Parents told to destroy baby doll because of spying fears

Hackers could talk and listen to children playing with My Friend Cayla

The doll answers users’ questions by using a web connection

An official German watchdog has told parents to destroy an internet-connected doll because hackers can use it to spy on children.

My Friend Cayla was found to be equipped with an insecure Bluetooth device, which cybercriminals could hijack, in order to steal personal data and listen and talk to the child playing with it.

Germany’s Federal Network Agency, the regulatory office for electricity, gas, telecommunications, post and railway markets, has now warned parents to destroy it.

A spokesman for the agency told Süddeutsche Zeitung that My Friend Cayla was a "concealed transmitting device", something that's illegal in Germany.

The doll answers users’ questions by accessing the web, but also asks for sensitive personal information, such as the user’s name, school, parents’ names and hometown.

A coalition of campaign groups last year filed a complaint with the Federal Trade Commission against Genesis, the company behind My Friend Cayla, alleging that the toys wrongfully collect data from children and sent it to Nuance Communications, a speech-recognition company that built the toy's accompanying app.

Similar concerns were raised about the i-Que Intelligent Robot, also created by Genesis.

“Researchers discovered that by connecting one phone to the doll through the insecure Bluetooth connection and calling that phone with a second phone, they were able to both converse with and covertly listen to conversations collected through the My Friend Cayla and i-Que toys,” read the FTC complaint.

Student Stefan Hessel first raised legal concerns about My Friend Cayla, telling Netzpolitik.org that a hacker could connect to its speaker and microphone system with a Bluetooth-enabled device from a range of 10m.