With internet-connected toys in high demand this time of the year, the Federal Trade Commission (FTC) is making some recommendations that can help you choose one that is less detrimental to your kids' data.
Speakers, toys of all sorts, or any other gadget that can connect to the internet pose a risk to private data.
Get some answers firstEven if their maker has a healthy security posture and makes an effort to keep the information safe, sometimes users fail to configure it to an acceptable security level.
The FTC on Monday released a brief
list of recommendations you can use to make sure smart toys are not spilling out information about your child.
By checking a connected toy's set of features, parents should be able to assess what could go wrong and take appropriate measures to minimize the threat.
The questions below are meant to shed some light into the features that could pose a problem:
■ Does the toy come with a camera or microphone? What will it be recording, and will you know when the camera or
the microphone is on?
With recording capabilities, a connected toy that is improperly secured or vulnerable could turn into a spying device. Knowing when these features are active allows you to spot a possible bad situation and take immediate action.
There have been too many cases of parents realizing that someone was monitoring their babies only when the hacker decided to talk through the camera or move it.
■ Does the toy let your child send emails or connect to social media accounts?
Communication through a connected toy could also lead to shocking discoveries where friends or strangers may lure them into doing bad things.
Oversharing is another risk to consider, especially when it comes to private info (SSNs, postal or email addresses, phone numbers, family financial details).
■ Can parents control the toy and be involved in its setup and management? What controls and options does it have? What
are the default settings?
Determining the level of control you have over the toy and its configuration can help increase defenses against run-of-the-mill attacks.
Don't forget about COPPAIt is also important to know what type of info a toy collects when a child plays with it, where it goes, and if it is shared with a third party. If the data delivered this way to a maker, even anonymously, is also shared with other entities, multiple points of failure are present.
"If the toy collects personal information from your child who’s under 13 years old, the toy company has to tell you about its privacy practices, ask for your consent, protect and secure collected data, and give you the right to have your child’s personal information deleted" - U.S. Federal Trade Commission
Your kid's privacy online is subject to the Children’s Online Privacy Protection Act (COPPA), which gives you the instruments to control the information about your child shared with a company and review it. Withdrawing consent is possible at any time, as is requesting information collected about your child to be deleted.
source
