OCU warns of serious security flaws in toys with internet connectivity

As noted in a study carried out by the Norwegian Consumers Council (Forbrukerradet), there are currently two toys with internet connectivity features, the “Cayla” doll and the “i-Que” robot, which have worrying flaws with regards to security and privacy for the children these toys are directed at.

This study has proven that, following a few simple steps, anyone can take control of these two toys and are able to speak and record conversations using only a simple mobile telephone. This makes it possible to speak and listen to others without needing to have physical access to the toys. (https://www.youtube.com/watch?v=lAOj0H5c6Yc&feature=youtu.be.)

Moreover, Forbrukerradet has shown that anything a child says to the toy is transmitted to Nuance Communications, an American company specialised in voice-recognition technologies. This company reserves the right to use and share this information with third parties for a wide range of purposes. 

Furthermore, the study points out the fact that these toys come pre-programmed with a set of specific phrases which advertise various commercial products.  For example, the “Cayla” doll tells children how much she likes specific movies. These animated feature films are produced by specific American studios with which the application’s provider has a commercial relationship.

In addition to all this, an analysis of the terms and conditions the users must accept has found illegal clauses such as, for example, one which states that the terms and conditions may be changed without prior warning, another stating that personal information may be used for specific advertising purposes and, finally, a clause allowing the personal information gathered to be shared with unidentified third parties. 

In the opinion of OCU and the other organisations which comprise the European Consumers Organisation (BEUC), these discoveries, in addition to others, are a clear violation of the European regulations regarding the protection of both personal information and consumers. Serious questions are raised as to the security and safety of these toys.  For these reasons, OCU is asking Spanish authorities to investigate these facts and to take any and all measures needed to ensure the safety and privacy of minors.