Marketecht

Just over ten years ago, Mattel surprised the world with the release of Hello Barbie, a doll capable of having simple conversations with children through Wi-Fi connectivity. The public response was swift. Here are some headlines from the time:

Why you should say 'goodbye' to Hello Barbie (CNBC)

Advocacy Group is Saying 'Hell No' to 'Hello Barbie' (Time)

Privacy advocates try to keep ‘creepy,’ ‘eavesdropping’ Hello Barbie from hitting shelves (The Washington Post)

In the light of these positively glowing reviews and immense backlash from children's advocacy groups, the doll sold poorly and was discontinued a short time later. I won't go into detail about the security issues plaguing poor Barbie (rest assured they were numerous); all you need to know is that with very little effort security researchers were able to intercept the doll's communications.

Back in the present day, 2025 saw an explosion of AI-powered children's toys, but the backlash has been milder. If you search that phrase right now, you'll be met with a handful of articles discussing the dangers and just as many advertisements and store links. Several articles take a balanced approach, asking if AI toys could be dangerous or talking about risks they might have.

Still, children's advocacy groups and pediatric institutions have banded together in a near-universal condemnation of the toys, even if public opinion isn't as clear. I agree with this conclusion, though for a different reason than child psychology researchers.

Much of the current discussion on the harms of these toys focuses on a few primary danger factors:

• The toys sometimes have inappropriate chat responses
• They may interfere with learning development
• Children may not develop proper relationship building skills

And these are all extremely valid reasons not to buy AI toys. But the biggest one is not a maybe or a might. It is an inevitability: these toys will leak data.

At the end of January this year, a man and his web security expert friend decided to poke around the website for Bondu toys.

It's a cute dinosaur, how dangerous could it be?

With just a little snooping, they learned that they could access the website's admin panel with only a Gmail account and see the data of tens of thousands of children, including private conversation summaries.

Fortunately, these guys were white hats, so they informed Bondu of the security flaw and waited until the company had fixed it before going public with their findings. I don't need to tell you that not everyone on the internet is so kind.

AI toy maker Miko has already had its own close call. These are warning signs for the inevitable “big one” that we'll see in the future. If giant, well-established companies like Nintendo, Roblox, and VTech have all had major breaches and lost children's data, companies with entire security teams and loads of funding, what can we say for the random pop-up companies appearing and disappearing on sites like Amazon overnight?

In today's cybersecurity world, hackers are constantly bringing their best effort. They're attacking servers as soon as they go up to find vulnerabilities. They're trawling the web for unsecured services and access points. They're using tools to try thousands of passwords from previous breaches and building botnets to use against new victims. Meanwhile, for the company playing defense, it only takes one mistake and the data is gone.

Imagine the kinds of things your child might tell a toy in private and the consequences of those being stolen. Personally, growing up in the era where people still memorized phone numbers, I was quite fond of “proving my skills” by writing down lots of them on scrap paper. It's not so much of a stretch to imagine a child telling Mr. Dinosaur her newly memorized address or an ID number. In an even more sinister hypothetical, we could imagine a child sharing confidential thoughts and fears – only to have these exploited by someone who wishes to harm them.

Do you trust a corporation to not make any mistakes? If you didn't read that article above, after the VTech breach the company changed their terms of service to say:

“You acknowledge and agree that any information you send or receive during your use of the site may not be secure and may be intercepted or later acquired by unauthorised parties. You acknowledge and agree that your use of the site and any software or firmware downloaded therefrom is at your own risk.”

In conclusion? I recommend sticking with Lincoln Logs for now.

#tech #ai #opinion

Rebecca B. – BS Interdisciplinary Studies (Marketing/Computing) Return to home