Internet-connected toys raise privacy concerns

A new analysis by University of Washington (UW) researchers finds that kids are unaware of their Wi-Fi-enabled toys' capabilities, and parents have numerous privacy concerns.

The study explores the attitudes and concerns of both parents and children who play with toys connected to the internet, which can joke around with children and respond in surprising detail to questions posed by their young users, and record the voices of children who interact with them and store those recordings in the cloud, helping the toys become "smarter."

Through a series of in-depth interviews and observations, the researchers found that kids didn't know their toys were recording their conversations, and parents generally worried about their children's privacy when they played with the toys.

"These toys that can record and transmit are coming into a place that's historically legally very well-protected - the home," said Emily McReynolds, associate director of the UW's Tech Policy Lab and co-lead author of the study presented this week at the CHI 2017 Conference on Human Factors in Computing Systems. "People have different perspectives about their own privacy, but it's crystalized when you give a toy to a child."

The researchers conducted interviews with nine parent-child pairs, asking each of them questions ranging from whether a child liked the toy and would tell it a secret to whether a parent would buy the toy or share what their child said to it on social media. They also observed the children, all aged 6 to 10, playing with Hello Barbie, a doll that records and analyzes children's private conversations, and CogniToys Dino, a Wi-Fi-enabled smart toy Dinosaurs that claims to "learn and grow with children."

These toys were chosen for the study because they are among the industry leaders for their stated privacy measures. Hello Barbie, for example, has an extensive permissions process for parents when setting up the toy, and it has been complimented for its strong encryption practices.

Most parents were concerned about their child's privacy when playing with the toys. They universally wanted parental controls such as the ability to disconnect Hello Barbie from the internet or control the types of questions to which the toys will respond. The researchers recommend toy designers delete recordings after a week's time, or give parents the ability to delete conversations permanently.

At minimum, the researchers said, toy designers should create a way for the devices to notify children when they are recording, such as having Hello Barbie say, "I'll remember everything you say to me" instead of a red recording light that might not make sense to a child in that context.

The researchers hope this initial look into the privacy concerns of parents and kids will continue to inform both privacy laws and toy designers, given that such devices will only continue to fill the market and home. Endit