An international coalition of consumer watchdogs says Nuance Communications is violating the privacy of children who play with two toys that use the Burlington company’s speech-recognition software.
The toys, My Friend Cayla and i-Que Intelligent Robot, use Nuance software to answer questions posed by children. But in complaints they expect to file with federal regulators on Tuesday, the consumer groups allege that Nuance is saving recordings of those interactions with children for future use without providing adequate warning to parents, in violation of a 1998 federal law to protect the online privacy of minors.
Both toys are made by Genesis Toys of Los Angeles, which will also be named in a complaint to the Federal Trade Commission. Neither Genesis Toys nor Nuance could be reached for comment Monday.
Advertisement
“My Friend Cayla and i-Que toys are spying on children, and sharing their intimate conversations with Genesis, Nuance, and unknown third parties,” said Josh Golin, executive director of the Boston-based Campaign for a Commercial Free Childhood, one of the organizations that plans to file the complaint with the FTC.
“Any Internet-connected product for children should make abundantly clear exactly who a child’s sensitive data is being shared with and for what purpose.”
Other groups backing the complaint include Consumers Union, which publishes Consumer Reports magazine, and the Electronic Privacy Information Center (EPIC).
The coalition also includes several groups based in Europe, such as the Norwegian Consumer Council, that are expected to file similar complaints Tuesday with regulators for the European Union, France, the Netherlands, Belgium, Ireland, and Norway.
My Friend Cayla carries a starting price of about $40 but more costly versions are available.
The I-Que Intelligent Robot costs about $130.
Both are available through Amazon.com; My Friend Cayla is also sold at other retailers including Walmart, Sears, and Toys ‘R’ Us.
Advertisement
Both toys use Bluetooth wireless radio to connect to a software app to run a nearby mobile device, such as a smartphone or a tablet.
The mobile device relays data between the toy and Nuance over the Internet.
A child can ask questions of the toy, such as “Who wrote Alice in Wonderland?”
Her voice is then transmitted to a Nuance data center, which translates the question into text and sends a reply to the toy, in the form of a synthesized voice.
In this way, a child can talk to the toy about an endless variety of topics.
But what happens to the digital recording of the child’s voice?
According to the consumer groups, Nuance’s service contract with Genesis Toys stipulates the Massachusetts company will store the recordings and analyze them to improve the performance of the toys and of other products and services.
That, the groups said, violates a federal law that sets strict limits on the collection of data from anyone under age 13.
Moreover, they point to Nuance’s own privacy policy, in which the company states that anyone under age 18 “should not send any information about yourself to us” and promises to delete any information that is inadvertently acquired from a child under age 13.
The Genesis toys are not the first to fall under suspicion because of the way they connect children to the Internet.
Mattel Corp.’s Hello Barbie, a talking doll with Internet-based speech recognition, came under fire last year for security flaws that might allow hackers to access a child’s recorded words. Mattel said it has fixed security flaws in its servers, and moreover, the doll did not collect any sensitive information from children.
Advertisement
Nuance was peripherally involved in a case involving Samsung Electronics, whose Smart TV used the company’s speech software to recognize verbal commands of watchers.
In 2015, EPIC filed a complaint with the FTC alleging that the TVs could pick up unrelated conversations — and transmit those recordings to Nuance.
Samsung subsequently clarified its policy that the software collected only the commands that watchers directed at the TV.
Claire Gartland, the director of EPIC’s consumer privacy project, said federal law requires that any data collected from a child be used only to provide specific services for that child, and that it must then be deleted.
“Children aren’t turning their information over so that Nuance can spiff up its voice- recognition technology,” Gartland said.
Both Genesis toys are also vulnerable to hacking because Genesis has not developed adequate security features, the consumer groups allege.
Researchers at the Norwegian Consumer Council found that they could use a Bluetooth-equipped mobile device to take control of the toys and eavesdrop on a child’s conversation — and even talk back to the child.
Finn Myrstad, director of digital policy for the Norwegian Consumer Council, said that Genesis was informed of the problem a year and a half ago, but has not fixed it.
Myrstad’s group also found that the My Friend Cayla doll appears to be preprogrammed to deliver oral advertisements for products from Walt Disney Co. For instance, the doll says her favorite movie is Disney’s “The Little Mermaid” and that she loves to visit Disneyland.
Advertisement
The complaint alleges that including such advertising in a toy constitutes a deceptive business practice under federal law.
Hiawatha Bray can be reached at hiawatha.bray@globe.com. Follow him on Twitter @GlobeTechLab.