Talking toys accused of recording and sharing kids' secrets
A complaint with the FTC alleges that internet-connected toys are recording and transmitting kids' conversations in violation of privacy rules.
That internet-connected talking toy you bought your kids may be putting their privacy at risk without your knowledge or consent, according to a coalition of consumer-interest organizations.
A complaint filed Tuesday with the US Federal Trade Commission alleges that Genesis Toys, the makers of "smart" kids toys -- the My Friend Cayla doll and the i-Que Intelligent Robot -- and speech-recognition software maker Nuance Communications are violating rules that protect children's privacy and prohibit unfair and deceptive practices.
The dolls ask children personal information like their name, their parents' names, favorite TV shows, favorite meals, school, neighborhood and toys. The Cayla dolls also have thinly veiled endorsements for Disney, with pre-programmed phrases telling kids she loves going to Disneyland, wants to go to Epcot in Disneyworld and that her favorite movie is "The Little Mermaid."
The My Friend Cayla doll may not be your friend at all, according to a complaint filed with the FTC.
The complaint (PDF), filed by the Electronic Privacy Information Center and the Campaign for a Commercial Free Childhood, among others, alleges that the toys record conversations and transmit the audio files through an app to a remote server operated by Nuance without first getting parents' consent. That, the coalition charges, violates the Children's Online Privacy Protection Act of 1998, which requires websites to get parental permission before making any use of data provided by children younger than 13.
Sen. Edward Markey (D-Mass.) wrote COPPA and called on the toy makers to be more transparent about what they were recording.
"Given the sensitive nature of children's recorded speech, I believe that Genesis Toys and Nuance must take responsible steps to protect children's privacy and comply with ... COPPA," Markey wrote in letters to both companies.
Under Cayla and i-Que's terms of services, it states the two companies use recorded speech data as research to improve its toys and other services. That second part is cause for concern, considering Nuance's other ventures.
One of its other services includes Nuance Identifier, a voice-recognition tool sold to military, intelligence and law enforcement agencies. The tool allows police to match up people's voices with their database of over 30 million voiceprints and "easily identify known individuals."
The coalition said it has also filed complaints with consumer watchdogs for the European Union, France, the Netherlands, Belgium, Ireland and Norway.
For many people, the allegations underscore the potential dangers associated with the internet of things, the notion of tying any and every thing into the web through built-in sensors such as cameras and microphones. Research firm Gartner expects sensors will be embedded in 6.4 billion devices of some kind or another this year alone, more than tripling to 20.8 billion connected things by 2020.
"As more toys are connected to the internet, we have to ensure that children's privacy and security are protected," Katie McInnis, technology policy counsel for Consumers Union, the advocacy arm of Consumer Reports magazine, said in a statement. "When a toy collects personal information about a child, families have a right to know, and they need to have meaningful choices to decide how their kids' data is used."
This isn't the first toy accused of privacy violations. A flaw found last year in Mattel's $75 Hello Barbie could have allowed hackers to pinpoint doll owners' home addresses. Researchers discovered earlier this year that the Fisher-Price Smart Toy, a plush little teddy bear that can hold conversations with children, could leak parents' and kids' data.
Nuance said it hasn't yet received an inquiry on the matter from the FTC but asserted that it takes data privacy very seriously.
"Our policy is that we don't use or sell voice data for marketing or advertising purposes," Richard Mack, a spokesman for Nuance, wrote in a blog post Tuesday. "Nuance does not share voice data collected from or on behalf of any of our customers with any of our other customers."
Genesis Toys didn't respond to a request for comment.
First published December 6, 7:05 p.m. PT.
Updated on Dec. 7, 11:34 a.m. PT: Adds remarks from Sen. Edward Markey and details on Nuance Identifier.