Your children’s toys are now connected

December 23, 2024

Smartwatches that track children’s locations, drones with cameras, robots that teach programming, or connected scooters that parents can monitor via an app are recent examples of how technology has become an integral part of toy stores. The digital age has transformed toys, turning them into tools that, beyond entertaining, foster technological skills from an early age.

Connected toy brands acknowledge parents' growing need to protect their children while providing safe educational and entertainment tools. To meet this demand, they have developed products that combine technology, functionality, and security.

In this way, they promote learning through innovative play experiences that complement traditional toys and provide peace of mind for parents. However, before connecting any toy to the internet, it is essential to understand its functions, configure it securely, review privacy policies, and plan to supervise its use.

When connecting toys to the Internet, it is imperative to configure them safely, monitor their use, and review privacy policies.

The educational role of connected toys

Connected toys play a fundamental role in children's digital literacy. These devices allow kids to develop technological skills naturally and playfully. For example, children’s tablets, programmable robots, or interactive dolls with features like facial or voice recognition help familiarize children with technology from an early age.

Moreover, they encourage specific skills such as programming, logical thinking, creativity, and teamwork. Programmable robots and devices with educational software offer a safe environment for children to explore technological concepts creatively. They also reinforce values such as problem-solving and collaboration.

The importance of safety in smart toys

The design, software complexity, and usability of toys are crucial to capturing the attention of children who are increasingly tech-savvy at younger ages. Making toys safe is essential to providing parents with peace of mind, as they recognize children's vulnerability in the digital environment.

According to a recent study by Incibe (Spain’s National Cybersecurity Institute) on Cyber Security in connected toys, it is essential that these devices, aimed at children, feature robust security mechanisms. The study analyzed 26 smart toys with capabilities such as recording video or audio, Bluetooth or wifi connectivity, and mobile app integration.

Cyber Security in connected toys is crucial because children use them and face a wide variety of potential threats.

The results indicate that 58% of the tests yielded favorable results, while six toys failed to meet minimum Cyber Security requirements, posing risks to end users. Additionally, 23% of the tests provided inconclusive results due to lack of information from manufacturers, such as technical configurations or applied policies.

It was also identified that 65% of the analyzed toys require a mobile app to function. This dependency increases technological interaction and also involves additional risks related to the handling of sensitive data, such as images, audio, usage habits, videos, or unauthorized access to personal data if the apps are not adequately protected.

Improper handling of permissions in apps could allow sensitive information to be collected without parents' knowledge or consent. Many of these devices handle data in the cloud, which, if not accompanied by proper encryption mechanisms, can heighten exposure risk.

⚠️ Only 40% of toys offer some form of parental control, leaving many with significant security and trust gaps that rely solely on manual supervision or external tools.

Recommendations for connected toys safety

To ensure the safety of connected toys, INCIBE offers several recommendations for both users and manufacturers:

Configure the toy securely by changing default passwords and using trusted Wi-Fi networks.
Supervise toy usage and utilize parental control tools.
Review privacy policies to ensure personal data is handled appropriately.
Keep toys updated and turn them off when not in use.
Purchase toys with “safe for children” Cyber Security certifications and read reviews from others.

Additionally,

The study highlights that most of the devices analyzed present an acceptable level of security. However, they have critical areas such as insecure default configurations, outdated firmware, and no encryption for data transmission.

→ These vulnerabilities can compromise children's privacy and security, making it crucial to stay informed about updates and security patches that address vulnerabilities. Users can subscribe to newsletters from manufacturers or specialized Cyber Security sources.
It was also noted that some toys present authentication issues, such as default passwords (e.g., “admin”) or insufficient mechanisms to protect against unauthorized access.

→ It is always recommended to change default device passwords to more secure ones and activate all available security features to safeguard against unauthorized access. For instance, a secure password should include at least 12 characters combining uppercase and lowercase letters, numbers, and symbols. An example could be: Connect3d!T@y.

On the other hand, the study urges manufacturers to implement measures such as disabling unnecessary services or protocols, improving default security settings, and ensuring transparency in data handling, aligning with regulations such as the Cyber Resilience Act (CRA). Recommendations for manufacturers include incorporating advanced parental control features and robust encryption in all data communications.

⚠️ Incibe advises families to consider toys' functionality and privacy impact, ensuring compliance with regulations. It also recommends carefully evaluating the risks associated with connectivity and choosing products that limit data exposure to what is strictly necessary.

Conclusion

Connected toys offer an exceptional opportunity to foster digital literacy and technological skills from an early age, enabling mastery of technological tools and preparing children for increasingly digital work environments. However, it is imperative that these devices are used safely and responsibly to protect children’s privacy and security.

Cybersecurity, education, and entertainment equip children for safe technology use.

Ultimately, safety must not be negotiable. Manufacturers have a responsibility to ensure their products are secure, while parents and caregivers must stay informed and vigilant. This way, these toys can become powerful tools for learning and creativity when used with the proper precautions.