We tend to associate vulnerable connected devices with household IoT products, but it’s an issue that’s also present in some kids’ toys. In 2015, there were warnings over Mattel’s Hello Barbie; now, Germany has banned a wireless doll over similar fears.
The country’s Federal Network Agency (Bundesnetzagentur) has advised parents who bought the popular My Friend Cayla doll to destroy the toy or disable its wireless connection.
Researchers say hackers are able to access the doll’s unsecured Bluetooth connection from up to 33 feet away and “through several walls” to listen to and talk to any children playing with it. University of Saarland student Stefan Hessel said "Access to the doll is completely unsecured," and that "there is no password to protect the connection."
US firm Genesis Toys manufacturers the internet-connected doll, which is distributed in Europe by Vivid Toy Group. Vivid said previous cases of hacking were isolated and carried out by specialists, and that it would be upgrading the app used with the doll, but, according to the BBC, the problem is still present.
Cayla can listen to questions and search the internet for replies, which it gives via speakers.
"Objects that conceal transmittable cameras or microphones and thus pass on data unintentionally endanger the privacy of the people," said Federal Network Agency head, Jochen Homann, in a statement. "This also applies to children's toys. The doll Cayla is forbidden in Germany. This is at the same time about the protection of society's most vulnerable."
While the UK Toy Retailers Association says Cayla “offers no special risk” and “there is no reason for alarm,” EU Commissioner Vera Jourova said: "I'm worried about the impact of connected dolls on children's privacy and safety." The commission is now investigating whether the doll breaches EU data protection laws.
Genesis Toys is no stranger to controversy, having faced an FTC complaint in December that accuses it of sending voice recordings to software firm Nuance Communications for “purposes beyond providing for the toys’ functionality.”