Are Teddy Bears Spying On Your Family?

The cute and cuddly teddy bear that your child just adores may in fact be spying on your family.  The Federal Bureau of Investigation (FBI) has issued a warning about internet connected toys.  The FBI noted that internet connected toys may contain microphones, cameras, geolocation technology, sensors, data storage capabilities and speech recognition that may disclose your family’s personal information.

Farfetched?  Not really.  In February 2017, over 2 million message recordings and over 800,000 customer credentials associated with a stuffed teddy bear were publicly exposed online.  There have been similar problems with popular dolls.  Another incident disclosed the names, email addresses, passwords, and home addresses of almost 5 million parents who had bought internet connected gadgets designed for children.

The FBI warned that Information including a child’s name, school, likes and dislikes, and activities may be disclosed through conversations with internet connected toys.  The collection of this information combined with a toy’s ability to connect to the Internet raises concerns for privacy and physical safety. Personal information is typically provided when creating user accounts. In addition, companies collect large amounts of additional data, such as voice messages, conversation recordings, past and real-time physical locations, Internet use history, and Internet (IP) addresses. This information could create opportunities for both child identity theft and exploitation risks.

What can parents do to protect their children?

  • Turn the toy off when it is not in use. 
  • Use a search engine to learn of any vulnerabilities discovered in the specific brand and model of the toy.
  • Make certain that Wi-Fi networks are properly secured.
  • Bluetooth connected toys should have authentication requirements (such as PINs or passwords).
  • Make sure that all communications between the toy, Wi-Fi access points, and the servers that store data are encrypted.
  • When creating user accounts for the toy, use strong and complex passwords.
  • When creating user accounts, limit the amount of information provided to the bare minimum required.
  • Read any disclosures and privacy policies accompanying the toy to understand how your child’s information will be used, stored and protected.

If you discover that your child’s toy has been compromised, you can file a complaint with the FBI’s Internet Crime Complaint Center.