Researchers warn smart toys collect child behavioral data without proper security
University of Basel researchers studied 12 smart toys and reported that several collect and transmit children's behavioral data without secure encryption or transparent privacy practices. The Toniebox was found to record detailed interaction patterns and send the data to the manufacturer, raising concerns about compliance with data protection regulations.
What happened
Researchers at the University of Basel, Switzerland studied 12 smart toys including Toniebox, Tiptoi smart pen, Edurino learning app, Tamagotchi virtual pet, Moorebot mobile robot, and Kidibuzz children's smartphone and found breaches of security and privacy.
The Toniebox records when it is activated and by which figurine, when the child stops playback, and to which spot they rewind or fast-forward, then transmits this data to the manufacturer.
Neither the Toniebox nor the Tiptoi pen securely encrypt data traffic, though the Tiptoi pen does not record how and when a child uses it, while the Toniebox collects and sends data to the manufacturer.
Reported impact
The toys collect extensive behavioral data about children in breach of privacy and security.
Index analysis
The study examined security through data traffic encryption, data protection, transparency of data collection, and compliance with the EU General Data Protection Regulation.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.