A toy that needs an app and an account — on purpose
Do smart toys record and store your child’s voice?
Some toys now connect to an app so a child can send a voice message, or so a parent can check in remotely. That connection is the feature, not a flaw. Two separate, documented cases show what can go wrong with the company’s side of that connection. Invasive, not malicious — neither company built a toy to spy on your family specifically.
Case one: an unsecured database, not an intruder (2017)
CloudPets sold internet-connected teddy bears and other stuffed animals that let parents and kids trade short recorded voice messages through a companion app — the kind of thing meant to feel warm, like a goodnight message from a parent traveling for work. In February 2017, security researcher Troy Hunt reported that the company’s user database — roughly 820,000 accounts by his estimate, with references to nearly 2.2 million voice recordings, plus photos, names, and family relationships — was sitting in a MongoDB instance with no password at all, indexed by Shodan, a search engine built for finding exposed internet-connected devices. Hunt found the database had reportedly been accessed by unauthorized parties and held for ransom on more than one occasion before it was finally secured. Spiral Toys, the company behind CloudPets, disputed the severity and said recordings themselves hadn’t been taken; independent reporting on the exact recording count varies, so treat that number as an estimate. What’s not in dispute: the database had no password, for an extended period, holding recordings of children’s voices.
Case two: a hack and an FTC settlement over consent, not encryption that failed (2015/2018)
VTech, a toy and electronics maker, ran a Kid Connect messaging app and a Learning Lodge content platform that stored children’s photos, chat logs, and account data. In November 2015, an attacker exploited a SQL injection vulnerability — by VTech’s own admission, a basic database security gap — to access data tied to an estimated 638,000 children and millions of parent accounts. The FTC’s January 2018 settlement, $650,000 plus 20 years of mandatory security audits, centered on children’s privacy law: the agency said VTech collected kids’ data without proper parental notice or verifiable consent, and that its privacy policy promised encryption that the company didn’t actually use. VTech didn’t admit to any violation as part of settling. Together, both cases are about what a toy company did — or didn’t do — with data after collecting it, not about a toy secretly recording a child its maker never intended it to.
Four questions worth asking before a connected toy goes in the toy box
- Does it need an app, an account, or Wi-Fi/Bluetooth to work? If not, none of this applies — a toy with no connection has nothing to leak.
- What does the company’s privacy policy actually say about voice data — is it stored, for how long, and is it ever used to improve the product (which can mean a human listens to a sample of it)? The policy itself, not a retailer’s product page, is the document to read.
- Is the account protected by a real password, ideally unique and not reused from another account, and is two-factor authentication offered? CloudPets’ exposure happened because there was effectively no access control at all — a strong account password is the single most basic defense against exactly that failure mode.
- Is the toy’s software still updated? A toy brand that stopped shipping updates years ago, or has been resold/discontinued, is a toy whose known issues will never be patched — worth weighing before buying one secondhand or keeping an old one connected.
What this doesn't fix
None of the above audits a specific company’s current security practices or proves a given toy is safe today — it only lists the questions worth asking. Checking an account password and a privacy policy takes a few minutes and closes the most common gaps; it doesn’t independently verify an engineering claim a company makes about its own servers. If a specific toy concerns you, the manufacturer’s current privacy policy and any public breach history are the things to read before it goes in the toy box, not a review site’s summary of either.
This page is about a connected toy you chose to bring home. Checking a rental room for a camera someone else hid is the other half of this site.
The field manual is about finding a camera someone deliberately hid in a space you’re staying in — a different problem than a toy company’s own data practices, same calm, source-checked approach. The complete system — every check on this site plus the ten-minute walkthrough, audio devices, your legal rights, and what to do if you find something. 47 printable pages, instant download, keep it on any device.