German Officials Ban Sale of Nosy Doll Deeming Her Illegal

A toy that made headlines before the holiday season last year is now making headlines in Germany. Not because it can record information, but because the German government has deemed it illegal due to its design.

My Friend Cayla is a doll created by the American company, Genesis. The fact that Cayla records what children say is not the issue. It’s because if a toy is created for sale in the country, any recording apparatus must be easily identifiable and reside outside the doll. In the case of Cayla, its microphone is hidden inside.

Cayla has the ability to answer almost any question (according to her website) when connected to the Internet and will respond to thousands of questions asked when offline using an app installed on a mobile device. She is designed that way so she can play games too, according to the manufacturer.

German authorities are not telling parents to destroy the doll. They have warned parents about the risks and recommend that the recording apparatus be removed from her. CNN quoted a spokesman for Germany’s telecoms regulator as saying, "The ownership of this device is illegal," but that they “expect people to act as lawful citizens and destroy the functionality of the doll.” However, parents will not be penalized for possession of it at this time.

They also have requested the doll be removed from store shelves and that the distributor discontinue putting it into stores altogether.

As technology advances many toys are connecting back to the Internet and sending information somewhere. Once any information leaves your, or your child’s possession, it’s difficult to know what may be done with it. Hackers were able to steal account information of 12 million vTech customers, including 6.4 million minors in 2015, for example.

Germany has stricter privacy laws than most other countries. Therefore, it’s not a surprise that it would pay special attention to the Internet of Things (IoT) and particularly with internet-connected toys; for good reason, perhaps. Anything connected to the Internet may have flaws that can be exploited, making the information that is collected or transmitted available to those you may not want to have it.

Last year, security researchers were able to find issues with the firmware of the internet-connected BB-8 toy that is controlled with an Android app using Bluetooth. In that case, updates were not retrieved with a secure connection, but merely by using unsecured HTTP. That said, this particular toy does not record personal information, nor is personal information stored in the app. The manufacturer is working to remedy that. However, it does highlight the fact that products do get released before they are ready for the IoT prime time.

Norwegian authorities have taken notice of My Friend Cayla too. However, rather than banning the doll, they have recorded a YouTube video alerting parents to the risks of allowing their children to play with her. Privacy advocates in the United States are also working to file a complaint with the Federal Trade Commission.