How “smart toys” spy on your children
“Toniebox”, “Tiptoi” and “Tamagotchi” are so-called smart toys that enable interactive play thanks to software and internet access. However, some of these toys lack privacy protection and sometimes collect extensive behavioural data from children and parents.
Source: Tim Sumpf, Epochtimes, 10 September 2024
The “Toniebox” and the associated figures are particularly popular among the youngest children and it is hard to imagine a children’s rooms without them. Much easier to use than traditional music players, they allow children to independently switch on music and audio at any time.
To start the story of the robber Hotzenplotz by Otfried Preußler, for example, children have to place the plastic version of the main character on the box. If the child wants to stop the story, they take the figure down. To rewind and fast-forward, they tilt the box to the left or right.
A great product, many parents probably think. However, the Toniebox registers exactly when it is activated with which figure, when the child stops and where it rewinds to – and sends the data to the manufacturer.
Focus on common toys
The Toniebox is one of twelve smart toys that the researchers led by Professor Dr Isabel Wagner from the University of Basel examined. They also included other well-known toys such as the Tiptoi learning pen and its optional charging station, the “Edurino” learning app and the Tamagotchi virtual pet.
Twelve smart toys were the focus of the study, including Toniebox (purple with figure, centre back) and Tamagotchi (pink/light green/light blue, front left). Photo: Céline Emch/University of Basel
The scientists also analysed lesser-known toys such as the so-called Moorebot, a mobile robot with a camera and microphone, and Kidibuzz, a smartphone for children with a parental control function.
The focus of the analysis was on security issues, such as if and how well data traffic is encrypted. It also looked at data protection, transparency – i.e. how easily users can request insight into the data collected about them – and compliance with the European General Data Protection Regulation.
Collect offline, send online
According to the study, the Toniebox and Tiptoi charging station perform poorly in terms of security, as they do not encrypt data traffic securely. The researchers also recognise shortcomings in the Toniebox when it comes to protecting privacy, as it collects data and sends it to the manufacturer. The Tiptoi pen, on the other hand, does not record how and when a child uses it. It only downloads audio files for the products purchased.
Even if the Toniebox was operated offline and only temporarily connected to the internet when loading new audio content, the device could store collected data locally and send it to the manufacturer at the next opportunity, Isabel Wagner speculates.
None of the toys tested are safe in terms of data protection. Photo: Feldbusch et al. (2024) in Privacy Technologies and Policy
“In another toy that we are currently investigating and that has ChatGPT integrated, we see that log data regularly disappears,” says Prof Wagner. The researchers suspect that the system is set up in such a way that it deletes the sent data locally in order to make optimum use of the internal memory.
Companies often claim that the collected data helps them optimise their devices. However, users can hardly foresee what else the data could be used for. “Companion apps for some toys demand completely unnecessary access rights, such as to the smartphone’s location or microphone,” the researcher notes.
And the ChatGPT toy, which is currently still being analysed, sends a data stream that looks like audio data. The professor of cyber security suspects that the company may want to use this to optimise speech recognition of children’s voices.
A label for data protection
“Children’s privacy is particularly deserving of protecting,” emphasises Julika Feldbusch, lead author of the study. Toy manufacturers should therefore prioritise the privacy and security of their products in line with their young target group more than they have done so far.
The researchers recommend that compliance with safety and data protection standards should be labelled on the packaging, similar to nutritional information on food. So far, it has been too difficult for parents to understand the safety risks associated with smart toys for their children.
An old Tamagotchi from the 2000s – still without an internet connection. Photo: Gorlov/iStock
“We are already seeing signs of a two-tier society when it comes to protecting children’s privacy,” says Feldbusch. “Well-informed parents deal with this and can choose toys that don’t create behavioural profiles of their children. But many lack the technical knowledge or don’t have the time to look into it in depth.”
Although it can be optimistically assumed that children will not suffer any negative consequences in individual cases if toy manufacturers create profiles of them, there are still doubts. “We don’t really know for sure. Comprehensive monitoring can have a negative impact on personality development, for example,” concludes Isabel Wagner.
Epoch Times asked the toy manufacturers for comment.
The study was published on 1 August 2024 in the journal “Privacy Technologies and Policy”.
