Be smart with smart toys – know when to pull the plug

Buyers beware

December 11, 2018 – OTTAWA, ON – Competition Bureau

Your kids are playing with a new doll they received for the holiday season. The instructions tell you to connect the toy to the Internet using an app… so you do. Your kids start playing with the doll, talking to it, playing house, maybe even talking about going on a trip. Suddenly, your smartphone lights up with advertisements for travel packages and services. What possibly could have happened?

By connecting the toy to the Internet, you may be giving your kids a fun interactive experience. You may also be unknowingly or involuntarily giving up some personal information. The toy may be listening in on your kids and picking up cues, which are then used to push targeted ads to your smartphone or tablet.

Whether it’s a talking doll, a stuffed animal or a robot, connected toys have a variety of capabilities as they are commonly equipped with microphones, speakers, cameras and location tracking technology. A connected toy could put the privacy and possibly even the security of your kids and family at risk, as they collect and use personal information that includes names, birthdates, address, conversation recordings, physical location, and more.

What information is collected, how it is used and how it is disposed of is not always disclosed properly on packaging or in advertising materials. It may be used by the toy manufacturer, or third parties, for advertising purposes. That could be considered deceptive marketing and would raise concerns for the Bureau.

Before you rush out to purchase one of these toys, the Competition Bureau and its law enforcement partners want you to be aware of some of the risks to your children and family:

Hidden marketing: certain toys need to be connected to the parent’s smartphone or tablet through an app. While these toys listen and interact with your kids, they may pick up on key words that will be used to push more targeted advertising to your device.

Undisclosed product placement: connected toys are sometimes pre-programmed to say certain phrases - some of which may promote a product, business or service.

Misleading terms and conditions: certain toys and related apps require that parents agree to terms and conditions that may be difficult to read, unclear or misleading. The terms and conditions might also not include all the information you need to know.

Intrusive terms and privacy policies: the terms of use and privacy policies can be changed at any time, and they can include terms that allow the toy manufacturer to share your information with third parties without notice.

Inadequate security: with toys connected to the Internet, personal information about your kids and your family could be accessed by hackers and other cybercriminals if they are not properly secured.

Here are some tips for those who may wish to purchase or use connected toys:

• Research the toy for any known risks or issues.
• Carefully read the terms and conditions associated with the use of the toy.
• Research the toy manufacturer and buy from recognized, trusted brands.
• Learn how the toy works.
• Understand what information will be collected, used, stored and who has access to it. 
• Use only trusted and secured Internet networks.
• Change the toy manufacturer’s default username and password. Use strong passwords. 
• Ensure the toy is kept up to date with security updates or patches.
• Monitor your kids’ activities when they’re playing with the toy. Turn it off when it’s not in use and disconnect it for added security.
• Learn how to delete your child’s personal information in case the toy gets lost or discarded.

Report hidden marketing and misleading terms and conditions to the Competition Bureau (1-800-348-5358). Report cybersecurity concerns to the Canadian Anti-Fraud Centre (1-888-495-8501) or the RCMP.