This Tuesday, a consortium of consumer protection and children’s privacy groups filed a Federal Trade Commission (“FTC”) complaint against Genesis Toys (“Genesis”) and Nuance Communications, Inc. (“Nuance”) in connection with Genesis’ interactive, Internet-connected toys.

What are the key takeaways for businesses in the Internet of Things (IoT) space?

My Friend Cayla and i-Que Intelligent Robot

Hong Kong-based toymaker Genesis manufactures and sells the popular My Friend Cayla and i-Que Intelligent Robot toys. Each of the toys contains a Bluetooth microphone and speaker and is capable of connecting to the Internet via downloadable mobile application.

Once one of the Genesis toys is connected to the Internet, children are able to talk and interact with the toy using voice biometric technology developed by third-party software provider Nuance, which converts children’s statements into text and searches for appropriate responses using Google, Wikipedia and Weather Underground. The FTC complaint alleges that the My Friend Cayla and i-Que toys actually record children’s communications and upload the sound recordings to Nuance’s cloud-based servers.

The FTC complaint also claims that My Friend Cayla dolls are pre-programmed with dozens of phrases that reference Walt Disney Company (“Disney”) products and attractions, such as Disneyland, Disneyworld, The Little Mermaid and the song “Let It Go” (from Disney’s Frozen).

FTC Complaint

On December 6, 2016, the Electronic Privacy Information Center (EPIC), Campaign for a Commercial Free Childhood (CCFC), Center for Digital Democracy (CDD), Consumers Union (CU) and Institute for Public Representation (IPR) (collectively, the “Complainants”) filed their FTC complaint against Genesis and Nuance.

The Complaints allege that Genesis and Nuance violated the Children’s Online Privacy Protection Act (“COPPA”) by collecting personal information from children without:

  • providing proper written disclosures on their websites and in their mobile applications and privacy policies;
  • obtaining proper prior verifiable parental consent to collect and transmit such information; or
  • complying with parental requests to delete such information.

Further, the FTC complaint alleges that Genesis and Nuance violated Section 5 of the FTC Act by:

  • failing to implement proper authentication and security measures to prevent unauthorized Bluetooth connections with the subject interactive toys;
  • failing to disclose that the toys are pre-programmed to promote Disney products and attractions;
  • representing that they are in compliance with applicable privacy laws, such as COPPA; and
  • using voice and text information collected from children to enhance Nuance’s voice biometric solutions for military, intelligence and law enforcement agencies.

The Complainants have asked the FTC to investigate the matter and bring a stop to the business practices alleged in their complaint.

Proceed with Caution in the IoT Space

As the multi-billion-dollar IoT industry continues to grow and change, state and federal lawmakers and regulators are rushing to keep pace.

As the above-referenced FTC complaint illustrates, the manufacture, sale and support of connected devices can be fraught with legal risk. As such, businesses operating in the IoT space should speak with experienced marketing and privacy counsel to ensure that their respective devices, websites, mobile applications and privacy policies comply with applicable consumer protection laws, rules and regulations.