It looks like you're using an Ad Blocker.
Please white-list or disable AboveTopSecret.com in your ad-blocking tool.
Thank you.
Some features of ATS will be disabled while you continue to use an ad-blocker.
'Smart' kids toys are reportedly collecting personal information from children, which can be easily hacked by strangers
TALKING toys could be putting your kids at risk by secretly recording their conversations and collecting personal information which could be stolen by dangerous predators.
Genesis Toys – who make the popular My Friend Cayla doll – and speech-recognition software maker Nuance Communications have been accused of using the toys to record conversations, which are then sent through the toy’s app as audio files and transmitted to Nuance’s servers.
But Genesis Toys’ My Friend Cayla doll and the i-Que Intelligent Robot allegedly have the capabilities to eavesdrop on children and their families, potentially violating laws that protect children’s privacy. That’s according to a new complaint filed with the Federal Trade Commission from a coalition of consumer privacy advocates including the Electronic Privacy Information Center (EPIC). The toys allegedly send recordings to speech-to-text software company Nuance Communications, which the complaint notes has contracts with military and law enforcement agencies.
"It is extremely alarming that what a child says to her ‘trusted’ friend could end up in a voice biometrics database sold to law enforcement and intelligence agencies. “With the growing Internet of Things, American consumers face unprecedented levels of surveillance in their most private spaces, and young children are uniquely vulnerable to these invasive practices.
Last but not least. What makes you think that you are important enough to say anything that law enforcement or the military would want to hear?
a coalition of consumer advocates including the Consumer's Union filed suit against Genesis Toys, the maker of two such toys, the My Friend Cayla doll and the i-Que Intelligent Robot. According to the full lawsuit (pdf), the toy maker is violating COPPA (the Childrens’ Online Privacy Protection Act of 1998) by failing to adequately inform parents' that their kids conversations and personal data collected by the toys are being shipped off to servers and third-party companies. Among the problems cited in the complaint is that the privacy policies governing the collection of kids' data aren't clear, aren't prominently displayed, and often change without notice. Parents aren't properly informed that data is being culled from the toys and sent off to companies like Nuance Communications, most commonly known for its Dragon voice recognition software, but a company that also has prominent roles in healthcare dictation and as a defense contractor. Both toys by proxy are governed by Nuance's privacy policy, which among other things says: "We may use the information that we collect for our internal purposes to develop, tune, enhance, and improve our products and services, and for advertising and marketing consistent with this Privacy Policy." It continues, “If you are under 18 or otherwise would be required to have parent or guardian consent to share information with Nuance, you should not send any information about yourself to us." With the toys being marketed to "ages 4 and up" and being mostly used by kids under age 18, the lawsuit states the companies selling and collecting this toy data are violating COPPA. Under COPPA, companies gathering kids data have to provide notice to, and obtain consent from parents regarding data collection. They also have to provide parents tools to access, review and delete this data if wanted, as well as the parental ability to dictate that the data can be collected, but not shared with third parties. The complaint suggests neither Nuance or Genesis Toys are doing any of this. And again, privacy is just part of the equation. There's also the fact that these toys just aren't all that secure. A report by the Norwegian Consumer Council (pdf) found that a lot of the data being transmitted by these toys is done so via vanilla, unencrypted HTTP connections that could be subject to man in the middle attacks. Reconfiguring the devices to create in-home surveillance tools was also "very easy and requires little technical know-how," according to the report. So again, much like all internet of things devices, companies were so excited to integrate internet connectivity, they effectively forgot about user privacy and security. Are we perhaps noticing a ongoing theme yet?