Smart toys’ can illegally spy on homes

• This is one of the conclusions drawn from the research conducted by S2 Grupo to analyze the main cyber threats of smart toys and the current needs to protect the privacy of families.

• Other cyber risks associated with this type of toy include the remote takeover of the device by a cybercriminal, the interception of communications or identity theft. In addition, it can jeopardize users' right to privacy as some of them have the ability to disseminate private information.

• The study also shows that 77% of parents are concerned about protecting their family's digital privacy, 73% are concerned about third parties collecting personal data without their consent and 90% recognize the importance of protecting their children's identity.

Valencia May 24, 2023.- S2 Grupo, a Valencian company specialized in cybersecurity and critical systems management, has presented this morning the first 'Report on cybersecurity in Smart Toys' to analyze the main cybersecurity problems of smart toys and the current needs to protect the privacy of families.

The report shows that the main cyber dangers of these types of toys are that they can illegally spy on homes, steal personal data, access credentials, stored data, images and sound, take remote control of the device, interception of communications, denial of service attacks and elevation of privileges or identity theft.

"We must bear in mind that these cyber dangers entail significant damage to the privacy of minors and households. Due to the nature and technical limitations of this type of device, we have detected very low levels of security in them and this is especially serious because the confidential information that may be compromised belongs to minors, one of the most vulnerable groups", said José Rosell, managing partner of S2 Grupo.

As indicated in the research, smart toys are booming in Europe, more and more children have at least one smart toy at home and their sales are expected to increase by 28% by 2026. And this increase will be further boosted by 5G technologies. The number of 5G smartphone subscriptions is estimated to reach 2.451 billion by 2025 compared to 580 million by the end of 2021.

"Smart toys are characterized by containing integrated electronic elements so that they can adapt to the user's own activities. In this way, smart toys can process more information from a wider variety of sensors such as microphones, voice recognition, cameras, proximity sensors, radio transmitters or Bluetooth to establish communications between various parts of the toy. The device is controlled by software and contains elements of artificial intelligence, which implies the ability to learn and process information from the user", explained Rafael Rosell, commercial director of S2 Grupo.

For all these reasons, company experts have stressed that consumers, especially adults, should be aware of the risks that these toys may present. They also highlighted that toy companies must comply with the legal and technical regulations drawn up in this regard, in order to guarantee the protection of user data. And they have recommended to families that the registration they make to use these toys is with the minimum essential data and use the right of free access and destruction of the information stored by the smart toy.

Types of smart toys and risks

From the report carried out by the S2 Grupo team, it can be extracted that smart toys can be classified into different types:

1. Toys for life (physical figures based on characters that serve as interactive elements for the child)
2. Robotics (they can be remotely controlled with an application and a series of commands that are usually verbalized)
3. Wearables (devices that are incorporated into clothing or worn on the body, such as smart bracelets, watches or helmets)
4. Learning development (they are intended to promote children's learning, developing skills or transmitting certain knowledge, such as a toothbrush that teaches through play)
5. Augmented reality toys (traditional toys that are equipped with sensors that allow the incorporation of virtual reality elements)

Top family concerns about smart toys

In the first 'Report on the cybersecurity of smart toys", the S2 Grupo team has highlighted that smart toys can provide significant benefits to children in terms of learning, entertainment, and even socio-cognitive development. For this reason, parents perceive technology as a force for progress that can have a significant ability to transform and improve their children's lives, but it also generates concern.

In this sense, 77% of parents are concerned about protecting their family's digital privacy, 73% of parents are worried about third parties collecting personal data without their consent, 90% recognize the importance of protecting their children's identity, location (88%), health data (87%), age (85%), school records (85%) and browsing history (84%)".

Regarding what kind of actions should be carried out in terms of security within parental prevention, the following conclusions have been drawn: 86% of parents think that it is highly relevant to maintain active and fluid communication channels where privacy, security and protection can be openly discussed.

75% of parents consider that a discussion about security and privacy with their children is as important as it can be in the area of sexuality.

89% of parents feel that they should have monitoring tools that allow them to play a security role with their children.

91% of parents want apps to be reviewed by experts for privacy and security before they are made available for download.

S2 Grupo has pointed out that some recommendations for the safe use of smart toys are:

1. Supervise the activity of the little ones with this type of devices.
2. Check if there is chat in that toy and if it requires the location.
3. It is recommended to use those that have security controls for parents.
4. Check that the toy has a physical or digital component for network access and that it is the parents who give access to it.
5. Read carefully the privacy and security policy of digital toys.
6. Always turn off the toy when not in use.

Finally, in the event held by S2 Grupo, some of the controversies in cybersecurity in smart toys since 2015 have been analyzed and a practical demonstration of the hacking of a smart toy has been carried out.