A connected toy or voice assistant may respond to speech, save recordings, link to an adult account, or send information to company servers. Because these devices often sit in bedrooms and family spaces, setup should include a privacy audit—not just Wi-Fi and a fun demonstration.
Map what the device can sense
List its microphone, camera, location access, contacts, Bluetooth, motion sensors and linked apps. Check whether it waits for a wake word or can collect information another way. A light or sound may indicate recording, but children need to understand that signal. If there is no clear indicator or physical mute control, consider a shared room instead of a private space.
Trace the information
Open the privacy notice and account settings. Ask what is collected; whether audio is stored, converted to text, reviewed by people, or used to improve a service; who can see histories; whether third-party games receive data; how long information is retained; and whether individual items and the account can be deleted.
Use the minimum information needed. Avoid a child’s full name, birthday, school, routines, photographs and precise location unless a feature genuinely requires them and the family accepts the trade-off. Turn off optional personalization, purchasing, contacts, location and sharing that do not support the intended use.
A room-by-room setup
- Shared living area: Place the device where adults notice use and visitors can see it.
- Bedroom: Prefer no always-listening device. If used, mute or power it off when not needed.
- Play space: Check whether toys record other children who have not agreed.
- Homework area: Disable purchasing and review whether spoken questions are saved.
- Travel: Recheck location and public-network settings before taking it outside.
Give children usable words
For a young child: “This toy can hear when its light is on. Do not tell it your full name, school or secrets.” For an older child: “Before enabling a new skill, show me what it wants to access.” Make it safe to report an odd answer or accidental recording without automatically losing privileges.
Review, update and delete
Install security updates, use a unique password and multifactor authentication when available. Review histories together and practise deletion. Revisit permissions after app updates, new features, a move, or a change in users. Before selling or donating, remove linked accounts and use the manufacturer’s reset process.
Product claims deserve the same reading as research claims: check who makes them, what evidence is offered, and what is missing. The guides on not overreading one study and putting risk into context help avoid both complacency and panic.
Sources and further reading
Check the people around the child
Connected devices can capture siblings, babysitters, relatives and visitors as well as the account holder. Tell regular caregivers what the device does and show them the mute or power control. When friends visit, either explain the device plainly or switch it off. Consent rules differ by place, but courtesy and data minimization are useful everywhere.
Know what happens when the internet fails or the company stops supporting the product. A toy that loses core functions may become frustrating; an abandoned device may stop receiving security updates. Before buying, check the support period and whether basic play works offline. After purchase, keep the receipt, model name and account-deletion instructions together so a future reset does not depend on memory.
Finally, separate convenience from necessity. If a timer, music player, story, or light can work without a networked microphone, a simpler tool may meet the same family need with fewer accounts, permissions, updates and stored records.
Write the review date on a family calendar and repeat this audit at least yearly.
