Toys that purportedly spy on children are the subject of a new complaint filed with the Federal Trade Commission. Senator Ed Markey (D-Mass.) also sent letters to the manufacturer of the My Friend Cayla doll and I-Que Intelligent Robot.

According to the Electronic Privacy Information Center, the Campaign for a Commercial Free Childhood, the Center for Digital Democracy, and Consumers Union, the My Friend Cayla doll and i-Que Intelligent Robot Genesis toys violate the Children’s Online Privacy Protection Act.

“This complaint concerns toys that spy,” the consumer groups wrote. “By purpose and design, these toys record and collect the private conversations of young children without any limitations on collection, use, or disclosure of this personal information. The toys subject young children to ongoing surveillance and are deployed in homes across the United States without any meaningful data protection standards. They pose an imminent threat to the safety and security of children in the United States.”

Both toys contain a Bluetooth microphone and speaker with a companion mobile application. Before playing with the toys, users are required to download the app to connect the doll and grant the manufacturers permission to access the hardware, storage, microphone, WiFi connections, and Bluetooth on devices for Cayla. Once the devices are activated, the toys convert a child’s statements into text, which is then used by the app to retrieve answers to questions and appropriate responses to comment.

In so doing, Genesis—and Nuance Communications, the software provider for the toys—record and collect children’s voices and speech using voice-recognition technology in violation of COPPA, the groups said. The companies fail to provide adequate notice to parents of their terms of service and privacy policy. The notice is “confusing and hard to access,” it is displayed in small font, and appears only after 3,800 words have already been presented.

The complaint adds that Genesis fails to obtain verifiable parental consent because the company assumes that downloading the app constitutes acceptance of its terms.

Genesis further neglects to comply with deletion and data retention requirements and keeps data for “vague and potentially indefinite periods of time,” the groups told the FTC. The company also fails to employ security measures to prevent unauthorized access to personal information collected from children via the toys. Finally, the toys also feature undisclosed product placements and Cayla is preprogrammed with “dozens of phrases” referencing Disneyworld and Disney movies. Cayla also tells children that her favorite movie is The Little Mermaid, for example, and that her favorite song is “Let It Go.”

For all of these purported COPPA violations, the complaint requests that the agency investigate Genesis and Nuance, halt any illegal practices, and provide appropriate relief.

Sen. Edward Markey (D-Mass.), who authorized COPPA when he was in the House of Representatives, sent letters communicating his own concerns to the general manager of Genesis and the chairman of Nuance. Sen. Markey’s letters inquire “about the privacy and security of children’s voice recordings collected by Genesis Toys’ dolls.” The identical letters ask the companies to identify information collected about children 12 years old and younger and, for each type of information, to explain how it is stored, how long it is stored, and any purposes for which the data is kept.

Sen. Markey also queried whether the collected information is necessary to make the toys function, whether the companies collect information about children from other sources (such as social media), and whether the companies notify parents about the data collected by the toys.

Sen. Markey’s letters also inquired whether the companies use the toys to send advertising to children, and if so, to identify all companies on behalf of which the advertising is delivered. The letters also asked the companies, “Do you notify parents that their children may receive advertisements through the toys? If yes, how? If no, why not?”

“Given the sensitive nature of children’s recorded speech, I believe that Genesis Toys and Nuance must take responsible steps to protect children’s privacy and comply with the Children’s Online Privacy Protection Act (COPPA),” Sen. Markey wrote.

To read the consumer groups’ complaint to the FTC, click here.

To read Sen. Markey’s letter to Genesis, click here.

To read Sen. Markey’s letter to Nuance, click here.

Why it matters: The groups said the complaint—filed in conjunction with consumer protection organizations in countries around the globe, including Belgium, France, Ireland, the Netherlands, and Norway—is a warning shot to all “smart” products. The groups are “worried about the lack of consumer and data protection for children in the rapidly emerging Internet of Things,” Jeffrey Chester, executive director of the CDD, said in a statement. “The industry must adopt safe practices.”