In December, consumer groups filed complaints about two talking toys: the I-Que Intelligent Robot and My Friend Cayla doll, which send personal information collected from children to a company that contracts with the US military and intelligence agencies. The companies shared the data without parents' consent, violating the Children’s Online Privacy Protection Act, the complaints alleged.
In response, a bill aimed at protecting children against eavesdropping toys and other home gadgets is now moving through the California state legislature. Authored by Democratic State Senator Hannah-Beth Jackson of Santa Barbara, the bill is intended to ensure consumer security, especially when it comes to children's toys and home devices.
"I embrace California’s role as a technological innovator," Jackson told reporters on a call Thursday. "But I'm concerned when [companies] advance without adequate disclosures, consumer information, safeguards, and knowledge of what the potential is with each of these devices."
The law would require devices to indicate when they are collecting information and to obtain consumer consent before they collect or transmit information.
While some specifics will be left up to manufacturers — "since technology changes so quickly and they know the industry," Jackson said — the senator said she expects the bill would lead to increased password protections against hacking and additional requests for consent prior to collecting information like location.
Jim Steyer, CEO of Common Sense Media, a children's advocacy group, told reporters on the call that both he and the senator have high opinions of the tech industry in California.
"We respect these companies — I know them well at the CEO level," he said, "but sometimes we disagree with them because they build products without respecting the rights of consumers."
Both the Cayla and the Intelligent Robot dolls pair with smartphone apps. The Cayla doll uses voice recognition technology to communicate with a child, but only after requiring the child to answer questions including their name, their parents’ names, their school, their hometown, and their physical location. The Intelligent Robot also has the ability to access and activate the smartphone camera, according to complaints.
The maker of both devices, Genesis Toys, did not immediately respond to a request for comment.
Steyer named the Fisher Price Smart Bear as another example of a toy with security vulnerabilities that would allow hackers to obtain a child’s name, birthdate and gender, along with other data. After the risk came to light, Fisher Price patched the flaw, the company said.
"The industry’s focus has been on the technology and not on its consequences," said Sen. Jackson. "Our job as policy makers to make sure those considerations are included as well."