'Smart' Toy Makers Must Build Privacy Into Products to Foster Parental Trust, Say FPF, FOSI

Makers of connected "smart" toys should provide clear privacy notices, give "meaningful" ways for parents to consent to collection and use of their children's data, and protect that information as a way to build trust with parents, said a Future of Privacy Forum and Family Online Safety Institute paper Thursday. Building on a June event, FPF and FOSI analyzed privacy and security implications of such toys -- like the speech-activated Dino and Hello Barbie Dream House or the wearable bracelet Pokemon Go Plus -- which can connect to the internet and, therefore, collect, process and share kids' data. "As connected toys become more popular, it is important for toymakers to be transparent about their data practices and to mitigate security risks," said FPF CEO Jules Polonetsky in a news release. "Federal law provides key safeguards, but more can be done to build trust.” The Children's Online Privacy Protection Act may apply to such devices, but the organizations say companies "should go beyond COPPA's strictures by building privacy into the design and packaging of their toys." Even non-connected toys that use Bluetooth could raise privacy concerns by transmitting hardware-specific data that can be tracked by sensors in a store or shopping area, the paper said. Manufacturers should consider technical or policy measures to ensure such toys can be used in public spaces while providing appropriate privacy options, it added.