Talking dolls, toys with microphones, and kids' smartwatches send what they hear and see to servers. The scope of what's collected should concern every parent.
What Children's Connected Devices Actually Collect
Children's connected devices occupy a uniquely sensitive privacy position: they collect data about minors, often in the home, with parents who rarely read the terms of service.
Voice-activated toys:
Everything said within range, sent to cloud servers for processing
Voice recordings sometimes retained indefinitely
In some documented cases, conversations beyond the activation keyword were capturedKids' smartwatches with GPS:
Real-time location
Call and message history
Biometric data (heart rate, activity)
Voice recordings from two-way callingEducational tablets and apps:
Browsing behavior and app usage
Drawing and writing samples (used to improve handwriting AI)
Learning progress — granular data on what a child struggles with
In some cases, photographs and videosSmart baby monitors with cameras:
Video feeds
Sleep patterns and movement data
Audio from the child's roomThe Security Track Record Is Poor
Children's connected devices have a documented history of security failures:
VTech (2015): 6.3 million children's profiles and 4.8 million parent accounts exposed, including photos and chat logs
CloudPets (2017): Voice messages between children and parents exposed in an unsecured database
Multiple kids' smartwatch brands (2019): Researchers demonstrated they could track children's locations and intercept calls without parental knowledge
Amazon Echo recordings of children have been retained and used for Alexa training without clear parental consentWhat Parents Should Do Before Buying
Check COPPA compliance — in the US, devices targeting under-13 must comply with the Children's Online Privacy Protection Act. Look for this in the product description.
Search the product name + "security" or "breach" before buying
Check whether voice recordings are retained — and whether you can delete them
Look for local processing — some devices process voice locally rather than sending it to the cloudWhat to Do With Devices You Already Have
Disable voice activation when not in use if the device has this option
Review and delete stored data in the manufacturer's app or account
Put connected toys on your IoT network, not your main Wi-Fi
Set network-level rules to prevent the device from calling home when it doesn't need to (your router's parental controls or firmware can help)The Baby Monitor Question
Baby monitors with internet connectivity have been accessed by strangers more times than is comfortable to contemplate. If you use a connected baby monitor:
Change the default password immediately to something strong and unique
Enable two-factor authentication if available
Use a model with end-to-end encryption
Turn it off when not actively neededBottom Line
Children's connected devices collect data you'd be uncomfortable with if you read the fine print carefully. Apply the same IoT security principles here as anywhere else — separate network, unique password, and skepticism about any feature that requires a cloud account.
