My Friend Cayla was an internet-connected 18-inch doll sold in Europe and the United States, including a U.S. release in August 2015. Its microphone transmitted a child’s speech over Bluetooth to an Android or iOS app, which converted the speech to text, searched the internet for responses, and sent synthesized answers back to the doll. The design created a live audio pathway from a child’s environment to a connected device and online services.
In February 2017, Germany’s Federal Network Agency classified Cayla as a concealed espionage device under the German Telecommunications Act and told parents to destroy dolls in their possession. The agency said the Bluetooth connection was insecure and could allow someone within roughly 10 meters to access the doll’s speaker and microphone. Security researchers Ken Munro of Pen Test Partners and Tim Medin of Counter Hack separately demonstrated Bluetooth-based control, claims attributed to those researchers rather than an established record of mass exploitation. The Norwegian Consumer Council also criticized alleged data sharing, targeted advertising, and hidden product promotion. The source reports that the U.S. Federal Trade Commission investigated whether uploading children’s speech violated privacy, but does not establish a final FTC enforcement finding.
