In March 2015, there was growing concern over privacy issues related to collecting data via “smart toys.” At that time, Mattel had just released its newest Barbie, “Hello Barbie,” which contained an embedded microphone in the doll’s belt to record a child’s response to the doll’s questions. The child’s responses were sent back to Mattel through the doll’s WiFi capabilities. Mattel claimed the voice-recognition software and recording capabilities would allow the doll to learn to respond to the child’s statements and even learn the family dog’s name or other topics a child would enjoy discussing. In explaining the doll’s capabilities, Mattel Senior Vice President of Global Communications stated “[t]he number one request we receive from girls globally is to have a conversation with Barbie, and with Hello Barbie we are making that request a reality.”

At the time, there were concerns regarding how Mattel and other toy manufacturers would use the data collected from their toys. Angela Campbell from Georgetown University’s Center on Privacy and Technology warned, “[i]f I had a young child, I would be very concerned that my child’s intimate conversations with her doll were being recorded and analyzed.”

There were also concerns beyond what the toy manufacturers would do with the information. This data held by toy manufacturers could be a prime target for hackers. Privacy concerns were based on the fact that children and adolescents are the fastest growing sector of identity fraud victims. It has been widely accepted that children are targeted because they have good credit reports and their credit histories may not be reviewed for years until they apply for student loans or their first loans.

Unfortunately, this concern has become a reality since the introduction of “Hello Barbie.” On December 1, 2015, VTech Holdings Ltd., a manufacturer of digital toys and telephones, reported it suffered a data breach on November 14, 2015. VTech reported this breach involved “child profile information,” including the name, gender and birth date of the child. The “unauthorized party” gained access to information stored as part of VTech’s “Learning Lodge” app store on the company’s website.

The concerns over “Hello Barbie” and other smart toys were further validated when on September 13, 2016, the New York State Attorney General settled matters with Viacom, Mattel, Hasbro and JumpStart related to the use of tracking technology on their toys and websites. The settlement included an agreement by the toymakers to pay a combined $835,000 in fines for tracking and collecting personal data of children online in violation of the Children’s Online Privacy Protection Act.

In response to the settlement, Hasbro’s spokesperson said, “[w]e are rolling out a new, stricter online privacy protection policy for our partners, and enacting new protocols and technology to scan our digital properties for any cookies, widgets or other applications that may violate our policy.” The settlement also included an agreement by the toy makers to routinely scan their websites and assess their data collection practices.

The early discussion concerning “smart toys,” which culminated in the NY Attorney General taking action, provides a great snapshot on the rapid development of these privacy issues. The landscape has changed dramatically in the last year and a half since the release of “Hello Barbie,” as more private information from children falls prey to hackers and other criminals. Eric Schneiderman, New York’s Attorney General, may have said it best, “[n]ow children live online and we have to police the internet as we seek to police our streets…I don’t want there to be a dossier on any child that can be used later to scam them.”

The post Barbie (Still) Can’t Keep a Secret: Toy Makers Enter Settlement Related to “Smart Toys” appeared first on Privacy Risk Report.

In recent posts we have discussed the “Internet of Things” which is used to describe how physical objects around us are increasingly becoming wired to the internet. For example, our prior posts have addressed “smart household appliances,” “smart vehicles” and even Apple’s new “smart watch.” Privacy concerns are now growing over Mattel’s new Barbie, “Hello Barbie,” which contains an embedded microphone in the doll’s belt to record a child’s response to the doll’s questions. The child’s responses are sent back to Mattel through the doll’s WiFi capabilities. Mattel claims the voice-recognition software and recording capabilities will allow the doll to learn to respond to the child’s statements and even learn the family dog’s name or other topics the child enjoys discussing. In explaining the doll’s capabilities, Mattel Senior Vice President of Global Communications stated “[t]he number one request we receive from girls globally is to have a conversation with Barbie, and with Hello Barbie we are making that request a reality.”

As seen with other products contributing to the “Internet of Things,” Hello Barbie and other “smart toys” are creating privacy concerns. For example, the Washington Post quotes Angela Campbell from Georgetown University’s Center on Privacy and Technology as warning: “If I had a young child, I would be very concerned that my child’s intimate conversations with her doll were being recorded and analyzed.” Further, the Campaign for a Commercial-Free Childhood has started a petition to stop Mattel from releasing Hello Barbie. Despite these concerns, Hello Barbie is still planned for release this fall and will cost $74.99.

The privacy concerns related to toys that are part of the “Internet of Things” may be put further into context by reports (PDF) that children and adolescents are the fastest growing sector of identity fraud victims. Children are targeted because they have good credit reports and their credit histories may not be reviewed for years until they apply for student loans or their first loans. Of course, while the Hello Barbie may not be shaking kids down for their Social Security numbers, these toys offer a great opportunity to consider the privacy risks posed to children.

The post Barbie Can’t Keep a Secret: Toys Cause Privacy Concerns appeared first on Privacy Risk Report.