Connected toys are internet-enabled devices with

Wi-Fi Wi-Fi () is a family of wireless network protocols, based on the IEEE 802.11 family of standards, which are commonly used for local area networking of devices and Internet access, allowing nearby digital devices to exchange data by radio wave ...

Bluetooth Bluetooth is a short-range wireless technology standard that is used for exchanging data between fixed and mobile devices over short distances and building personal area networks (PANs). In the most widely used mode, transmission power is limi ...

, or other capabilities built in. These toys, which may or may not be smart toys, provide a more personalized play experience for children through embedded software that can offer app integration,

speech Speech is a human vocal communication using language. Each language uses Phonetics, phonetic combinations of vowel and consonant sounds that form the sound of its words (that is, all English words sound different from all French words, even if ...

and/or

image recognition Computer vision is an interdisciplinary scientific field that deals with how computers can gain high-level understanding from digital images or videos. From the perspective of engineering, it seeks to understand and automate tasks that the hum ...

RFID Radio-frequency identification (RFID) uses electromagnetic fields to automatically identify and track tags attached to objects. An RFID system consists of a tiny radio transponder, a radio receiver and transmitter. When triggered by an electromag ...

functionality, and

web searching A search engine is a software system designed to carry out web searches. They search the World Wide Web in a systematic way for particular information specified in a textual web search query. The search results are generally presented in a ...

functions.Anon. n.d. “Consumer and Privacy Issues in Internet-Connected Toys.” Retrieved April 13, 2017 (https://fil.forbrukerradet.no/wp-content/uploads/2016/12/toyfail-report-desember2016.pdf ). A connected toy usually collects information about the users either voluntarily or involuntarily,O’Shea, Joe. 2016. “’Toys can be directed to take pictures, video, audio, and you will have no idea it is happening'- Irish cyber security expert warns parents” ''Independent.ie,'' November 3. Retrieved March 24, 2017 (http://www.independent.ie/life/family/parenting/toys- can-be-directed-to-take-pictures-video-audio-and- you-will-have-no-idea-it-is-happening-irish-cyber- security-expert-warns-parents-35183365.html) which raises concerns on the topic of privacy. The data collected by the connected toys are usually stored in a database, where companies that produce connected toys can use the data for their own purposes, provided they do so in line with the protections outlined in the Children's Online Privacy Protection Act (COPPA).

Information collection

Types of information that can be collected

Different information can be collected by children's connected toys, including information from both parents and children. Information that can be collected from children includes:Nelson, Bill 1942-. 2016. “Children's Connected Toys: Data Security and Privacy Concerns.” ''Homeland Security Digital Library''. Retrieved June 5, 2022 (https://web.archive.org/web/20170509052752/https://www.hsdl.org/?view&did=797394 ). * Birthdate, name, and gender * Profile pictures *

Voice message A voicemail system (also known as voice message or voice bank) is a computer-based system that allows users and subscribers to exchange personal voice messages; to select and deliver voice information; and to process transactions relating to ind ...

s, chat messages, and photos sent by children * Account passwords * Physical location * Chat history and Internet browsing history Information that can be collected from parents includes: * Email address and mailing address * Gender * Profile pictures * Voice messages, chat messages, and photos sent by parents * Account passwords and password retrieval questions *

Credit card A credit card is a payment card issued to users (cardholders) to enable the cardholder to pay a merchant for goods and services based on the cardholder's accrued debt (i.e., promise to the card issuer to pay them for the amounts plus the o ...

information * Phone number * Wi-Fi passwords and

IP address An Internet Protocol address (IP address) is a numerical label such as that is connected to a computer network that uses the Internet Protocol for communication.. Updated by . An IP address serves two main functions: network interface ident ...

Common ways of collection

The collection of information by the connected toys can happen either voluntarily or involuntarily. Common ways of information collection include: * Information filled out by the users when creating an account * Interaction with the toys * Connection to Wi-Fi or cellular networks

Privacy-related issues

There are concerns that children's

information Information is an abstract concept that refers to that which has the power to inform. At the most fundamental level information pertains to the interpretation of that which may be sensed. Any natural process that is not completely random ...

is not secured properly due to previous

data breach A data breach is a security violation, in which sensitive, protected or confidential data is copied, transmitted, viewed, stolen or used by an individual unauthorized to do so. Other terms are unintentional information disclosure, data leak, info ...

es. Information collected by the toy companies is usually accessible by the public with little

encryption In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decip ...

on the system due to the lack of awareness of information privacy.

Previous data breaches

Connected toys have been at the center of several high-profile data breaches, which have raised concerns over the methods that toy companies use to protect children's information.

CloudPets data leak

In 2017, CloudPets toys by the company Spiral Toys experienced a significant data leak on its database. CloudPets stores all its information collected from the stuffed toys in an online database. According to cybersecurity expert Troy Hunt, more than 820, 000 user accounts were exposed and over 2.2 million voice messages, from both children and parents, were leaked during the severe CloudPets data breach. The cause of the data leak was because of the insecure database that Spiral Toys used in order to store the information collected. The database was easily accessible by the general public before the data leak happened. Although the database is not publicly accessible anymore, Spiral Toys have not informed their users regarding the data leak, which is a violation of the security breach notification law in California.

VTech data breach

In November 2015, VTech suffered a severe data breach on their information storing system, where the hacker used SQL injection, which is “an injection attack wherein an attacker can execute malicious SQL statements (also commonly referred to as a malicious ''payload'') that control a

web application A web application (or web app) is application software that is accessed using a web browser. Web applications are delivered on the World Wide Web to users with an active network connection. History In earlier computing models like client-serve ...

’s database server (also commonly referred to as a ''Relational Database Management System – RDBMS''),” to get full authorization to the database where he can access children and parents’

personal data Personal data, also known as personal information or personally identifiable information (PII), is any information related to an identifiable person. The abbreviation PII is widely accepted in the United States, but the phrase it abbreviates ha ...

. According to VTech's public data release, around 4.8 million parent accounts and approximately 6.4 million children-related profiles were leaked worldwide in several of their products. Data that were compromised during the breach included name, email address, password, secret question and answer for password retrieval, IP address, mailing address and download history; no credit card information or social security numbers were stored in the same database. The United States suffered the most due to the data breach, with 2.2 million parent accounts and 2.9 million children profiles registered in the United States, followed by France, United Kingdom, and Germany. A 21-year-old man from Berkshire was arrested for the hack.

Data sharing

Data sharing between toy producers and other companies has raised concern over the privacy of personal data collected by connected toys. Conversations and interactions between children and the toys are usually recorded by the toys and sent to the

cloud server A virtual private server (VPS) is a virtual machine sold as a service by an Internet hosting service. The virtual dedicated server (VDS) also has a similar meaning. A virtual private server runs its own copy of an operating system (OS), and cus ...

of the toy producer. The toy company that produced My Friend Cayla and i-Que Intelligent Bot, Genesis Toys, shares its voice data collected by the toys with Nuance Communications in order to improve their speech recognition technology. Nuance Communications have a record of selling biometric solutions to military, intelligence, and law enforcement agencies, which is put into consideration of privacy issues regarding connected toys. Similarly, Hello Barbie produced by

Mattel, Inc. Mattel, Inc. ( ) is an American multinational toy manufacturing and entertainment company founded in January 1945 and headquartered in El Segundo, California. The company has presence in 35 countries and territories and sells products in more ...

uses voice recognition technologies provided by ToyTalk based in California. The data collected by Hello Barbie are actively shared between Mattel and ToyTalk.

Data retention

Data retention of information collected by the connected toys is also a problem to consider. According to Children's Online Privacy Protection Act, "an operator of a Web site or online service shall retain personal information collected online from a child for only as long as is reasonably necessary to fulfill the purpose for which the information was collected. The operator must delete such information using reasonable measures to protect against unauthorized access to, or use of, the information in connection with its deletion." The Norwegian Consumer Council did an investigation on the terms of use and

privacy policies A privacy policy is a statement or legal document (in privacy law) that discloses some or all of the ways a party gathers, uses, discloses, and manages a customer or client's data. Personal information can be anything that can be used to identify ...

on My Friend Cayla and i-Que Intelligent Bot in 2016. They found that the privacy policies do not specifically mention how long the data will be retained after the users stop using the service or delete the account. Specifically, My Friend Cayla's privacy policy mentions that "it is not always possible to completely remove or delete all of your information from our databases without some residual data because of backups and other reasons."

Ban on My Friend Cayla in Germany

In early 2017, Germany's Federal Network Agency,

Bundesnetzagentur The Federal Network Agency (german: Bundesnetzagentur or ) is the German regulatory office for electricity, gas, telecommunications, post and railway markets. It is a federal agency of the Federal Ministry for Economic Affairs and Climate Acti ...

, placed a ban on the sale and possession of the connected toy My Friend Cayla produced by Genesis Toys, claiming the toy to be an unsafe and unauthorized information transmission device. My Friend Cayla is the first connected toy that got banned by Germany.Huggler, Justin. 2017. “Germany Bans Internet-Connected Dolls over Fears Hackers Could Target Children.” ''The Telegraph''. Retrieved April 27, 2017 (http://www.telegraph.co.uk/news/2017/02/17/germany-bans-internet-connected-dolls-fears-hackers-could-target/ ). The agency further states that any toy that transmits data, including features such as recording video and voice, without detection is banned in Germany. It is concerned about the potential use of the toy as a surveillance device. The president of Bundesnetzagentur, Jochen Homann, states that "items that conceal cameras or microphones and that are capable of transmitting a signal, and therefore can transmit data without detection, compromise people's privacy. This applies in particular to children's toys. The Cayla doll has been banned in Germany. This is also to protect the most vulnerable in our society."Anon. 2017. “Bundesnetzagentur Removes Children's Doll ‘Cayla’ from the Market.”''Bundesnetzagentur Press''. Retrieved April 27, 2017 (https://www.bundesnetzagentur.de/SharedDocs/Pressemitteilungen/EN/2017/17022017_cayla.html ). The agency is conducting further investigations into other connected toys. No action has been made towards the families that have the toy. The Federal Network Agency advised the parents to immediately destroy the toy to avoid potential risk in comprising personal data privacy.

Laws related to connected toys

Federal laws that are commonly associated with connected toys include the Children's Online Privacy Protection Act (COPPA) and section 5 of the

Federal Trade Commission Act The Federal Trade Commission Act of 1914 was a United States federal law which established the Federal Trade Commission. The Act was signed into law by US President Woodrow Wilson in 1914 and outlaws unfair methods of competition and unfair acts ...

. Both acts are enforced by the

Federal Trade Commission The Federal Trade Commission (FTC) is an independent agency of the United States government whose principal mission is the enforcement of civil (non-criminal) antitrust law and the promotion of consumer protection. The FTC shares jurisdiction ov ...

regarding the

data collection Data collection or data gathering is the process of gathering and measuring information on targeted variables in an established system, which then enables one to answer relevant questions and evaluate outcomes. Data collection is a research com ...

of children's personal information.

Children’s Online Privacy Protection Act

Toys that are able to connect to the internet in various ways are subject to regulation from the Children's Online Privacy Protection Act (COPPA). COPPA gives parents control over what information is collected from their children online. Websites are required to ask for verifiable permissions from parents before receiving any personal information online from children under the age of 13.Anon. 2015. “Complying with COPPA: Frequently Asked Questions.” ''Complying with COPPA: Frequently Asked Questions , Federal Trade Commission''. Retrieved April 20, 2017 (https://www.ftc.gov/tips-advice/business-center/guidance/complying-coppa-frequently-asked-questions#General Questions). If the data is transferred to a third party, the third party is required to proceed the same steps to protect the data.16 C.F.R. § 312.8 Violation against COPPA is subject to civil penalties of up to $40,654 per incident. Concerns have been raised regarding COPPA protection for connected toys, as toys that are bought in retail stores do not directly subject to the law protection of COPPA. Other sources of concern relate to the compliance of connected toy companies regarding COPPA. The

Electronic Privacy Information Center Electronic Privacy Information Center (EPIC) is an independent nonprofit research center in Washington, D.C. EPIC's mission is to focus public attention on emerging privacy and related human rights issues. EPIC works to protect privacy, freedom o ...

, the

Campaign for a Commercial-Free Childhood Fairplay, previously known as Campaign for a Commercial-Free Childhood (CCFC), is a United States "national coalition of health care professionals, educators, advocacy groups, parents, and individuals who care about children nd isthe only nationa ...

, th
Center for Digital Democracy
and Consumers Union submitted a complaint to the Federal Trade Commission regarding how My Friend Cayla and I-Que Intelligent Bot produced by Genesis Toys have violated the laws of COPPA. The complaint mentioned the data sharing between Genesis Toys and Nuance Communications. In addition, it concerns with how Nuance Communications does not directly mention compliance with COPPA.Anon. n.d. “FEDERAL TRADE COMMISSION Washington, DC 20580 In the Matter of Genesis Toys and Nuance Communications.” ''FEDERAL TRADE COMMISSION Washington, DC 20580 In the Matter of Genesis Toys and Nuance Communications''.

Section 5 of the Federal Trade Commission Act

:"Unfair or deceptive acts or practices in or affecting commerce" are declared unlawful by section 5 of the Federal Trade Commission Act. The Federal Trade Commission has used its section 5 to protect consumers' privacy and personal data. The companies of connected toys could potentially violate the FTC Act by inappropriately collecting, protecting, and misusing data and information collected by the toys.

References

{{Reflist, 2 Electronic toys Toy controversies Virtual assistants Child safety