The box says "it's amazing what she knows," but security experts say the "My Friend Cayla" doll also makes it easy for strangers to know your child. The doll uses blue tooth technology to connect to a device with no PIN or password required.
"On a scale of one to ten this doll was definitely one to hack," said Ken Munro with Pentest Partners, who discovered the vulnerability in 2015. "I don't think anybody takes this seriously enough. What bothers me is we're expecting parents to become computer security experts and that's not realistic."
RELATED: Germany bans talking doll due to security concerns
Privacy groups are taking action. Last December the Electronic Privacy Information Center in Washington filed a complaint with the F.T.C. about Genesis toys, the maker of My Friend Cayla and the robot I-Que. The complaint cites ease of access and how the app recordings were sent to a third party software company, Nuance Communications, without making it clear to parents.
The Children's Online Privacy Protection Act, or C.O.P.P.A, sets strict guidelines on how parents must be notified about information collected on their children.
"The parent has to actually know what is going on and then say 'yes, I agree.' The box cannot already be checked. It cannot be just hidden somewhere in the terms of service. It's supposed to be a moment where the parent realizes what's going on and says 'yes, I'm okay with that,'" said Munro.
RELATED: Do some toys threaten your child’s privacy?
Even if parents are notified, understanding how the information is stored is key.
"It's going to the cloud. That's the basic thing for so many of our devices," said Munro.
Child user profiles and recordings collected by some other companies have also been compromised. In 2015, V-Tech Toys was hacked exposing over six million child profiles. Plus, security researchers recently discovered that people could access voice recordings of Spiral Toys Cloudpets. Munro said that the best way to make sure your children's privacy is secure is to
not give out their information in the first place.
"It's really more of a problem of how we as Americans view our privacy, and we keep giving more and more information out, " said Munro. "Eventually, we're not going to have any more privacy if we don't stop."
The F.T.C. would not comment on their investigation of complaints against Genesis Toys and Nuance.