My Friend Cayla, similar toys may not be your child’s best friend

Germany bans internet-linked dolls over fears that privacy could be compromised

Share on FacebookShare on Google+Tweet about this on TwitterShare on LinkedInEmail this to someonePrint this page

Ger­many has tak­en steps to allay con­cerns about how the “Inter­net of Toys” could put chil­dren in harm’s way.

This past Decem­ber, con­sumer groups con­cerned with child safe­ty peti­tioned the Fed­er­al Trade Com­mis­sion to look into a hot new doll, named My Friend Cay­la, and its coun­ter­part mar­ket­ed to boys, i-Que Intel­li­gent Robot. Pri­va­cy advo­cates expressed con­cern about the dolls’ capac­i­ty to spy on children.

Relat­ed video: As Inter­net of Things expands, so do risks

And now Ger­man author­i­ties have banned these two inter­net-con­nect­ed toys on grounds that they “sub­ject young chil­dren to ongo­ing sur­veil­lance … and pose an immi­nent and imme­di­ate threat to the safe­ty and secu­ri­ty of children.”

Ger­man author­i­ties warned par­ents not to allow Cay­la or i-Que in their homes.

The Bun­desnet­za­gen­tur has tak­en action against unau­tho­rized wire­less trans­mit­ting equip­ment in a children’s toy and has already removed prod­ucts from the mar­ket,” the agency said in a state­ment attrib­uted to Bun­desnet­za­gen­tur Pres­i­dent Jochen Homann. Bun­desnet­za­gen­tur is the Ger­man reg­u­la­to­ry office for elec­tric­i­ty, gas, telecom­mu­ni­ca­tions, post and rail­way markets.

Ger­many warns of spying

Items that con­ceal cam­eras or micro­phones “are capa­ble of trans­mit­ting a sig­nal and, there­fore, can trans­mit data with­out detec­tion and com­pro­mise people’s pri­va­cy. This applies in par­tic­u­lar to children’s toys. The Cay­la doll has been banned in Ger­many,” Homann said.

The state­ment con­tin­ued: “Any toy that is capa­ble of trans­mit­ting sig­nals and that can be used to record images or sound with­out detec­tion is banned in Ger­many. The first toys of this type have already been tak­en off the Ger­man mar­ket at the insti­ga­tion of the Bun­desnet­za­gen­tur and in coop­er­a­tion with distributors.

There is a par­tic­u­lar dan­ger in toys being used as sur­veil­lance devices: Any­thing the child says or oth­er people’s con­ver­sa­tions can be record­ed and trans­mit­ted with­out the par­ents’ knowl­edge. A com­pa­ny could also use the toy to adver­tise direct­ly to the child or the par­ents. More­over, if the man­u­fac­tur­er has not ade­quate­ly pro­tect­ed the wire­less con­nec­tion (such as Blue­tooth), the toy can be used by any­one in the vicin­i­ty to lis­ten in on con­ver­sa­tions undetected.”

The Ger­man agency put oth­er toy­mak­ers on notice that their con­nect­ed toys would be sub­ject to review, too.

The toy­mak­er, Gen­e­sis Toys, did not respond to email queries for com­ment. In Decem­ber, U.S. con­sumer groups asked the Fed­er­al Trade Com­mis­sion to inves­ti­gate My Friend Cay­la and i-Que.

Prod­uct safe­ty is no longer just about a small toy that you are afraid your kid will choke on,” said Jef­frey Chester, exec­u­tive direc­tor of the Cen­ter for Dig­i­tal Democ­ra­cy, at the time. “It’s about how the prod­ucts are designed and what they might be doing with your children’s information.”

Blue­tooth is conduit

Cay­la and i-Que engage in sim­u­lat­ed con­ver­sa­tions with chil­dren. They use Blue­tooth to con­nect to smart­phones and gain access to the internet.

A child’s state­ments are con­vert­ed into text, which is then used by the appli­ca­tion to retrieve answers using Google Search, Wikipedia and Weath­er Under­ground,” the com­plaint says.

The toys are avail­able from many U.S. retail­ers. On one prod­uct page, they are described as appro­pri­ate for chil­dren rang­ing from age 3 to 12.

Via speech recog­ni­tion tech­nol­o­gy, Cay­la can under­stand and respond to your child in real-time about almost any­thing,” the page says. “She can tell sto­ries, play games, share pho­tos from her pho­to album, and can sing, too. She can even help your child with their home­work questions.”

U.S. agency asked to act

The con­sumer groups—including the Elec­tron­ic Pri­va­cy Infor­ma­tion Cen­ter, The Cam­paign for a Com­mer­cial Free Child­hood, and Con­sumers Union—claim that the devices record children’s con­ver­sa­tions “with­out any lim­i­ta­tions on col­lec­tion, use or dis­clo­sure” of the per­son­al information.

They say the Gen­e­sis toys vio­late the Child Online Pro­tec­tion Act, and the Fed­er­al Trade Com­mis­sion should step in immediately.

Gen­e­sis Toys claims that My Friend Cay­la has amassed over 1 mil­lion fans world­wide, accord­ing to the complaint.

The com­plaint alleges that the toys ask for per­son­al infor­ma­tion, such as par­ents’ names, favorite TV show, school name, and home city. The Gen­e­sis pri­va­cy policy—only avail­able as a pop-up when down­load­ing an app—says all data can be stored and shared with cer­tain third par­ties, accord­ing to the complaint.

The con­sumer groups also say the toys don’t employ basic Blue­tooth secu­ri­ty, such as requir­ing a pair­ing code.

As a result, when the Cay­la and i-Que dolls are pow­ered on and not already paired with anoth­er device, any smart­phone or tablet with­in a 50-foot range can estab­lish a Blue­tooth con­nec­tion with the dolls,” it says. That opens the door to strangers in close prox­im­i­ty being able to use the doll to con­nect with the child using it, the groups allege.

More sto­ries relat­ed to pri­va­cy and the Inter­net of Things:
Who’s lis­ten­ing? Pri­va­cy ques­tions echo across the Inter­net of Things
Why more attacks lever­ag­ing the Inter­net of Things are inevitable
Samsung’s SmartTV fore­shad­ows Inter­net of Things eavesdropping

Posted in Cybersecurity, Data Privacy, Featured Story