The Federal Trade Commission (“FTC”) on January 10 confirmed that it was reviewing a complaint filed by privacy activists, which alleges that toys manufactured by Genesis Toys using Nuance Communications’ voice technology violate the Children’s Online Privacy Protection Act (“COPPA”) and related rules.
The complaint, filed by the Electronic Privacy Information Center (“EPIC”) in December and joined by the Campaign for a Commercial Free Childhood, the Center for Digital Democracy, and Consumers Union, describes the My Friend Cayla doll and i-Que Robot toy lines. Both are designed to record and analyze children’s voices using voice-recognition software, and, the complaint alleges, are programmed to request and record children’s personal information. Moreover, EPIC alleges, the toys’ respective privacy policies fail to disclose the extent of their information collection or the defendants’ uses of this data. Finally, the complaint argues that, by presenting terms of use only once a user has downloaded the toys’ companion mobile apps, Genesis Toys fails to receive effective parental consent for its access to children’s information.
EPIC argues that this conduct violates COPPA and the FTC’s regulations issued pursuant to COPPA. COPPA imposes certain requirements for online services that receive personal information from children aged 13 or younger, and the COPPA regulations require a number of specific notices and practices not only for collection and sharing, but also parental consent, parental review, and data retention, among other topics. In the current case, EPIC notes that the COPPA regulations require providing prominent and clear disclosure of privacy practices, sending direct notice of changes to these practices, and implementing reasonable verifications to confirm that purported consent comes from a parent.
The FTC has not commented on its investigation of the toymakers, and with the new administration facing two commissioner vacancies, the FTC’s enforcement priorities could change in the coming year. Nevertheless, the EPIC complaint gives a timely reminder to not only the toy industry, but indeed the entire consumer Internet of Things market, that receiving personal information from children carries specific risks. Many of EPIC’s factual allegations quote common, broadly-worded boilerplate and describe familiar user-experience problems. Where children are involved, however, these issues can become critical.
