In these days of home Wi-Fi and 5G connectivity, a parent will be tempted to ask, “Why not buy an internet-enabled toy for my child?”
The answer to that question will lead to the purchase of smart watches, child-friendly tablets, talking toys, app-based playthings, name them.
Whereas the manufacturer will give assurances that all is well with these playthings, a recent project that involved hacking into some of the world’s best-selling smart toys showed that there is a risk of exposing sensitive information about your household and your child to strangers.
A study by the Mozilla Foundation, released in December 2025, involved hiring Ireland-based cybersecurity consultancy firm 7ASecurity to attempt to hack into 10 popular toys.
“Our researchers found that many ‘smart’ toys aren’t as clever as they should be when it comes to privacy,” said the foundation in a report, dated January 14.
Among the 10 was a tablet designed for children aged three to seven. There was also a mini-robot companion that plays with someone at their desk. They also looked into a well-known Bluetooth-enabled Rubik’s Cube.
Also analysed were two popular children’s smartwatches that have video call and location tracking capabilities.
The researchers equally explored an AI-powered robot with the capability to have conversations with children and even tell them bedtime stories.
They also studied a game that connects to a phone or tablet, which helps children understand mathematical concepts.
Lastly, they examined a paper aeroplane that connects to smartphones; a ball and toy set that connect to a smartphone; and a box with music playing, storytelling and gaming capabilities.
From their analysis, the consultants found many ways a toy can be dangerous to a child and their household. Below are the five of them.
1. A stranger may listen to household conversations
The analysis found that some toys that can make recordings and connect to the internet may inadvertently turn into listening devices within your home.
If a toy’s Bluetooth or Wi-Fi security is weak, it said, attackers may activate microphones or cameras remotely, eavesdropping on private conversations or capturing images without anyone knowing. To stay safe, it recommended disabling microphones.
“If possible, you should also disable features like a toy’s camera and microphone when not in use,” advised the Mozilla Foundation.
Toys that can make recordings and connect to the internet may inadvertently turn into listening devices within your home.
Photo credit: Shutterstock
2. Your data may be collected and stored elsewhere
Without transparent documentation from manufacturers, the study found, it can be difficult to know exactly what data is being collected, how it is used, and who has access to it. It did not help matters that most of the sellers had explanations full of legalese regarding what they do with the data they collect.
“In other cases, the relevant information is buried under pages and pages of legalese, which makes it extremely difficult to understand exactly how and where your child’s data is being used,” said the foundation.
Some of the information that can be shared with third parties includes audio, video, location, and usage patterns that can help someone determine a family’s routines.
3. A stranger may remotely control your devices
The security analysts found that Bluetooth vulnerabilities in toys can allow attackers within pairing range to hijack a device. Once connected, they said, the attackers can make the toy play unexpected sounds, flash lights, or even move erratically, in the process disturbing children or frightening them.
“In at least one case, we’ve seen that a Bluetooth exploit could lead to total permanent take-over of the device. Your child’s toy could be compromised for days or weeks without you having any way to know,” the Mozilla Foundation stated.
“If a device with poor Bluetooth security also has access to a microphone or camera, an attacker could activate it to eavesdrop on conversations, or track the toy’s location if it’s GPS-enabled,” it also warned.
4. Home network may get compromised
More advanced attackers may use a weakly protected toy as a way of invading a home network. By exploiting toys with poor authentication, hackers could pivot from the toy to other devices such as computers, smartphones, smart home systems, or security cameras. While this is less common, it poses a significant risk for families with high-profile members or sensitive information in their household.
Mozilla Foundation advises that, to be on the safe side, parents can consider having separate networks for their toys.
“Keeping any toys you’ve bought on a separate Wi-Fi network or turning Wi-Fi off is also a good idea, just in case,” it said.
5. Someone else might access your data when you give out the toy
The project found that even after they are done with a smart toy, parents may leave data accessible to others if they give it out. This is because deletion of saved data is not always straightforward, meaning the next user of the toy may be able to extract information once saved in it.
“If you’re not properly wiping all stored data from the toy before it passes out of your hands, it’s a potential privacy threat,” the report said. “Depending on what the toy has recorded, an attacker could have access to anything from intimate family discussions to clues about the layout of your house.”
Some of the data the next person can obtain, it said, includes addresses, phone numbers and daily routines.
Location data embedded in photos can also be given out, same as names of family members and time stamps showing when the home is occupied or empty.
Mozilla advises these steps to avoid that eventuality: “Factory-reset the device, remove the [memory] card alongside any internal storage and dispose of them separately, and delete any accounts you have with the manufacturer.”
A digital privacy and cybersecurity expert who broke down the report for Mozilla Foundation gave some rather drastic advice for parents who want to avoid all the hassle: “Buy low-tech [toys] until the toy industry as a whole adopts regular third-party auditing for internet-connected toys.”
