The microphone is only step one
A child says, “Tell me about dinosaurs.” The toy might recognize a wake word locally, send the next few seconds to a cloud service, convert the speech to text, retrieve an answer, and send audio back. Another toy may store only the command text. A simpler toy may react to sound volume without recognizing words at all.
That is why “has a microphone” and “stores recordings” are different statements. Parents need the complete path.
Capture
When does the microphone listen—always, after a button press, or after a wake word?
Process
Does the device handle the command locally, or transmit audio to a company or service provider?
Retain
Is audio or a transcript stored, for how long, for what purpose, and with which deletion option?
What COPPA says about a child’s voice
In the United States, the Federal Trade Commission explains that an audio file containing a child’s voice is personal information under the Children’s Online Privacy Protection Rule. Covered child-directed services generally need verifiable parental consent before collecting personal information from a child under thirteen, unless a limited exception applies.
The FTC also describes a narrow non-enforcement policy for a voice recording used only as a replacement for typed words—for example, to fulfill a verbal request—when the recording is kept only briefly, used for no other purpose, and destroyed. The operator still must clearly explain its audio collection, use, and deletion practices. This exception does not erase other COPPA duties or cover a request for other personal information such as the child’s name.
Seven questions to answer before setup
- What activates the microphone? A physical button is easier for a child to understand than an always-ready listening state.
- Does audio leave the toy? Look for terms such as cloud processing, voice service provider, speech recognition, or subprocessors.
- What is retained? Check raw recordings, transcripts, conversation history, and training or product-improvement language separately.
- How long is it kept? “Only as long as necessary” is less useful than a specific retention period or event.
- Can a parent review and delete it? Find the control before the child builds months of history.
- Can voice features be disabled? The toy should remain useful enough for your family if you decline an optional connected feature.
- Who else receives data? Check service providers, advertising, analytics, AI-model providers, and business-transfer language.
A five-minute family privacy setup
- Use a parent-controlled email address and a unique password.
- Install current firmware and app updates before the first play session.
- Decline optional sharing, personalization, or training settings you do not want.
- Turn off camera, microphone, location, or contacts permissions that are not needed.
- Show your child the microphone indicator or button in simple language.
- Create one rule: never tell a toy your full name, school, address, password, or family secrets.
- Set a reminder to review the account and deletion controls after the novelty period.
How to explain it to a child
“A talking toy is still a computer.”
You can ask it about space, animals, jokes, or stories. Keep private things—your last name, school, address, passwords, and anything that would identify our family—between you and a trusted grown-up.
Red flags in a privacy notice
- The notice never explains whether voice data leaves the device.
- Retention is described only with vague, open-ended language.
- Deletion requires a process the company does not clearly identify.
- Optional advertising or profiling is bundled into the core toy experience.
- The privacy notice and app-store permission list contradict each other.
- The product page makes strong privacy promises that the actual policy does not support.