Designed to be interactive and educational, internet-connected toys can also pose privacy risks to children.

Today’s always-connected, real-time technology—the kind that allows us to ask iOS’s Siri for the weather forecast and play games against live opponents on smartphones—has made its way into our children’s toys. And while these interactive stuffed animals, dolls and tablets provide educational learning opportunities, their built-in internet connectivity means they also make kids susceptible to hackers, identity thieves and worse.

The issue has become such a problem that, in late 2016, Florida Senator Bill Nelson unveiled a Senate report from the Committee on Commerce, Science and Transportation (CCST) that cautions parents about the privacy risks inherent in these high-tech playthings. Per Nelson: “It’s frightening to think that our children’s toys can be used against them in this way. The companies that make these toys have to do more to safeguard the parents and children who use them.”

Not that local parents necessarily needed Congress to tell them that. Brandon Scholler, the father of two boys ages 3 and 2, with a baby on the way, was already concerned about toys with internet connections. “As of now, we have no plans to bring any of these devices into our house,” he says. “We prefer the old-fashioned toys that don’t require screen time or connectivity to a wireless network.”

Still, it’s hard to turn back the wheels of progress, and as smart devices become increasingly ubiquitous in modern society, it will become harder and harder for parents to keep their kids away from them completely. The good news? There are ways to protect your family from smart toys’ hidden dangers—which means you don’t necessarily need to keep your children offline to keep them safe.

Risks vs. Rewards

“Smart toys look like cute playthings, but they are actually computers with all the inherent abilities and vulnerabilities,” says Mary McLaughlin, cybersecurity analyst for the Office of Statewide Intelligence with the Florida Department of Law Enforcement (FDLE). “They may follow your children everywhere they go— home, school, day care, church, friends’ homes … everywhere. Some are akin to carrying a smartphone everywhere with the microphone and speaker always on.”

That’s why Scholler thinks parents should be informed about the capabilities—both good and bad—of this new era of smart toys. “As long as parents understand the risks involved and are able to monitor their child’s usage, hopefully some of these toys can be a learning tool,” he says.

As it turns out, it’s primarily the folks involved in the creation and marketing of smart toys who are most likely to tout their educational benefits. However, McLaughlin suggests that, in addition to potential privacy and security issues that can be related to smart toys, parents should also consider to what extent these types of devices will engage their child’s interest. “Before you spend your money, consider this: Many smart toys, while looking enticing on the shelf or in the commercial, demand from a child nothing more than sitting and watching,” she says. “They neither stimulate the imagination nor engage the child in play, and thus the novelty quickly wears off.”

Regardless, smart toys are useful in acclimating children to what will no doubt be an even higher-tech future, as well as teaching kids to code. There is also a certain magic to a toy that will interact with a child in real time, such as Fisher-Price’s Smart Toy Bear, Mattel’s Hello Barbie or VTech’s InnoTab. For instance, not only can the Smart Toy Bear tell your child the time, but it can also remember what your child says so they can have a conversation.

However, since the bear connects to the internet to retrieve answers to questions, that functionality leaves it vulnerable to hackers who could potentially tap into the toy’s microphone. Location services on many modern smart toys can also reveal the user’s location to unscrupulous parties.

McLaughlin explains that hackers can gain access to devices based on how they connect to their servers. “Many use Bluetooth and automatically [pair] with other Bluetooth devices without even needing a password,” she says. “Imagine this: A predator could connect to the doll of a child nearby and actually speak to them through the doll.”

Danger Zones

These dangers are so alarming that in December 2016, the Electronic Privacy Information Center and other U.S. watchdog groups submitted a complaint to the Federal Trade Commission, criticizing how smart toys are purposely designed to record and collect children’s private conversations without limitations on use, and subject children to surveillance without any data protection.

“Any device that makes children accessible to people who would want to prey on them is concerning,” says Danny Banks, special agent in charge for FDLE’s Orlando region. “It doesn’t mean—and I want to [put] caution behind [this]—that we as consumers shouldn’t buy these devices, but the best thing we can do, and what I really want to promote, is to educate ourselves on what the capabilities of these devices are.”

That education is critical, as Banks says the FDLE’s cases of cybercrime and child/sexual predators almost always involve a smart device these days.

“Sometimes that may be somebody reaching out to a child through a video game that has communication capabilities, sometimes it’s their phone, sometimes it’s other chat rooms that come through some toys,” he says.

Again, though, local parents seem to be well ahead of the curve. “My daughters are older, yet lack of privacy is still a big concern,” says Susan Watkins, mother of a 16- and 23-year-old. “At their age, the only thing I can do is make them aware of it and try to encourage them to be careful about what information they make public. They both believe that having ‘private’ profiles on various apps protects their privacy. I dislike that they have locator apps on their phones.”

“My main concern is a hacker knowing the location of my child,” says Christy Lee, who allows her 2-year-old daughter to use an Amazon Fire Kids Edition tablet up to two hours per day. “That’s creepy.”

Keeping Kids Safe

One of the most important things you can do to deter a hacker from gaining access to your family is to secure your home network. McLaughlin suggests having a strong and long network password that is 25-30 characters in length and contains a combination of letters, numbers and symbols—and be careful sharing it.

And to help maximize the safety of children while using smart toys, the CCST recommends that parents be aware of the privacy and security risks associated with connected toys.

“We don’t want it to get to a point where we’ve got a lot of statistics where people have been preyed upon and victimized,” Banks says. “That’s why we’re [doing] this big educational campaign right now, so we don’t ever have measurable statistics.”

At the end of the day, parents are the ones on the front line of keeping kids safe—a notion that’s not lost on the Greater Orlando moms and dads we spoke with. “With the advancements in technology and the ever-growing threat to our privacy, the concern over ‘smart toys’ is only going to increase,” Scholler says. “We have already heard about ‘smart televisions’ that are watching and listening to us, so it’s only logical that as families we understand what these toys are capable of when purchasing them for our children.”

SIDEBAR: Best Practices for Smart Toys

Thinking about buying a smart toy for your child? Already bought one? Here are Congress’ recommended steps for keeping your child safe while using any internet-connected device.

Before Purchasing a Smart Toy

• Find out what information will be collected. How will it be used? Will it be shared? How long will it be stored?
• Research the manufacturer. Has the company ever had a data breach? If so, how was it resolved?
• Read reviews from other parents. Have they had any issues or concerns about privacy?

After Purchasing a Smart Toy

• Read the entire manual and know all of the device’s capabilities.
• If applicable, immediately change the default password.
• Adjust the privacy settings to limit what personal information is shared. (Allow only what the device needs to function.)
• Regularly install available updates to the software.
• When a toy or device is not in use, turn off its Wi-Fi and/or Bluetooth connection.

This article originally appeared in Orlando Family Magazine’s March 2017 issue.