As internet-connected toys become more popular gifts and everyday play companions, a new report from the Mozilla Foundation, conducted in partnership with cybersecurity firm 7ASecurity, reveals alarming gaps in security and data protection that could put children and families at risk. The Toys Data Security & Safety Report 2025 examined ten widely used connected toys and found systemic vulnerabilities ranging from unencrypted storage to insecure server configurations — issues that could expose intimate personal information or allow unauthorized access and control.
Why Smart Toys Can Be Risky
Many modern toys are no longer just playthings. They include cameras, microphones, GPS, sensors, and wireless connectivity to enable interactive experiences, mobile app integration, and even artificial intelligence features. However, this connectivity also means that these devices collect, process, and sometimes transmit personal data — often with weak security protections.
The Mozilla report found that several popular devices did not encrypt stored data, leaving photos, voice recordings, and location information vulnerable if a toy was lost, stolen, or discarded. In one example, attackers could remove an SD card from a toy to retrieve unprotected content.
Beyond physical access risks, many toys exhibited server-side vulnerabilities such as missing authentication controls or misconfigurations that could allow external attackers to access databases holding personal information like full names, birthdates, email addresses, and GPS coordinates.
Real-World Privacy and Security Consequences
The consequences of these vulnerabilities extend far beyond theoretical risk. Depending on the toy’s capabilities and the data it collects, a malicious actor could:
- Access sensitive family data such as addresses, routines, and voice recordings;
- Track a child’s location through GPS-enabled features;
- Use compromised toys as surveillance devices by activating microphones or cameras;
- Harvest data that could feed into broader profiling or targeted exploitation.
These risks are particularly concerning because they arise from products marketed toward children and used in private spaces, such as bedrooms or play areas. Security experts emphasize that poor device design and lax data practices in this category reflect a broader failure by manufacturers to prioritize safety and privacy by default.
What Mozilla Reported This Year
The Mozilla Foundation’s report audited ten connected toys, selected based on popularity and market presence. While the full list is proprietary to the report, examples of affected devices include:
- Smart tablets and watches designed for children
- Robotic companions with voice interaction
- STEM-oriented learning toys with tablet connectivity
These products often require users to create accounts and share personal information to unlock full functionality — yet the report found that six out of ten exhibited weaknesses in servers and authentication controls.
Emerging External Findings on Smart Toy Safety
Independent research and consumer advocacy groups have also raised alarms about connected toys. A study shared with Axios underscored widespread privacy and security weaknesses in popular devices, warning that some toys could effectively function as listening devices and expose intimate household data to attackers.
Another consumer report highlighted troubling responses from AI-enabled toys, including inappropriate or dangerous advice delivered to children, underscoring that risks go beyond technical vulnerabilities to include content safety concerns.
Key Privacy Threats Identified
Across toys reviewed and related research, the most significant threats include:
- Unencrypted Storage: Data stored on removable media or internal flash without encryption is easily accessible if a device is lost or stolen.
- Server-Side Vulnerabilities: Misconfigurations and missing authentication can expose personal data through cloud endpoints.
- Remote Code Execution: Some flaws could allow attackers to take control of a toy’s functionality.
- Inadequate Parental Controls: Limited or poorly implemented controls can leave children exposed to harmful interactions or data sharing.
What Parents Can Do to Protect Their Kids from Toys That Can Invade Their Privacy
- Research Before Buying: Check security and privacy reviews of connected toys and avoid products with known vulnerabilities.
- Change Default Passwords: Replace any default credentials and choose strong, unique passwords for toy accounts.
- Disable Unused Features: Turn off cameras, microphones, GPS, or Wi-Fi when not needed.
- Use Segmented Networks: Isolate connected toys on a separate Wi-Fi network to protect your primary household devices.
- Factory Reset Before Resale or Disposal: Wipe internal storage and remove external cards to eliminate residual data.
Immediate Safety Tips for Buyers
- Always review a toy’s privacy policy for data usage and retention practices.
- Disable unnecessary connectivity features when possible.
- Keep software and firmware updated to benefit from security patches.
- Monitor accounts tied to toys for suspicious activity.
- Consider low-tech alternatives if safety standards are unclear.
Industry and Policy Implications
The findings from Mozilla’s report and related research highlight the need for stronger industry standards and regulatory oversight in the “connected toy” segment. Unlike other consumer electronics categories, there are few comprehensive requirements that mandate minimum encryption, secure authentication, age-appropriate data handling, or third-party security audits for children’s toys.
Consumer watchdogs and privacy advocacy groups are increasingly calling for:
- Mandatory third-party security testing before product launch
- Clear labeling of privacy features and data collection practices
- Standards for encryption and secure device pairing
- Stronger legal frameworks to protect children’s data specifically
In the absence of regulatory action, industry groups may develop voluntary certification programs to signal safer products, but without widespread adoption these efforts will have limited impact.
2025 Toys Data Security & Safety Report
The 2025 Toys Data Security & Safety Report exposes a crucial gap in how connected toys are built and marketed — one where convenience and novelty too often outpace security and privacy protections. With sensitive personal data at stake and devices increasingly integrated into children’s lives, it is essential that manufacturers, parents, and policymakers work together to elevate safety standards and protect families in the digital age.
If you want to avoid expensive toy privacy litigation we recommend you to reach out to a privacy expert for a complimentary privacy audit provided by the data privacy experts here at Captain Compliance.
