Short answer

AI toys and connected kids' devices can record a child's voice, send it to the cloud and, in some products, pass conversations to third-party AI services. In the US, the FTC treats a child's voice recording as personal information that generally needs verifiable parental consent. Before buying, read the privacy policy, check deletion options and decide whether the toy needs to be online at all.

Key takeaways

  • Under the FTC's COPPA guidance, audio files of a child's voice are personal information and generally require verifiable parental consent.
  • The FTC lists connected toys, smart speakers and voice assistants as covered online services when directed to children under 13.
  • Mozilla's 2023 buyers' guide reported that Moxie, an AI robot for children, records and shares its conversations with Google and OpenAI.
  • Mozilla also reported FTC action over Alexa keeping children's voice recordings for years; Amazon agreed to pay $25 million.
  • A toy that stops working unless parents consent to data collection leaves little real choice.

What makes an AI toy different

Older smart toys played recorded phrases. AI toys and robots hold open-ended conversations, which usually means a microphone, an internet connection and a company server that processes what the child says. Some pass that audio or text on to other AI providers. A child may confide in the toy in ways they would not with an adult, and may not understand that a company is listening.

What US rules say

The FTC enforces the Children’s Online Privacy Protection Rule (COPPA). Its guidance says the rule covers commercial online services directed to children under 13 that collect personal information, and general-audience services that actually know they are collecting from children under 13. Operators must post a privacy policy, give parents direct notice and get verifiable consent before collecting children’s personal information. The FTC’s FAQ lists connected toys, smart speakers and voice assistants as covered online services and treats photos, videos and recordings of a child’s image or voice as personal information. Audio files of a child’s voice require verifiable parental consent.

The rule also expects operators to keep children’s information only as long as reasonably necessary for the purpose it was collected, and lets parents revoke consent and direct deletion. Rules differ in other countries, so check your local data protection authority.

What researchers have found

Mozilla’s 2023 buyers’ guide ranked children’s connected toys and apps among the worst for privacy because they collect and reuse large amounts of data. It reported that the Moxie robot records and shares its conversations with Google and OpenAI, and that parents must consent to data collection or the robot will not work. It also cited the Alexa case, in which Amazon agreed to pay $25 million over charges that it kept children’s voice recordings for years, ignoring some deletion requests and sometimes using the data to train algorithms. Amazon disputed Mozilla’s wider findings in separate coverage. These are Mozilla’s findings from 2023, so check whether a product has changed.

A parent’s checklist before buying

  1. Does it need the internet? An offline mode or a hardware mute switch reduces exposure.
  2. What is recorded and sent where? Look for named third parties and any mention of AI training.
  3. Can you delete it? Find the deletion steps in the app and use them.
  4. Is an account or a child’s name required? Use the minimum, and a parent email.
  5. How does it respond to hard topics? Test it before your child does.

Talking to your child

Children should know that a toy is a machine owned by a company, and that private things stay private. If a toy asks for a name, address or school, they should stop and tell you. For older children using chat apps and companions, see AI companions and teen safety and AI tools in schools: a parent guide.

Voice recordings can be misused: a few seconds may be enough to clone a voice, as covered in protect your voice from cloning. If a toy maker is breached, treat it like any other leak and follow data breach: what to do.

What you can do

  1. 01Read the privacy policy before the box is opened: look for what is recorded, who receives it, how long it is kept and whether it is used to train AI.
  2. 02Check that you can delete your child's recordings and account, and test that the delete option works.
  3. 03Prefer toys with a physical microphone switch, offline modes and no account requirement.
  4. 04Set up the toy yourself, use a parent email, disable optional sharing and keep the toy off bedroom and bathroom areas.
  5. 05Test it first: ask the toy a few questions a child might ask and see how it responds to sensitive topics.
  6. 06Teach children not to share their name, address, school or secrets with any toy or chatbot, and tell them they can switch it off.

Related reading: AI voice clone scams and the data breach tracker.

Frequently asked questions

Is a child's voice recording protected by US law?

The FTC says audio files of a child's voice are personal information in themselves and require verifiable parental consent under COPPA. There is a narrow non-enforcement policy for brief voice requests used only as a replacement for typed words and deleted promptly, with a clear notice.

Does COPPA cover smart toys?

The FTC's COPPA FAQ lists connected toys, smart speakers and voice assistants among covered online services, when they are directed to children under 13 or knowingly collect their data.

Can an AI toy say something inappropriate?

Toys built on general AI models can answer unpredictably, so test the toy yourself, look for age ratings and content controls, and supervise early use. We did not find a primary source to cite for specific toy incidents, so we do not name products here.

What if the toy only works if I accept data collection?

Mozilla noted that Moxie's policy says refusing consent to data collection renders the robot inoperable. Treat that as a reason to weigh the purchase carefully, since declining is not a practical option.

Sources

  1. Complying with COPPA: Frequently Asked Questions, Federal Trade Commission
  2. Children's Online Privacy Protection Rule: Not just for kids' sites, Federal Trade Commission, 2026-05-01
  3. A nightmare before Christmas: Mozilla researchers find many popular tech gifts perform worse on privacy than ever before, Mozilla Foundation, 2023-11-15

This article reflects public information as of 2026-11-06. AI tools and rules change quickly; we update articles when new facts are published. Spot an error? See our editorial and corrections policy.