in response to the petition. "Additionally, Hello Barbie鈥檚 technology features a number of safeguards to ensure that stored data is secure and can鈥檛 be accessed by unauthorized users."
The FTC can penalize privacy violators by initiating a civil administrative complaint to force them to change their practices. Congress updated the law in 2012 to expand the definition of children's personal information to include geolocation, photos, videos, and audio files.听
COPPA violations can also lead to large federal fines.听In September, Viacom, Mattel, and Jumpstart games paid out a total of $835,000 in federal fines 鈥 bowing to allegations from New York Attorney General Eric T. Schneiderman (D) that the companies had illegally allowed third-party vendors to track children鈥檚 activity online.
Genesis Toys did not respond to a request for comment regarding this week's complaint. It鈥檚 not the first time that the company has come under fire for flaws in its products, either. Last year, security researcher Ken Munro , programmed to recognize dozens of phrases from Disney movies and record and convert children鈥檚 questions into text in order to retrieve answers from Google, Wikipedia, and the weather forecasting website听Weather Underground. Mr.听Munro was able to alter the doll's interface to spew听foul language and references to Hannibal Lecter.听
And听听from the Scandinavian firm Bouvet ASA,听Norway's Myrstad听discovered that hackers could intercept Bluetooth signals from My Friend Cayla, potentially letting听snoopers talk through the doll or eavesdrop on people.
Last November, criminal hackers broke into the servers of Hong Kong-based toymaker VTech 鈥 designer of tablets, gadgets, and toys for kids, 鈥 including the names, home addresses, and chat logs of millions of parents and children out in public.
It's not yet clear how the US government will react to this week's privacy complaint against听Genesis.听The FTC did not respond to requests for comment regarding the timing of a potential decision on the matter. But Sen. Ed Markey (D) of Massachusetts has already sent letters to Nuance and Genesis Toys on the privacy features of their products.
Advocates are hoping that the听complaint could lead to a recall of the toys in the US until they鈥檙e up to snuff with federal data privacy laws. Stores in the Netherlands and Belgium have already stopped stocking the devices.听
But some digital toymakers are working hard to ensure they're COPPA compliant. Elemental Path, for instance, sells the internet-connected听Cognitoys Dino, a toy dinosaur that anonymizes all user data that leaves the device. The company's听chief technologist JP Benini says Tuesday's filing should be a warning for parents to听stay vigilant when it comes to buying connected toys.
"Parents just have to be mindful of the toys they expose their children to," he says. "If a parent is really, really concerned about a toy listening to their child, they鈥檙e going to speak with their wallets and not buy the toy."