It's everything a kid ever dreamed of — toys that can talk back. But are internet-connected toys safe?

Robert Merkel, a father of one, is no digital purist.

He occasionally posts pictures of his nearly two-year-old daughter on Facebook, but Dr Merkel finds it difficult to recommend anyone buy a smart toy.

From board games to rubber duckies, these playthings are becoming connected to the internet via Wi-Fi, Bluetooth and apps.

Depending on its capabilities, the toy could be recording voice messages, internet history and location data.

A doll with speech recognition, for example, is only possible thanks to sensors, microphones and online data storage.

"If it's got a microphone in it, would you be comfortable with that microphone being on in your house, potentially 24 hours a day?"

Dr Merkel, a software engineering lecturer at Monash University, is not alone in his concerns.

Earlier this year, the FBI warned US parents about the privacy and security risks posed by internet-connected toys.

What are the risks?

Smart toys are popular gifts, but an internet connection can turn a cuddly teddy bear into something creepier.

Take the case of CloudPets, an internet-connected soft toy that let adults and kids remotely record messages. In February, it was reported that a CloudPets database was publicly accessible.

The leak included emails and passwords, and voice recordings of children were also insecurely stored.

Loading...

No-one wants photos of their kids in the hands of strangers, and leaked information can do damage.

Details such as children's names and birthdates are often used by parents as part of their passwords, Dr Merkel says.

"When the customer databases of toy vendors get hacked, [the hackers] discover reused passwords, they discover a bunch of names they can use to try and crack more passwords."

Not to mention, personal details such as your home address can be used for identity theft and online scams.

So what can you do to reduce your risk — apart from not buying internet-connected toys at all?

Do your homework before you buy

Before purchasing an internet-connected toy, Peter Zaluzny suggests you research the toy vendor's security record.

Try to find out whether the company has been hacked before, how the company responded, and how long it took to inform customers of the breach, says Mr Zaluzny, a technology journalist with the consumer advocacy group Choice.

And, if you do purchase a toy, Mr Zaluzny recommends sharing as little information as possible with the manufacturer. This could include email addresses, photos, names and ages, among other details.

Loading...

Often, it is impossible to say whether information collected by a smart toy is securely stored or even where it is stored.

"Behind any of the smart toys … there are a whole bunch of computers," Dr Merkel says.

"Not even security professionals can tell whether [toy vendors] are doing their job properly and you're only going to find out when there's a data leak."

Of course, this is the case with any internet-connected device, including your smartphone. But Dr Merkel points out that Apple and Google spend a lot of time and money making their smartphones reasonably secure.

"Apple and Google hire large numbers of the best information security people out there," he says. "That doesn't apply to your average smart toy vendor."

If you have a smart toy, keep it safe

Nothing connected to the internet is 100 per cent safe, but if you do have a smart toy in the house, make sure it is as secure as possible.

If it uses Bluetooth, Mr Zaluzny recommends ensuring the connection is locked down with a password.

This article contains content that is not yet available here.

If left insecure, someone nearby could "tap into the toy" and potentially use it to communicate with the child, among other risks.

Remember that just like a smartphone, the toy's software may require updates. If one becomes available, make sure you download the update quickly — it could contain vital security improvements.

And, disconnect immediately if something seems awry, Mr Zaluzny adds.

Finally, if the product is not being used, turn it off and disconnect it from the internet.

The internet privacy group Mozilla has also created a a connected gift guide, which includes specific toy advice.

Talk to your kids about online safety

Andrew Levins, a DJ and writer in Sydney, has a boy who is almost four and a girl who is one-and-a-half.

He wants his children to be comfortable and skilled with technology, but internet-connected devices will be allowed on a case-by-case basis. It may depend on the level of personal information the toy demands, for example.

"I think the age requirements for Facebook and Instagram are good, so if there was stuff that required them to enter their personal information and upload photos, I would wait until they're of an age to know what to do and what not to do," he says.

Smart toys can be a good opportunity to start conversations with your kids about online safety and how the internet works, Mr Zaluzny says.

He suggests parents try to understand what the product can do "inside-out".

"That way, they can learn what's appropriate for their child to do using that product," he says.