Table of Contents
AI Smart Toys for Kids: The Privacy Reality Behind the Talking Teddy Bear
Connected toys that talk, listen, and learn can collect voice recordings, location data, and behavioral patterns from children. Here's what parents need to check before buying.
There’s a category of gift that looks like a toy but functions like a data collection device. The packaging shows a smiling child and a friendly robot face. The small print mentions something about “always-on connectivity” and “personalized AI responses.” What it doesn’t explain clearly is that your child’s voice, their questions, their location, and their conversational patterns are being transmitted to servers — often in other countries — and retained for purposes that range from “product improvement” to data practices that are hard to evaluate without a law degree. Smart connected toys have been on the market for years. The regulatory and parent awareness gap has barely closed. This is what you need to know before the next holiday season.
Key Takeaways
- Germany’s Federal Network Agency classified My Friend Cayla as an “illegal espionage device” in 2017 and ordered parents to destroy it — not return it, destroy it — because it transmitted children’s conversations without disclosure.
- The FTC has taken enforcement actions against multiple connected toy and children’s service companies for COPPA violations, including a $5.7 million settlement with the makers of Musical.ly (now TikTok).
- COPPA (Children’s Online Privacy Protection Act) requires verifiable parental consent before collecting data from children under 13 — but “verifiable” has often meant a checkbox rather than a meaningful check.
- Mozilla’s “Privacy Not Included” guide consistently finds that many popular connected toys have privacy practices that fall below what adults would accept for their own devices.
- A practical pre-purchase checklist can significantly reduce the risk of bringing invasive data collection into your home.
What Smart Toys Actually Collect
The term “smart toy” covers a range from innocuous (a toy with a Bluetooth speaker) to genuinely invasive (a doll with a hidden microphone, always-on internet connection, and third-party data sharing). The key distinctions are:
Voice data. Toys with conversational AI capabilities necessarily collect audio. The question is what happens next: Is audio processed locally on the device? Sent to a remote server? Retained after processing? Shared with third parties? Most parents assume voice data is processed and discarded. For many products, that assumption is wrong.
Location data. Any connected toy with a companion app may collect location data from the phone used to pair it. Some toys marketed as “family tracking” devices collect child location continuously.
Behavioral and interaction data. What questions does your child ask? What topics do they return to? What characters and content do they prefer? These interaction patterns have commercial value — they inform product development and, in some cases, targeted advertising ecosystems.
Account and household data. Creating an account to use a connected toy often means providing email addresses, birth dates, household information, and payment data. This data typically flows to the toy maker and their third-party analytics partners.
The Cayla Case: What “Illegal Surveillance Device” Actually Means
My Friend Cayla was a conversational doll sold in the U.S. and Europe starting around 2014. The doll used a microphone, Bluetooth connection, and a companion app to enable conversation with children. The app transmitted audio to Nuance Communications for voice processing and to Genesis Toys (the manufacturer) for response generation.
The problem: the doll’s Bluetooth connection had no authentication. Anyone with a Bluetooth-enabled phone within range could connect to the doll and use it as a remote microphone — listening to conversations in the room without the family’s knowledge. Germany’s Federal Network Agency determined this made the device an illegal surveillance apparatus under German telecommunications law. They ordered parents to destroy the toy (not just return it) because a returned toy could continue to be used.
In the U.S., the Campaign for a Commercial-Free Childhood filed a complaint with the FTC. The FTC did not ultimately take enforcement action against the toy makers, though it did issue guidance about internet-connected toys and COPPA compliance.
The Cayla case is not a historical anomaly. It’s a template for understanding what can go wrong when voice-connected toys are built without privacy as a design principle.
What COPPA Requires (and What It Doesn’t Guarantee)
The Children’s Online Privacy Protection Act (COPPA) has been federal law since 1998, with significant updates in 2013. It requires:
- Verifiable parental consent before collecting personal information from children under 13.
- A privacy policy that clearly explains what data is collected and how it’s used.
- Parental access to review and delete collected data.
- Reasonable security measures for protecting children’s data.
What COPPA doesn’t guarantee: that the data collected is minimal, that it isn’t shared with third parties for purposes parents wouldn’t anticipate, or that enforcement is rigorous. The FTC enforces COPPA but has limited resources relative to the number of children’s products on the market. Many COPPA violations result in settlements where companies pay fines without admitting wrongdoing and make vague promises to do better.
The Norway Consumer Council’s 2016 “Toyfair” report found that connected toys from LeapFrog, Mattel, and others had terms of service that were “almost impossible to understand” and included data sharing provisions that would alarm most parents if presented clearly.
Privacy Data on Popular Connected Toy Categories
| Toy Category | Voice Data Collected | Location Data | Third-Party Sharing | COPPA Compliance Record |
|---|---|---|---|---|
| Interactive AI dolls (e.g., post-Cayla market) | Often yes — sent to server | Sometimes via app | Frequent — analytics vendors | Mixed; FTC watch list |
| Kids’ tablets with companion apps | Usage data, voice search | No direct GPS | Often yes — ad networks | Moderate; varies by brand |
| GPS-enabled kid trackers/watches | Yes — voice calls recorded | Continuous | Varies by provider | Some violations documented |
| Educational robots (Cozmo, etc.) | Local processing only (better) | No | Minimal | Generally better record |
| App-connected board games | Minimal | No | Minimal | Generally better record |
| Smart home toys (Alexa-connected) | Full Alexa data collection | No | Amazon ecosystem | COPPA addendum exists |
Key observation: Toys that process voice locally (on-device) rather than transmitting to a server are substantially less risky from a privacy standpoint. Look for this explicitly in product specifications.
Mozilla’s Privacy Not Included Guide
Mozilla publishes a yearly guide evaluating popular connected products for privacy practices. Their methodology checks: what data is collected, whether it’s encrypted in transit, whether there’s a bug bounty program (indicating the company takes security seriously), whether the privacy policy is readable, and whether the company can be contacted about privacy issues.
Their children’s toy category consistently finds products that fail basic privacy standards. “Meets our minimum security standards” is their threshold — and not all toys clear it. The guide is free and searchable at foundation.mozilla.org/privacynotincluded.
Parent Checklist Before Buying a Connected Toy
Run through this before any connected toy purchase:
Before buying:
- Search “[toy name] privacy policy” and “[toy name] data collection” — read what comes up.
- Check Mozilla’s Privacy Not Included guide.
- Check Common Sense Media’s privacy evaluation if available.
- Ask: does this toy require an internet connection to function? If yes, why?
- Does the toy have a microphone? If yes, is audio processed locally or sent to a server?
Before setting up:
- Read the privacy policy before creating an account — specifically the data sharing and retention sections.
- Use a dedicated email address for toy accounts, not your primary family email.
- Check what permissions the companion app requests. “Access to contacts” or “access to location always” for a toy app is a red flag.
- Disable any features that aren’t needed (location sharing, personalization that requires data retention).
Ongoing:
- Review your account’s data dashboard if one exists.
- Delete the account and data when your child outgrows the toy.
- Factory-reset connected devices before donating or disposing.
What to Watch For Over 3 Months
Immediately after setup: Check the companion app’s permissions in your phone’s settings. Revoke any permissions that aren’t necessary for core function. Many apps request camera and contacts access that is not needed for the toy to work.
Month 1: Monitor your home network for unexpected data uploads, particularly from unfamiliar device names. A basic home router app will often show which devices are connected and how much data they’re sending.
Month 2: If the toy has a companion app, check for updates to the privacy policy. Companies sometimes update terms after a product launch. New terms may include data sharing provisions that weren’t in the original.
Month 3: Ask your child what the toy has said or asked them about. Children often don’t recognize that an interactive toy’s questions (“What’s your favorite food? What’s your family’s name?”) are data collection. The conversation is worth having.
Red flag: a connected toy that won’t function at all without creating an account and agreeing to a privacy policy. The requirement to consent to data collection as a condition of basic toy function is a design choice, not a technical necessity.
Frequently Asked Questions
Are connected toys regulated under COPPA if they’re sold in stores, not online?
COPPA applies to operators of websites and online services directed to children, and to operators of general-audience websites that have actual knowledge they’re collecting data from children under 13. Connected toys that require an online account or app to function are generally considered to operate an online service, bringing them under COPPA’s scope. Physical-only toys without any connectivity are not covered.
What should I do with a connected toy I already own that I’m now concerned about?
First, check the privacy settings in the companion app and disable any data collection options that are optional. Second, read the privacy policy — specifically the deletion and account closure sections. Third, if you decide to stop using the toy, delete the account through the app or website (not just uninstalling the app — you need to delete the account to remove stored data). Fourth, factory-reset the device before storing or discarding it.
How can I tell if a toy’s voice processing happens on-device vs. in the cloud?
The product specifications or privacy policy should state this — look for language like “voice processing is done locally” or “audio is sent to our servers for processing.” If it’s not stated, assume it goes to a server. Toys that work without a Wi-Fi connection typically do local processing. Toys that require internet to respond to voice commands are sending audio to a server.
My child’s school gave them a connected learning device. Does COPPA protect them there?
Schools occupy a special position in COPPA — they can consent on behalf of parents for services used for educational purposes. But this doesn’t mean the data is protected indefinitely. FERPA applies to educational records, and schools should have data processing agreements with any vendor that receives student data. Parents can ask the school for copies of these agreements.
About the author
Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.
Sources
- Federal Trade Commission. (2022). “Children’s Online Privacy Protection Rule (COPPA).” https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa
- Bundesnetzagentur (German Federal Network Agency). (2017). “Bundesnetzagentur bans ‘Cayla’ doll.” Press release. https://www.bundesnetzagentur.de/SharedDocs/Pressemitteilungen/EN/2017/17022017_Cayla.html
- Norwegian Consumer Council. (2016). “Toyfair: Connected Toys Spying on Children.” https://www.forbrukerradet.no/undersokelse/no-undersokelsekategori/toyfair/
- Mozilla Foundation. (2024). “Privacy Not Included: Holiday Buyer’s Guide.” https://foundation.mozilla.org/en/privacynotincluded/
- Common Sense Media. (2024). “Privacy Evaluations of Children’s Technology.” https://www.commonsense.org/education/privacy
- Campaign for a Commercial-Free Childhood & Center for Digital Democracy. (2016). “Complaint and Request for Investigation of Genesis Toys and Nuance Communications.” Filed with the FTC.
- U.S. Federal Trade Commission. (2019). “$5.7 Million FTC Settlement with Musical.ly.” https://www.ftc.gov/news-events/news/press-releases/2019/02/video-social-networking-app-musically-agrees-settle-ftc-allegations-it-illegally-collected-personal
