This doll recorded kids’ conversations without parental consent

Two connected toys — the My Friend Cayla doll and i-Que Intelligent Robot — allegedly violated kids’ privacy protections by recording their conversations without parental consent, according to a complaint sent to the FTC this week. Both connected toys, from manufacturer Genesis Toys, ship with a built-in Bluetooth microphone and speaker to facilitate communication between kids and the toys’ companion iOS / Android app. Both also search the internet to find answers to kids’ questions.

Once children talk to their toys, that voice data is sent to Nuance, a voice analysis firm that reportedly powers Siri and Samsung’s S Voice. It also holds contracts with the US military. The firm converts spoken questions into text so it’s easier to use in search. While yes, it’s troubling that children’s potentially intimate conversations are being sent to a defense contractor, the bigger issue is that the app never requests parental permission to do so. This, the complaint says, violates the Children’s Online Privacy Protection Act.

the internet of toys (yikes)

When the Cayla doll’s app is first turned on, users have to click “Agree” on Terms of Service and then solve a math problem, which always asks what 11 + 16 equals. The i-Que app doesn’t have these steps. The privacy organizations who filed this complaint say these restrictions do not qualify as parental consent for the collection and use of kids’ voice recordings.

Both toys also accompany abysmal privacy policies that ultimately defer to Nuance’s Privacy Policy, which states that the company uses collected data to improve its products. One of its products, Nuance Identifier, is a “highly accurate voice biometric solution that allows public security officials to quickly and easily identify known individuals through their voice within large audio data sets.” Law enforcement can use the software to identify suspects by their voice.

While the complaint doesn’t say the toy data is directly used to help support this program, it does allude to the idea that it could be happening.

To top it all off, the privacy firms say that researchers found that they could exploit weak Bluetooth authentication measures to listen in on conversations. It’s unclear whether the FTC will take action against the company, but Senator Ed Markey sent a letter to both Nuance and Genesis Toys asking for more information on the security and privacy of kids’ data.