X

Smart toy maker VTech settles privacy charges with FTC

The company was charged with illegally collecting kids' info and then failing to protect it from hackers.

Laura Hautala Former Senior Writer
Laura wrote about e-commerce and Amazon, and she occasionally covered cool science topics. Previously, she broke down cybersecurity and privacy issues for CNET readers. Laura is based in Tacoma, Washington, and was into sourdough before the pandemic.
Expertise E-commerce, Amazon, earned wage access, online marketplaces, direct to consumer, unions, labor and employment, supply chain, cybersecurity, privacy, stalkerware, hacking. Credentials
  • 2022 Eddie Award for a single article in consumer technology
See full bio
Laura Hautala
A boy holds a VTech tablet at a toy show in November, 2015. That was the same month a hacker revealed the company's database of customer information was vulnerable.

Yank Baker, 6, plays with a VTech tablet at a toy show in November 2015. That was the same month a hacker revealed the company's database of customer information was vulnerable.

 Getty Images

Toy maker VTech will pay $650,000 to settle charges from the US Federal Trade Commission that it broke privacy laws when it collected children's information and failed to secure its database from hackers.

The settlement, announced Monday, stems from a data breach in 2015 in which a hacker broke into VTech's Learning Lodge apps. The hacker was able to access information collected on hundreds of thousands of children. The apps work on VTech toys that connect to the internet.

The hack was one high-profile example of the ways that internet-connected toys can be vulnerable to hackers. A month later, in December 2015, hackers also found security flaws in talking Mattel toy Hello Barbie.

According to a lawsuit filed Monday with the settlement, the FTC investigated VTech for violating the Children's Online Privacy Protection Act. The law requires companies to notify parents and get consent when collecting children's information online, and it requires companies to take reasonable steps to protect that information.