Your child's doll could be spying on them, privacy group warns

Two internet-connected toys have been called out by consumer protection groups for turning over data collected from conversations with children to companies without permission

"Cayla can understand and respond to you in real-time about almost anything. She is not just a doll, she’s a real friend!” Genesis Toys says in its marketing material. But the dolls may be a little more real than most parents are comfortable with.

My Friend Cayla and the i-Que Intelligent Robot, by toymaker Genesis, have raised concerns with consumer protection advocates who believe the toys could be spying on children and their families, potentially violating laws that protect children’s privacy.

The doll and the robot are part of a new generation of connected toys that rely on wireless technology and a Bluetooth to deliver realistic responses to children’s questions.

However, a coalition of campaign group including the Electronic Privacy Information Center, the Campaign for a Commercial Free Childhood, The Center for Digital Democracy, and Consumers Union have filed a complaint with the Federal Trade Commission against Genesis alleging that the toys wrongfully collect data from children and send it to Nuance Communications, a speech-recognition company that made the toy's accompanying app.

The My Friend Cayla doll asks several initial questions of its user such as the child’s name, their parents’ names, their school and their hometown. By syncing with a smartphone and app, exchanges with the child are transmitted and recorded via bluetooth to Genesis.

The toymaker then passes on data to Nuance to improve its software. But consumer protection groups worry about what else Nuance might do with the data, which they claim is not clearly stated in its privacy policy.

I-Que Intelligent Robot also uses a smartphone app that requests access to the smartphone’s camera. The complaint claims this action is not “explained or justified.”

The FTC complaint reads: “The use of children’s voice and text information to enhance products and services sold to military, intelligence, and law enforcement agencies creates a substantial risk of harm because children may be unfairly targeted by these organizations if their voices are inaccurately matched to recordings obtained by these organizations,”

“Researchers discovered that by connecting one phone to the doll through the insecure Bluetooth connection and calling that phone with a second phone, they were able to both converse with and covertly listen to conversations collected through the My Friend Cayla and i-Que toys.”

Last year, Mattel has raised similar concerns over its “Hello Barbie” doll as child protection advocates raised the alarm that a concealed microphone, activated by a button on the doll’s belt could be used to record children’s likes and dislikes and sent that information back to Mattel via wifi.

Genesis has yet to comment on the issue.

Nuance Communications has issued a statement via a blog post stating that the company has adhered to its privacy policy.

“Upon learning of the consumer advocacy groups’ concerns through media, we validated that we have adhered to our policy with respect to the voice data collected through the toys referred to in the complaint,” said company spokesperson Richard Mack.