The Electronic Privacy Information Center, The Campaign for a Commercial Free Childhood, The Center for Digital Democracy, and Consumers Union have filed a complaint with the Federal Trade Commission (FTC) against Genesis Toys and Nuance Communications for what they termed a violation of both specific children’s privacy and general consumer protections in the United States.

Specifically, the complaint concerns what the privacy groups referred to as “toys that spy.”

“By purpose and design, these toys record and collect the private conversations of young children without any limitations on collection, use, or disclosure of this personal information,” the group wrote. The toys subject young children to ongoing surveillance and are deployed in homes across the United States without any meaningful data protection standards, wrote the privacy groups. They pose an imminent and immediate threat to the safety and security of children in the United States.

Just like every other thing, toys are becoming more intelligent and connected following the advent of the internet of things. Data from industry association shows that U.S. domestic toy sales reached approximately $22 billion in 2014, and has continued to grow since then.

Advancements in sensor, chips and cloud technology have broadened the horizon on what toys can offer, compared to what obtained in the past.

This change in interaction between consumers and manufacturers enables the manufacturers leverage current technology to collect large volumes of data in real time for various purposes, including fine-tuning their marketing efforts.

According to the privacy groups, certain business practices by toy manufacturer Genesis Toys and speech recognition technology provider Nuance Communications violate both specific children’s privacy and general consumer protections in the United States.

Both Genesis Toys and Nuance Communications unfairly and deceptively collect, use, and disclose audio files of children’s voices without providing adequate notice or obtaining verified parental consent in violation of the Children’s Online Privacy Protection Act (COPPA), the COPPA Rule, and Section 5 of the Federal Trade Commission Act.

The privacy groups said it is “incumbent” upon the FTC to take action in this matter, and to enjoin GenesisToys and Nuance Communications from such unlawful activities.

Genesis markets and sells a variety of connected children’s toys, including My Friend Cayla (Cayla) and i-Que Intelligent Robot (i-Que). Cayla and i-Que are internet-connected toys that talk and interact with children by capturing and recording children’s communications and analyzing the recordings to determine the words spoken.

These voice recordings are stored and used for a variety of purposes beyond providing for the toys’ functionality.

There are two components to the Cayla and i-Que toys: a physical doll and a companion mobile application. The physical doll contains a Bluetooth microphone and speaker, and the companion app provides the data processing to facilitate the toy’s ability to capture the private communications of children. Before playing with toys, users are required to download the Cayla and/or i-Que application on a mobile device, to which the doll connects using Bluetooth technology.

Researchers discovered that My Friend Cayla is pre-programmed with dozens of phrases that reference Disneyworld and Disney movies. For example, Cayla tells children that her favorite movie is Disney’s The Little Mermaid and her favorite song is “Let it Go,” from Disney’s Frozen. Cayla also tells children she loves going to Disneyland and wants to go to Epcot in Disneyworld.

This product placement is not disclosed and is difficult for young children to recognize as advertising. Studies show that children have a significantly harder time identifying advertising when it’s not clearly distinguished from programming.

The Cayla companion application includes a section titled “Child’s information” that prompts children to submit personal information to complete the following statements:

  • My Name is;
  • My Mom’s name is;
  • My Dad’s name is;
  • My favorite TV program is;
  • My favorite meal is
  • I go to school at;
  • My favorite princess is;
  • My favorite toy is; and
  • The place I live in is called.

The Cayla application also invites children to set their physical location. According to the Privacy Policy for Cayla and i-Que, Genesis collects users’ IP addresses.

Nuance is a third party software provider to Genesis Toys, which uses Nuance’s voice recognition technology for its My Friend Cayla and i-Que applications.

According to the Terms of Service for both Cayla and i-Que, “When you ask the App a question, this information request is stored on a Nuance Communication or IVONA server in the cloud. Collectively, Nuance and IVONA are our third party software partners (collectively ‘Licensor(s)’).” Confusingly, the Cayla Privacy Policy indicates this information is stored on “a Nuance Communication (for Apple-based users) or Google (for Android/Google based users) server in the cloud.”

The i-Que Privacy Policy makes no reference to such information collection. Researchers found that both Apple and Android apps for Cayla upload data to the same IP address, 205.197.192.116, which is located in Burlington, Massachusetts, the same city where Nuance is headquartered. Geolocation data confirms that IP address 205.197.192.116 belongs to Nuance.

Researchers observed that the data was sent while the app was recording the speech, and the size of the data sent indicated that the files being uploaded were sound files. The Cayla and i-Que Terms of Service state that Genesis and Nuance use speech data, including audio files and text transcriptions, to enhance and improve the services for the toys and for other services and products.

The Nuance Privacy Policy states:

[W]e may use the information that we collect for our internal purposes to develop, tune, enhance, and improve our products and services, and for advertising and marketing consistent with this Privacy Policy. By using Nuance products and services, you acknowledge, consent and agree that Nuance may collect, process, and use the information that you provide to us and that such information shall only be used by Nuance or third parties acting under the direction of Nuance, pursuant to confidentiality agreements, to develop, tune, enhance, and improve Nuance services and products.

Nuance services and products include voice biometric solutions sold to military, intelligence, and law enforcement agencies.

Nuance Communications issued a statement via a blog post defending their actions. “Today a number of news articles were published concerning a complaint filed by certain consumer protection groups with the U.S. Federal Trade Commission (FTC) related to data privacy, and specifically related to what information is being collected from children through voice-enabled toys manufactured by one of our customers,” wrote the company.

“Upon learning of the consumer advocacy groups’ concerns through media, we validated that we have adhered to our policy with respect to the voice data collected through the toys referred to in the complaint; and, Nuance does not share voice data collected from or on behalf of any of our customers with any of our other customers.”

The Norwegian Consumer Council also filed a similar complaint in Europe, in addition to producing a video explaining the issues associated with use of the toys.