A practical guide to AI toys and what parents can do to make them safer

If your child unwrapped a talking teddy or a smart robot this Christmas, you may be wondering what it really does – and what kind of data it collects. Cybersecurity and children’s safety experts weigh in on the real risks of AI toys and the simple steps parents can take to make them safer.

AI-enabled toys have quietly crossed from novelty to mainstream, and many parents are only now realizing that what looks like a harmless gift may also be a permanently connected device, capable of recording voices, generating conversations, and transmitting data beyond the confines of their living rooms.

You may have chosen the toy yourself, reassured by promises of education, creativity, or companionship. Or it may have been given by a grandparent or relative who had no idea the cuddly bear or cartoon bunny needed WiFi, an account, and ongoing software updates.

Either way, the days after Christmas are often when unease sets in. In days gone by, you only needed to worry about whether batteries were included. Now parents need to ask: what exactly does this toy do, what data does it collect, and where does that information go?

These questions are starting to matter more. In early 2025, a partnership between OpenAI and Mattel underlined just how quickly generative AI is moving into children’s toys and devices.

This year, research from the US Public Interest Research Groups (PIRGs) revealed that several AI toys already on sale were capable of generating inappropriate content and offering dangerous advice to children.

The news hammered home the fact that connected devices, powered by large language models, require the same level of scrutiny as anything else that plugs into the internet.

From Teddy Ruxpin to generative AI

One cybersecurity expert I interviewed lamented that we are no longer in the Teddy Ruxpin era.

When Teddy Ruxpin appeared in the 1980s, its magic came from cassette tapes and pre-recorded phrases. It felt interactive, but it was entirely predictable.

Today’s AI toys are fundamentally different. They generate responses in real-time, remember previous conversations, and adapt their tone and behavior based on how a child interacts with them.

Popular culture has already explored the extreme version of this idea. The horror film M3GAN exaggerated the dangers for dramatic effect, but experts say the underlying concern is real: when toys speak convincingly and respond emotionally, children may trust them in ways parents don’t expect.

What the research on AI toys has uncovered

Those concerns were reinforced earlier this month when the US PIRG Education Fund tested four AI-enabled toys sold in 2025. Among them were the Kumma Bear and the Alilo Smart AI Bunny, a popular product on Amazon marketed to very young children.

The findings were alarming. The Kumma Bear was found to engage in conversations involving sexually explicit topics and to offer potentially dangerous advice.

Following the report, Larry Wang, CEO of Singapore-based FoloToy, confirmed that the company had withdrawn the Kumma Bear and the rest of its AI-enabled toy range after researchers raised concerns about inappropriate conversations, including discussions of sexual fetishes and instructions on how to light a match.

The Alilo Smart AI Bunny raised similar red flags. Despite being aimed at toddlers, testers found it could generate definitions of terms such as “kink” and describe bondage when prompted.

These were not sophisticated attacks or fringe scenarios. They were ordinary interactions, revealing how easily powerful language models can drift beyond child-appropriate boundaries when safeguards fail.

Do children need AI toys at all?

Among the cybersecurity experts and children’s safety specialists I spoke with, there was no single consensus on whether children should have AI toys in the first place, although some child advocacy groups are very vocal on this matter.

Zaki Barzinji, senior director at Aspen Digital, is among the most skeptical voices.

Barzinji has spent years working at the intersection of technology, youth policy, and equity, including serving in the White House as a senior associate director of public engagement and liaison to underrepresented faith communities. His work has long focused on how emerging technologies affect young people.

“Generally speaking, no toy really needs to be connected to the internet for any purpose, let alone for running a large language model on your kid,” he says.

Barzinji does acknowledge that adaptive learning technologies can be beneficial, particularly for children with different learning or communication styles. But he argues that the most effective versions of those tools tend to be applications running on tablets or laptops, where parents can see what’s happening and intervene when needed.

“Once these models are in your kids’ toys,” he says, “there’s very little you can do to track and monitor.”

Others are more cautious than opposed. Anne Cutler, a cybersecurity evangelist at Keeper Security who works closely with families on digital safety, believes the decision ultimately rests with parents.

“There are benefits and there are risks,” Cutler says.

“It’s up to the parent to decide if those benefits outweigh the risks.”

AI toys – the benefits plus risks parents miss

Cutler is quick to acknowledge why AI toys appeal to families.

“They can have these customized, very real-feeling conversations with your children,” she says.

“They’re adaptable, they get to know your child, they can be educational, and they can help with homework.”

Julie Mungai, a senior attest services manager at BARR Advisory who conducts cybersecurity and compliance audits for US-based and international organizations, agrees that AI toys can support learning.

“They can read stories aloud, answer questions, help with early education, and encourage social-emotional development,” she says.

“For kids who struggle with reading or attention, that interactivity can be engaging and motivating.”

But both stress that the risks are often poorly understood. “These devices look cute and harmless,” Mungai says, “but behind them sit powerful LLM models that generate conversational replies with broad creative freedom.”

Cutler breaks those risks into three overlapping categories: privacy, safety, and cybersecurity.

“All of this data is being collected,” she explains.

“If you don’t know how it’s being managed by the company, that puts you, your family, and your child at risk.”

LLM-powered toys create a new attack surface

Connected toys have existed for years, but experts say large language models fundamentally change the equation.

“Even with product-native filters, LLMs can generate off-topic or sensitive responses,” Mungai says.

“Children may treat the toy as a friend, mentor, or authority figure, even when the toy can be wrong.”

Nik Kale, principal engineer for Cloud Security and AI Platforms at Cisco, urges parents to think less like shoppers and more like security managers.

“Parents should start shifting their mindset from ‘buying a toy’ to ‘bringing a new, untrusted device into the home network,’” he says.

“These toys often have the technical capabilities of a smart speaker, but without the security investments made by major tech companies.”

“The most significant risk in 2025 isn’t just hacking – it’s behavioral profiling,” he adds.

A connected toy with a microphone or camera can quietly build a detailed model of a child’s voice, emotions, routines, and interactions long before they are old enough to consent.

If that data is stored insecurely or used for “product improvement,” it can create a digital profile of a child that persists for years.

Don’t humanize AI

One of the strongest warnings from experts was not technical, but psychological.

“Resist the urge, as much as possible, to ascribe personality, critical thinking, or any other form of anthropomorphisation to an AI toy,” Barzinji says.

He acknowledges that this may take some of the magic away, but believes the trade-off is essential.

“It’s important to lay a proper foundation and context for what AI is and what it isn’t as early in your child’s development as possible,” he says.

Barzinji points to his own household.

“My kids have a Google Home Mini in their room that is meant primarily for playing audiobooks at bedtime,” he explains.

“But sometimes they sneakily ask questions like, ‘Hey Google, can you fart?’ to which Google willingly replies. But that, at least for now, is the extent of Google Home’s capabilities. It’s not having full-on conversations with them.”

That distinction matters, he argues, because a child who understands that a toy’s “intelligence” is a clever trick rather than genuine thinking is less likely to over-rely on chatbots later in life for sensitive questions or emotional support.

What parents should look for on manufacturers’ websites

One of the most practical steps parents can take happens before a toy is even switched on is scrutinizing the manufacturer.

Security experts consistently stressed the importance of transparency. Responsible manufacturers clearly explain what data a toy collects, where that data is stored, whether it is shared with third parties, and whether it is used to train AI models.

Vague language about “product improvement” or “enhancing user experience” should raise questions, particularly when voice recordings or video are involved.

Security update policies matter too. Kale advises parents to look for clear statements about how long a company will provide firmware updates and how it handles vulnerability disclosures.

“If a manufacturer doesn’t mention security updates at all,” he says, “it’s generally a red flag.”

Barzinji adds that parents should favour products reviewed by trusted consumer protection organizations, such as Consumer Reports or the US Public Interest Research Group, rather than relying solely on marketing claims.

Precautions that make a difference

Once an AI toy is in the home, experts agree that configuration and environment matter as much as the product itself.

Cutler stresses that AI toys should never function as babysitters.

“They should be used in a shared space,” she says.

“Parents should be listening, understanding what’s being talked about, and what their kids are being exposed to.”

Kale highlights one of the most important technical safeguards parents can put in place: network separation.

“Never place smart toys on the same WiFi network as your phones, laptops, or work devices,” he advises.

Many modern routers allow guest networks or separate IoT networks, which limit the damage if a toy is compromised.

Regular software updates are critical. Because these toys are connected to the internet, vulnerabilities will be discovered over time. Applying updates promptly helps close security gaps that could otherwise be exploited.

Talking to children about “digital ears”

Technical settings alone are not enough. Shaila Rana, a cybersecurity, AI, and IT professor at Purdue Global, says parents need to talk openly with their children before and during use.

“Explain that the toy remembers things and sends them somewhere else – to a company’s computer,” she says.

“Make it age-appropriate, but be honest.”

Rana believes these conversations help children develop critical thinking skills.

"I call it digital consent for children,” adds Kale. “Explain that the toy has 'digital ears' and that it’s okay to play with it, but not to share personal details like addresses or routine information. A good rule of thumb is: “Don’t tell the robot anything you wouldn’t tell a stranger at the park.”

Bye bye robot: when a toy is no longer welcome

One detail parents often overlook is what happens when an AI toy leaves the home.

Throwing the toy away does not delete cloud-stored data. Accounts may remain active, and voice recordings may persist unless parents explicitly request deletion. Laws such as COPPA (Children's Online Privacy Protection Act), CCPA (California Consumer Privacy Act), and, in Europe, GDPR (General Data Protection Regulation) give parents the right to review and delete their children’s data, but those rights only matter if families actively exercise them.

If a parent decides an AI toy no longer belongs in their home, experts advise closing associated accounts, requesting data deletion, and confirming that recordings or profiles have been removed.

AI toys can be entertaining, educational, and even comforting. But they are also powerful connected systems that collect data, shape behaviour, and influence how children understand technology.

While experts do not agree on whether children should have AI toys at all, they’re unanimous on one point: blind trust is not an option.