Tech toys have become popular holiday gifts. Many are interactive; some even claim educational benefits. But one such toy has privacy advocates very worried this year.
It's called My Friend Cayla. It's a doll and looks pretty much like most dolls do. She is available in various skin tones and hair colors, and according to her website, she is the smartest toy you'll ever have.
But My Friend Cayla also has some issues. She sings, talks and listens — maybe a little too well.
"We're very concerned about the fact that these dolls are essentially spying on your kids' private conversations," says Claire Gartland, director of the Consumer Privacy Project at the Electronic Privacy Information Center, a Washington nonprofit that advocates for consumer privacy.
The problem with Cayla, Gartland says, is that everything a child tells the doll can be recorded, in the guise of having an interactive conversation.
Ask her, say, "Can I tell you a secret?" And the doll responds: "Sure go ahead; be very quiet, though. I promise not to tell anyone; it's just between you and me because we are friends."
But Gartland says anything that's said to Cayla isn't really secret at all. If the doll is connected to a smartphone — as it's designed to be — that information can be sent to the toy's makers.
"There's all kinds of intimate details of their personal life, their parents' personal lives. We know how kids at younger ages don't necessarily have the same social filter," Gartland says, "so these children could be chattering on about anything, really."
Gartland says the conversations that Cayla records are sent to servers at a company called Genesis, which makes the doll, and to another company called Nuance, which makes voice-recognition software for this any many other products. Nuance also has a database used by law enforcement and military and intelligence agencies that matches voiceprints.
In a blog post, Nuance says it does not share voice data collected from its customers with any of its other customers. Genesis did not return calls for comment.
Gartland says parents are not being sufficiently notified of My Friend Cayla's capabilities, "and more importantly they're not consenting to this, and that's where some of our legal regulations come into play."
The Children's Online Privacy Protection Act requires companies that collect and use private information from children age 12 and younger to notify their parents and get permission first.
Copyright 2016 NPR. To see more, visit http://www.npr.org/.
