A new study conducted by University of Washington researchers has found that kids don’t know their toys record their conversations. Parents are understandably worried about their kid’s privacy when they play with these toys. In general, internet security can however be greatly improved by using one of the many free VPN servers available today. The research was conducted via a series of in-depth observations and interviews.

CogniToys’ Dino, Hello Barbie and other toys are connected to the internet and are able to joke around with children. They are also able to respond to questions posed by their young owners in surprising detail. The voices of kids who interact with the toys are recorded and these recordings are stored in the cloud, helping to make the toys “smarter.”

Emily McReynolds, an associate director of the UW’s Tech Policy Lab and co-lead author of the study noted that the toys record and transmit in the home, a place that’s historically very well-protected legally. Although people have very different perspectives about their privacy, these are brought to the front when a child is given such a toy.

The paper was presented at the CHI 2017 Conference on Human Factors in Computing Systems.

The growth of internet connected toys in the market has not been without public scrutiny and security breaches. VTech, a company that manufactures children’s tablets, stored personal data of more than 200,000 children when its database was hacked in 2015. Cayla toy was banned in Germany earlier this year over concerns that personal data might be stolen.

The research team held interviews with nine parent-child pairs, asking questions ranging from if a parent would purchase the toy, or share their child’s conversation with it on social media, to whether the child liked the toy and would tell it secrets.

The children, all from 6 to 10 years old, were also observed playing with CogniToys’ Dino and Hello Barbie. The researchers chose these toys for the study because of their stated privacy measures. Parents for example have to go through an extensive permissions process when setting up Hello Barbie and it has been praised for its strong encryption practices.

Almost none of the children taking part in the study knew the toys were recording their conversations. The researchers also noted that the lifelike exteriors of the toys probably drove the kids’ perception that they are trustworthy.

Maya Cakmak, an assistant professor at the Allen School and co-lead author explained that the toys are social agents that might compel children to disclose things they wouldn’t tell a cell phone or computer. The social exterior of a toy might fool people into being less secure with what they tell it. In this respect, children are even more vulnerable than adults are.

Some kids were worried by the fact that their conversations were being recorded. When a parent explained how a conversation with the doll could possibly be shared widely on the computer, the child responded: “That’s pretty scary.”

In an article on CNET, it was reported that a complaint was filed with the US Federal Trade Commission alleging that Genesis Toys and Nuance Communications violate rules that protect kid’s privacy and prohibit unfair and deceptive practices.

The researchers feel that toy designers should as a minimum create ways for the device to inform children when they are being recorded. Recording notifications could be more humanlike, for example having Hello Barbie say, “I’ll remember everything you say to me” rather than using a red recording light that won’t necessarily make sense to a child in that context.

The study also uncovered that many parents were worried about their kid’s privacy when playing with the toys. They all wanted parental control by being able to disconnect the toy from the internet, or regulate the type of question to which the toy would respond. The research team recommends that toy designers should delete recordings after a period, or give parents the option to delete conversation permanently whenever they want.

A recent UW study showed that when video recordings are filtered to preserve privacy, the toy could still can still perform useful tasks, such as a tele-operated robot being able to organize objects on a table.

The researchers are hopeful that this look into the privacy concerns of parents and kids will inform both toy designers and privacy laws, given that these devices will continue to appear both in the market, and at home.