AI and Children's Data: A Parent's Guide to Privacy Risks in Smart Toys

The doll on the shelf looks harmless. It has a microphone behind a stitched smile, a Wi-Fi chip in its back, and a companion app that wants your email address before your child can say hello to it.

Connected toys are ordinary now. They answer questions, read bedtime stories, remember a favourite colour, and send all of it to a server somewhere. Most are made by companies that mean well and publish privacy policies nobody finishes. The useful question is not whether these toys are sinister. It is what happens to your child's voice, name and daily habits once they leave your living room — and how much of that you can actually control.

More than you might think.

What These Toys Collect

Read a toy's privacy policy closely and the list is usually longer than the box suggests. Common categories include:

• Voice recordings and transcripts. Every question your child asks, sometimes stored in full rather than as text.
• Names, ages and birthdays, collected during setup because the toy "personalises" its responses.
• Photos and video, if there is a camera, often including whatever is behind your child.
• Approximate location, inferred from Wi-Fi networks, or pulled from your phone's GPS while the app is open.
• Play history. Which songs get repeated, how long a child stays engaged, what time of day they pick the toy up.
• Your details. Email address, phone number, and occasionally your home network name and password.

A voice recording is not like a password. If a password leaks, you change it. A recording of a five-year-old cannot be recalled, and a voice is personal enough to identify a person. Anything a microphone catches should be treated as permanent.

Where It Goes After Bedtime

Data from a toy usually travels to the maker's servers, often in another country, and is then handled by cloud providers, analytics services, app developers and marketing partners. Many policies name categories of recipients rather than specific companies, which makes it hard to know who ends up with a recording of your child saying their own name.

Retention is the other half of the story. Some companies delete audio after a set period. Others keep it indefinitely, or keep it until you ask. Deletion tools vary wildly: some apps have a clear button, others route you through a support form that quietly goes nowhere.

Worth noticing: a surprising number of toys work fine without an internet connection. If the app is only needed for firmware updates or extra songs, that tells you how essential the data collection really is.

Why Children's Data Deserves Extra Care

Children cannot consent in any meaningful sense. They do not understand that a toy is also a sensor, and they certainly do not grasp that a playful answer becomes a data point in a profile that may follow them for years. Profiles built in childhood are unusually durable precisely because the child has no say in creating them.

Then there is security. Researchers and regulators in several countries have documented connected toys transmitting audio without proper encryption, and toy companies have had customer databases exposed. You do not need to distrust any particular brand to accept that this category has a track record worth checking before you hand it to a child.

Rules differ by country — in the United States, the Children's Online Privacy Protection Act places duties on services aimed at young children; in the EU and UK, the GDPR and related design codes apply. If you are dealing with a specific breach or dispute, your national data protection authority, or a lawyer, is the right place to take it.

Before You Buy

Five minutes of research beats an hour of clean-up later. Ask:

• Does it need an account or a connection to do the thing my child actually wants?
• Does the policy say what it collects, how long it keeps it, and who else gets it?
• Does it need a microphone, camera or location at all for the features we will use?
• Has the maker been fined by a regulator or covered in the news for a data problem?
• Can I delete data from inside the app without emailing support?

None of these are automatic dealbreakers. A toy that records audio but states a clear retention period and offers one-tap deletion is a different proposition from one that keeps everything and hopes you never ask.

Setting It Up With Fewer Loose Ends

1. Register the account yourself, using a household email address rather than your personal one, and a password you do not reuse anywhere.
2. Give the toy the least it will accept. A first name or nickname is enough. Skip the birthday, the school, the photo.
3. Put the toy on a guest Wi-Fi network if your router supports one, so a compromised device cannot see your laptops and phones.
4. Turn on automatic updates, and check for firmware updates every few months.
5. Switch off the microphone or camera when the toy is not in use, or remove the batteries. Physical switches beat settings menus.
6. Review the companion app's permissions on your phone. A toy app rarely needs your contacts or precise location.
7. Turn off Bluetooth when it is not needed, and check which other accounts you linked during setup.

If the toy is already in the house

Start in the app's privacy or account settings. Look for a history of recordings you can download or delete, a personalisation or advertising toggle, and a data deletion request. Change the password, remove linked accounts, and check whether the toy still needs to be on your network at all — many keep working without it. If the company ignores a deletion request, your national data protection authority can take a complaint.

A Rule That Holds Up

Buy fewer connected things than you think you need, and choose the offline version when there is one. Set the toy up yourself, give it as little as possible, and check back once a year to delete what has piled up. Talk to your child about it in plain terms — that the toy listens, that some toys remember, and that it is fine to say no.

You will not eliminate the data trail. You can make it short, boring and mostly useless to anyone who might want it, which is a reasonable goal for a plastic bear with a microphone in its ear.

Photo: Matthew Jesús / Pexels