Can Privacy Regulations Outsmart Smart Toys?

The experience of perusing a toy aisle today often involves seeing shelves filled with toys that can listen and respond to their child owners—blurring the lines between reality and the movie, Toy Story. As the technology in toys becomes more sophisticated, children become increasingly vulnerable to cyber home invasion via their internet-connected smart toys. In this brave new toy world, parents and guardians show concern about the privacy and safety of their children. Smart toys typically can connect to the internet, link to an app, and communicate using a microphone and speaker. For many parents and guardians, purchasing smart toys for their children causes some level of caution or apprehension. Mainstream smart toys such as Hello Barbie—a doll brought to life by artificial intelligence software and hooked up to an app—risk being hacked. Because smart toys connect directly to the internet, these intelligent toys can endanger kids by involuntarily disclosing their private information. The Federal Bureau of Investigation (FBI) released a public service announcement warning of the security risks that accompany smart toys, including the collection of sensitive data. The FBI encourages owners of these devices to take their own protective measures, which include researching the toy manufacturer’s policies prior to purchase. The Children’s Online Privacy Protection Act of 1998 (COPPA), enforced by the Federal Trade Commission (FTC), regulates online services for children under 13 years old, including those that garner personal information from kids. COPPA requires providers to obtain parental consent before collecting data and if data are collected from a child user, to keep data secure. The FTC first cracked down on a smart toy COPPA violation in 2018 when an electronic toy company accumulated data from children without parental consent. Since then, many advocates for privacy have pushed for more transparency from companies manufacturing smart toys, particularly when it comes to what kind of data manufacturers collect and whether users can delete that accrued data later. Because smart toys are here to stay, there is room for significant regulatory action to protect children at play. In this week’s Saturday Seminar, scholars explore how privacy regulations around children’s smart toys intersect with company responsibility, user vulnerability, data sharing, and ethics