Your kids' toys could be spying on your family

When parents give their kids a holiday gift, they probably aren’t considering whether the toy might be listening in on their conversations. 

But Genesis Toys’ My Friend Cayla doll and the i-Que Intelligent Robot allegedly have the capabilities to eavesdrop on children and their families, potentially violating laws that protect children’s privacy. That’s according to a new complaint filed with the Federal Trade Commission from a coalition of consumer privacy advocates including the Electronic Privacy Information Center (EPIC). The toys allegedly send recordings to speech-to-text software company Nuance Communications, which the complaint notes has contracts with military and law enforcement agencies. 

With everything from toys to cars now incorporating wireless internet connections, privacy experts are increasingly raising concerns about how these consumer goods open the door to hackers, privacy violations and other problematic behaviors. Last year, Mattel (MAT) found itself in hot water for its “Hello Barbie” doll, which is enabled with WiFi and could be used to collect information about kids and their families that could later be used for marketing. 

IIn the case of the Genesis toys, the complaint alleges that consumers “could not reasonably anticipate that their children’s voices and text would be recorded and used in this way.”

“The use of children’s voice and text information to enhance products and services sold to military, intelligence, and law enforcement agencies creates a substantial risk of harm because children may be unfairly targeted by these organizations if their voices are inaccurately matched to recordings obtained by these organizations,” the complaint asserts. 

Genesis didn’t immediately return a request for comment. In a blog post, Nuance executive Richard Mack wrote, “Nuance takes data privacy seriously.” He added that the company hasn’t heard from the FTC. 

“Our policy is that we don’t use or sell voice data for marketing or advertising purposes,” Mach wrote. “Upon learning of the consumer advocacy groups’ concerns through media, we validated that we have adhered to our policy with respect to the voice data collected through the toys referred to in the complaint.”

EPIC said it believes the toys should be pulled from stores. “Immediately, we’d like to see the FTC require them to recall the dolls and stop further sales until they address the concerns we raise,” said Claire Gartland, director of the Consumer Privacy Project at EPIC. 

Gartland added that the toys “normalize surveillance to children, that it’s OK to have their trusted best friend spying on them or recording their every word.” 

My Friend Cayla, which costs $59.93 at Walmart.com, is billed as “a wonderful choice for a young child who needs a companion.” The i-Que Robot is sold at British retailers for about $75 and is described as having a “wicked sense of humor” and “wacky sound effects.”

Both toys include the physical doll, which include a Bluetooth microphone and a speaker, as well as a mobile application, which on the My Friend Cayla doll asks for permission to access the hardware, storage, microphone, Wi-Fi connections and Bluetooth on consumers’ devices. The i-Que robot asks for permission for a mobile device but doesn’t explain why, the complaint says.  

The applications record and collect conversations between toys and kids, with the recordings then converted into text. The apps then search for answers on sites including Wikipedia, and the toy can then respond to a child’s comment or question. 

My Friend Cayla appears to have another agenda: promoting Disney (DIS) products. Researchers found that the doll is pre-programmed with phrases and recommendations that plug Disney products, such as telling children that her favorite song is “Let It Go” from Disney’s “Frozen.” The doll also says she wants to go to Epcot in Disneyworld and enjoys visiting Disneyland. 

“This product placement is not disclosed and is difficult for young children to recognize as advertising,” the complaint says. “Studies show that children have a significantly harder time identifying advertising when it’s not clearly distinguished from programming.”

Cayla also prompts children to disclose personal information, the complaint alleges. The doll asks kids to finish answering questions about their family members’ names, where they attend school and where they live.

That seems fairly straightforward for a doll that’s geared to responding personally to kids, but more troubling may be what happens next. The recordings are allegedly sent to Nuance Communications, a speech-to-text company that sells voice biometric services to military, intelligence and law enforcement agencies. The complaint alleges that Nuance has more than 30 million “voiceprints” in its system. 

Cayla’s privacy policy doesn’t mention speech data, nor does it describe the collection or use of data by Genesis, Nuance or other third parties, the complaint notes. The toys are allegedly in violation of a federal law that sets limits on the collection of data from children under the age of 13. 

The toys are also potentially hackable because any smartphone or tablet with 50 feet can connect via Bluetooth, with no authentication code needed, the complaint asserts. 

It continued, “Researchers discovered that by connecting one phone to the doll through the insecure Bluetooth connection and calling that phone with a second phone, they were able to both converse with and covertly listen to conversations collected through the My Friend Cayla and i-Que toys.”

Essentially, the toys recognize other devices as a headset and could allow people to covertly listen in on conversations, Gartland said. That, she added, is “a serious concern.”