St. GEORGE — A complaint was filed with the Federal Trade Commission by consumer watchdog groups that say two toys made by Genesis Toy company record conversations which are sent to a voice technology company with military and law enforcement clients.
This complaint concerns toys that spy. By purpose and design, these toys record and collect the private conversations of young children without any limitations on collection, use, or disclosure of this personal information. The toys subject young children to ongoing surveillance and are deployed in homes across the United States without any meaningful data protection standards. They pose an imminent and immediate threat to the safety and security of children in the United States.
Due to a growing level of concern over the two toys, the My Friend Cayla Doll and the i-Que Intelligent Robot, a complaint was filed with the Federal Trade Commission last week, claiming that “the toys subject young children to ongoing surveillance” and violate privacy and consumer protection laws.
The advocacy groups allege that the Cayla Doll and the robot are spying on the children who own them, as outlined in the complaint filed with the Federal Trade Commission.
The complaint alleges that toy maker, Genesis Toys, a Hong Kong, China, company with a Los Angeles office, engaged in deceptive marketing and violated a law that restricts the collection of personal data about children.
These toys are sold all over the country by several big box retailers, including Target, Kmart, Wal-Mart and the online giant Amazon.
Target in St. George, located at 275 S. River Road, was the only retailer where the Cayla Doll was found on the store shelf.
All retailers offered the Cayla Doll and the i-Que Robot for purchase online.
Three watchdog organizations came together, including Electronic Privacy Information Center, or EPIC, Campaign for a Commercial Free Childhood and Center for Digital Democracy and Consumers Union. After discovering how the toys actually worked, they filed their complaint with the FTC.
How the toys work
The doll and robot are both internet-connected toys that talk and interact with children by capturing and recording their communications and then analyzing the recordings to determine the words spoken.
There are two components to the Cayla Doll, which is the physical doll that is accompanied by a mobile application. The doll contains a Bluetooth microphone and speaker, and the mobile application provides the data processing to facilitate the toy’s ability to capture the private communications of children.
The application then requests permission to access the hardware, storage, microphone, Wi-Fi connections and Bluetooth on the doll, but fails to disclose the reason or significance of gaining that permission.
The complaint outlines how the mobile phone app in the Cayla Doll asks children to provide personal information, like their name and their parents’ names, their favorite TV show, their favorite meal, where they go to school, their favorite toy and where they live. Children are even asked to pinpoint their exact location, or the location of their residence on a map.
When children ask the toys a question, the words are recorded and converted to text so that answers can be retrieved from Google, Wikipedia and Weather Underground before those answers are relayed back to the toy that then answers the child.
The application that accompanies the robot has similar features, and also requests access to the device camera, even though it has nothing to do with the toy’s function. Furthermore, the request is not explained to the user, nor is it justified, the watchdog organizations’ allege in their complaint.
My Friend Cayla Doll launched in 2014 within international markets as a talking companion that relies on an app and a Blue-Tooth connection to deliver realistic responses to children’s questions. The i-Que Intelligent Robot launched one year later, with features and capabilities very similar to the doll. The doll made its debut in U.S. Markets in the summer of 2015.
The doll and robot, however, act as recording devices that transmit voice prints of the children to Nuance Communications, a company incorporated in Delaware that specialized in speech recognition products whose clients include military, law enforcement and intelligence firms.
The FTC filing comes in the wake of a previous breach in security when last year a vulnerability in the software that accompanies the Cayla Doll was discovered by security researcher, Ken Munro, who found that it was vulnerable to hackers, according to a Feb. 9, 2015, article in the Huffington Post by David Moye.
A spokesman for the doll’s U.S. distributor told the Huffington Post in 2015 that the Cayla Doll is no longer vulnerable to the type of “unlocking” done by Munro, and said the company’s software engineers noticed the same vulnerability around the same time that it was reported in the press in 2015.
“We immediately developed a patch, and upgraded the software,” Gabe Uribe of Genesis Toy told Huffington Post by email, according to Moye’s 2015 report. “In fact, we have shipped over 400,000 Caylas around the globe since its debut last summer, and have not had a single consumer complaint, regarding security issues or problems.”
The complaint alleges that Nuance is saving recordings of those interactions with children for future use without providing adequate warning to parents, in violation of a 1998 federal law to protect the online privacy of minors.
The recorded words, phrases and conversations are also uploaded to Nuance, a voice technology company. The consumer groups allege in the complaint that Nuance uses the recordings to improve the products it sells to military, government and law enforcement agencies.
One particular product, ‘Nuance Identifier,’ helps security officials identify criminals by the sound of their voices after searching millions of recordings maintained by the company.
Richard Mack, Nuance’s vice president of corporate marketing and communications, said his company doesn’t sell or use the voice data it collects for marketing or advertising purposes, according to a statement released on December 6, 2016 by the company.
“Upon learning of the consumer advocacy groups’ concerns through media, we validated that we have adhered to our policy with respect to the voice data collected through the toys referred to in the complaint,” Mack wrote, and added, “Nuance does not share voice data collected from or on behalf of any of our customers with any of our other customers.”
Nuance Communications specializes in voice technology, and maintains 60 million enrolled voice prints that can be matched from recorded conversations within minutes. The technology is marketed to private and public entities. Furthermore, those recordings can be stored and maintained indefinitely.
Neither Genesis Toys nor Nuance Communications could be reached for comment Friday, and the partners listed on Genesis’ website, which include Target, Toys R Us, Wal-Mart and Kmart, as well as the online giant Amazon, were also contacted for a statement. However, the only response received as of Friday came from Lee Henderson, corporate communications spokesperson for Target, via email, which said.
‘Thanks for reaching out to Target. I would defer you back to Genesis Toy Company for comment on your inquiry.’
Copyright St. George News, SaintGeorgeUtah.com LLC, 2016, all rights reserved.