Protecting yourself, Shopping

Too-smart toys could steal your child’s personal info

Susan Ladika

Smart toys such as Furby Connect and My Friend Cayla may be on your kid’s holiday gift list. But such toys also are on the FBI’s warning list.

Interactive, internet-connected toys are outfitted with microphones, cameras, data storage components, and similar features. That means these too-smart toys “could put the privacy and safety of children at risk due to the large amount of personal information that may be unwittingly disclosed,” the FBI warns.

As your youngster chats with the toys, those with microphones could collect such information as your child’s name, address, school and favorite activities, according to the FBI. If the information is hacked, it could open the door to cyberthieves stealing your child’s identity.

The crackdown on too-smart toys
In December 2016, four consumer groups filed a complaint with the Federal Trade Commission (FTC), alleging My Friend Cayla and i-Que robot are outfitted with unsecured Bluetooth connections and violate consumer protection and privacy laws. The groups want the toys pulled from store shelves.

In Germany this year, the Federal Network Agency, which regulates telecommunications, banned My Friend Cayla in that country, classifying it as an espionage device, and recommending that parents destroy the dolls.

In the United States, the Children’s Online Privacy Protection Act (COPPA) requires the FTC to issue and enforce regulations related to children’s online privacy. The aim is to ensure that parents have control over what information is collected online from children who are under the age of 13.

The law is directed at websites and online services such as mobile apps directed at children under the age of 13 that collect, use or disclose kids’ personal information.

In response to the era of internet-connected toys, the FTC updated its guidance on COPPA this summer. The law requires that companies:

  • Post a privacy policy that describes how kids’ personal information will be handled.
  • Notify parents directly about policies before collecting information.
  • Obtain parents’ consent before collecting information.
  • Respect parents’ rights to review and revoke access to the information.
  • Implement security measures to protect kids’ personal information.

Those who violate the rule can be held liable for civil penalties of up to $40,654 per violation.

What you can do to protect your child
If you’re thinking of buying a too-smart toy this holiday season, the FBI recommends that you:

  • Research security issues involving the toys you’re considering.
  • Research the toy’s security measures.
  • Read disclosures and privacy policies.
  • Only connect the toys using secure internet connections.
  • Use a PIN or password when pairing the toy with Bluetooth.
  • Use encryption to transmit data from the toy.
  • Keep the toy updated with the most recent security patches and software updates.
  • Turn off the toy when it’s not being used.
  • Use strong passwords when creating user accounts.

If you’re concerned the toy might have been compromised, you can file a complaint with the Internet Crime Complaint Center.

While your child’s toy might be smart, you need to be smarter.

See related: Holiday gift ideas: 5 money-smart toys, Synthetic identity theft crimes growing fast, targeting kids, Guard the last 4 digits of your Social Security number – they are all ID thieves need

Join the Discussion

We encourage an active and insightful conversation among our users. Please help us keep our community civil and respectful. For your safety, we ask that you do not disclose confidential or personal information such as your bank account numbers, social security numbers, etc. Keep in mind that anything you post may be disclosed, published, transmitted or reused.

The editorial content on is not sponsored by any bank or credit card issuer. The journalists in the editorial department are separate from the company's business operations. The comments posted below are not provided, reviewed or approved by any company mentioned in our editorial content. Additionally, any companies mentioned in the content do not assume responsibility to ensure that all posts and/or questions are answered.