A children’s app or connected toy may collect more information than parents expect. A talking toy might record a child’s voice, a game may collect device identifiers, and a companion app could access location, photos, contacts, or nearby wireless networks.
These features are not automatically unsafe, but parents should understand what information is collected, why it is needed, and whether it is shared with other companies. Privacy should be reviewed before the child creates an account or begins using the product.
Understand When COPPA Applies
The federal Children’s Online Privacy Protection Act, commonly called COPPA, protects personal information collected online from children under age 13.
The COPPA Rule generally applies to commercial websites and online services directed to children under 13 that collect, use, or disclose personal information. It can also apply to a general-audience service when the operator has actual knowledge that it is collecting personal information from a child under 13.
An online service can include:
Mobile apps
Internet-connected toys
Online games
Smart speakers and voice assistants
Connected learning devices
Services using cameras or microphones
Internet-enabled location services
COPPA primarily regulates the companies operating these products. It does not mean that every app or toy marketed to a family is automatically covered in every situation.
Know What Counts as Personal Information
Children’s personal information is not limited to a full name or home address. Depending on the circumstances, it may include:
Email addresses or other online contact information
Usernames that function as online contact information
Precise geolocation
Photos or videos containing a child’s image
Audio recordings containing a child’s voice
Persistent device identifiers
Biometric identifiers
Government-issued identification numbers
Information combined with an identifier linked to a child
A product may collect data in the background even when the child never types a name. Advertising tools, analytics services, and other software included in an app can also collect identifiers or location information.
Look for Direct Notice and Parental Consent
A company covered by COPPA generally must give parents notice of its information practices and obtain verifiable parental consent before collecting personal information from a child, subject to limited exceptions.
The notice should explain:
What information will be collected
How the information will be used
Whether it will be disclosed to other parties
How the parent can provide or refuse consent
How the parent can review or delete the information
How to contact the operator
A request for consent should not be treated as a routine screen to click through. Read what the company is asking permission to collect. If the explanation is vague, difficult to find, or inconsistent with the product’s permissions, consider delaying setup.
Parents should also pay attention to separate consent requests involving targeted advertising or other disclosures to third parties.
Read the Privacy Policy Before Buying
Check whether the privacy policy is available before purchasing a connected toy. A toy that needs an app, account, or subscription may be difficult to evaluate after the box has already been opened.
Look for clear answers to these questions:
Does the toy contain a camera, microphone, or location feature?
Is information stored on the device or transmitted to company servers?
Are voice recordings or photographs saved?
Does the company share information with advertisers, analytics providers, or other partners?
How long is children’s information retained?
Can a parent view and delete it?
What happens to the data when the account is closed?
Will the product still work if optional data collection is refused?
How does the company protect stored information?
A privacy policy that says information “may” be used for broad business purposes deserves closer review.
Review App Permissions
Device permissions can reveal what an app is capable of accessing. Compare each request with the product’s purpose.
A drawing game may reasonably need access to saved pictures if the child chooses to import one. It may be harder to justify continuous location access or access to the contact list.
Review permissions for:
Camera
Microphone
Photos and videos
Precise or approximate location
Bluetooth and nearby devices
Contacts
Local network access
Notifications
Advertising tracking
Choose “only while using the app” or another limited option when it is available and sufficient. Disable permissions that are not necessary for the feature the child uses.
Recheck permissions after software updates because settings and features can change.
Pay Special Attention to Cameras and Microphones
Connected toys may listen for commands, record conversations, or transmit audio to process a child’s request. Parents should determine whether the device provides a visible or audible sign when its microphone or camera is active.
Ask:
Is the device always listening for a wake word?
Are recordings stored or immediately deleted?
Can employees or contractors review recordings?
Can the microphone or camera be physically disabled?
Can another user connect to the toy remotely?
Are recordings used to improve the product or train automated systems?
Consider where the toy will be used. A connected camera or microphone in a child’s bedroom can capture more private information than the same device used in a shared family room.
Check Communication and Sharing Features
Some children’s products allow users to send messages, upload images, join multiplayer games, or share creations. These features may expose information to strangers or other users.
Review whether:
Communication is limited to approved contacts
A child can receive messages from unknown users
Profiles are public by default
Photos or recordings can be uploaded
Location information appears in posts
User-created content is moderated
Parents can disable chat or sharing
Blocking and reporting tools are available
Teach children not to share their full name, school, location, schedule, passwords, or family details through a toy or game.
Use Parent Controls and Strong Account Security
Create the parent account yourself rather than allowing the child to complete setup alone. Use a unique password and enable two-factor authentication if the company offers it.
During setup:
Enter only information that is required
Avoid using the child’s full name in a public username
Keep the child’s exact birth date private when it is not required
Turn off public profiles and unnecessary sharing
Limit purchases and external communication
Review friend or contact requests
Disable personalized advertising when possible
Install security and software updates
Do not reuse the same password across toy, shopping, email, and family accounts. A breach involving one service could otherwise expose several accounts.
Consider Whether the Data Is Necessary
A product should not require a child to provide more personal information than is reasonably necessary to participate in an activity covered by COPPA.
Parents can apply a similar test before granting permission: Does the requested information make sense for the function?
A map-based game may need location while it is being played. A basic puzzle game usually does not need continuous precise location. A voice-controlled toy may need temporary audio to answer a question, but parents should still ask whether the recording is retained.
When two products offer similar features, the one collecting less information may be the more practical choice.
Know the Parent’s COPPA Rights
For a service covered by COPPA, parents generally have the right to:
Receive notice about the company’s information practices
Decide whether to consent to collection
Review personal information collected from their child
Request deletion of the child’s information
Prevent further use or collection
Refuse certain disclosures to third parties
Revoke previously provided consent
A company may end access to a service when the information is necessary for it to function and the parent withdraws consent. The company should still explain the deletion process and any information it must retain for legitimate legal or operational reasons.
Keep copies of consent notices and deletion requests. Take screenshots if account settings do not provide a downloadable record.
Delete Data Before Selling or Discarding a Toy
Connected products should be treated like other smart devices when they leave the household.
Before donating, reselling, returning, or discarding one:
Delete the child’s profile
Remove stored photos, audio, and messages
Unlink parent and child accounts
Disconnect third-party services
Remove payment information
Perform a factory reset
Remove memory cards
Delete the companion app if it is no longer needed
Ask the company to delete server-stored information
A factory reset may erase information stored on the toy without deleting information already held by the company. Complete both processes when applicable.
Respond to a Concerning Privacy Practice
If an app or toy appears to collect children’s information without appropriate notice or consent, first save relevant evidence. Keep the privacy policy, screenshots, emails, permission requests, and account records.
Contact the company and ask:
What information was collected?
When and how was it collected?
Why was it needed?
Which parties received it?
How can the parent access and delete it?
How can future collection be stopped?
Parents can report suspected violations of federal consumer privacy requirements to the Federal Trade Commission. A state attorney general or state consumer-protection agency may also accept complaints.
If account information may have been exposed, change the password immediately, enable stronger account security, review linked services, and monitor the associated email and payment accounts.
Remember That State Laws May Provide Additional Rights
COPPA focuses largely on information collected online from children under 13. State privacy laws may provide broader protections, including rights affecting teenagers, targeted advertising, profiling, data sales, deletion, or consent.
The protections available to a family can depend on the child’s age, the company’s practices, the state where the family lives, and whether a particular law applies to that business.
Schools may also use apps and connected services under separate rules and agreements. Parents can ask the school what information a service collects, whether it is used only for educational purposes, which company controls it, and when it will be deleted.
Use a Short Privacy Checklist
Before approving an app or connected toy, confirm that you can answer these questions:
What data does it collect?
Which features collect audio, images, or location?
Why is each type of information needed?
Who receives the information?
Can optional collection be turned off?
How long will the data be retained?
Can the parent review and delete it?
Are communication features private by default?
Does the company provide security updates?
Can the device and online account be completely erased?
A toy’s entertainment or educational value should be weighed against the information it requires. Choosing products with limited collection, useful parent controls, and clear deletion options can reduce unnecessary exposure while allowing children to use connected technology.
Disclaimer: This article provides general information and is not individualized legal advice. Children’s privacy rights and company obligations may vary according to the child’s age, the service involved, and federal or state law. Parents may wish to contact an attorney, regulator, or consumer-protection agency about a specific situation.
