Hello,

We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Connectivity

Connected Toys Are Raising Complicated New Privacy Questions

Toys and other devices are collecting loads of data from children. What could go wrong?

Talking toys have come a long way since the original Furby. Now they’re connected to the Internet, use speech recognition, and are raising a host of new questions about the online privacy and security of children.

Hackers have already targeted toys. Late last year, Hong Kong-based digital toy maker Vtech admitted that cybercriminals accessed the personal information of 6.4 million children. Researchers have also shown how hackers can gain control of connected dolls. But a number of the privacy-related challenges raised by connected toys are novel. They are collecting new kinds of data, and what’s at stake if something goes wrong is not always clear.

Two of the most prominent examples of the new generation of toys are the Dino, a cloud-connected, Wi-Fi-enabled plastic dinosaur that uses speech recognition technology and IBM’s Watson to “listen” and respond to a child’s words, and Mattel’s Hello Barbie, which also uses speech recognition and uploads voice recordings to the cloud. Both work in way that’s similar to the way virtual assistants like Apple’s Siri and Amazon’s Alexa work.

They’re regulated by a law that now looks outdated. In 1998, the U.S. enacted the Children’s Online Privacy Protection Act, or COPPA, to protect young children from the risks of sharing personal information online. The Federal Trade Commission enforces COPPA, which is designed to give parents control over their children’s data. But some privacy advocates and policymakers argue that COPPA is not clear enough in some cases, given the wide and growing range of technological capabilities of today’s toys.

The Dino, made by a startup called Elemental Path, records what children say and uses IBM’s Watson to respond.

Technically, COPPA applies to online services “directed to children under 13 that collect, use, or disclose personal information from children.” That clearly includes toys like the Dino and Hello Barbie. But should it also apply to other applications like Siri and Alexa, or other data-collecting online services that are popular with children even though they are not exclusively directed at them?

Earlier this month, Virginia Senator Mark Warner sent a letter to the FTC expressing concern over the increasing collection of children’s personal information by apps and toys, and to ask for clarification about how the FTC will enforce COPPA in this environment. “While Congress may have had an inkling of the future growth of web-services in 1998,” Warner wrote, “it certainly did not envision the array of conventional household products that now possess data gathering and processing capabilities.” He asked the commission to clarify how it determines whether a device, website, or app is directed at children. The FTC has not yet responded.

Another set of big questions hovers around consent. Under COPPA, companies must get “verified consent” from a child’s parent before collecting personal information from that child. But getting that consent for connected toys can be much trickier than when Internet just meant browsers and websites.

One of the biggest challenges is that new connected toys and devices often feature small, limited, or disconnected user interfaces, if they have them at all, former FTC commissioner Julie Brill said at a discussion this week in Washington, D.C., focused on children’s online privacy. Brill, now a partner at a D.C. law firm, served as an FTC commissioner from 2010 until last March.

The Dino and Hello Barbie come with applications that parents can use to adjust settings and provide consent to data collection. But what happens when another child comes over, or the child takes the toy to school? Technically it can’t record other children until their own parents give consent as well, said Brill. This will be an “interesting challenge,” and companies will have to come up with creative new ways to get this consent, she said. For example, future products may be able to use voice recognition—not just speech recognition—to identify specific people and refrain from recording those who have not consented.

Finally, thorny ethical dilemmas could arise, especially if young children choose to share very sensitive things. What exactly should a company do when it records a four-year-old saying she’s been abused? Notify the police? What if it’s not true? Questions like these are challenging, but as connected toys and other listening devices become more popular we’ll probably need to answer them.

Tech Obsessive?
Become an Insider to get the story behind the story — and before anyone else.

Subscribe today
The Dino, made by a startup called Elemental Path, records what children say and uses IBM’s Watson to respond.
More from Connectivity

What it means to be constantly connected with each other and vast sources of information.

Want more award-winning journalism? Subscribe and become an Insider.
  • Insider Plus {! insider.prices.plus !}* Best Value

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Bimonthly print magazine (6 issues per year)

    Bimonthly digital/PDF edition

    Access to the magazine PDF archive—thousands of articles going back to 1899 at your fingertips

    Special interest publications

    Discount to MIT Technology Review events

    Special discounts to select partner offerings

    Ad-free web experience

  • Insider Basic {! insider.prices.basic !}*

    {! insider.display.menuOptionsLabel !}

    Six issues of our award winning print magazine, unlimited online access plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

    Bimonthly print magazine (6 issues per year)

  • Insider Online Only {! insider.prices.online !}*

    {! insider.display.menuOptionsLabel !}

    Unlimited online access including articles and video, plus The Download with the top tech stories delivered daily to your inbox.

    See details+

    What's Included

    Unlimited 24/7 access to MIT Technology Review’s website

    The Download: our daily newsletter of what's important in technology and innovation

/3
You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.