Kids' smartwatches and connected toys: what to check before you give one

They can be, if you choose them and set them up with care. A connected toy or a children’s smartwatch is a small computer with a microphone and often a camera or a location chip, tied to an app and an online account. The problems that consumer groups and regulators have documented sit mostly in that app and account: who can reach the child, who can see where they are, and what is stored. Those are things you can check before buying and settle during setup.

This guide does not rank brands: models change quickly, and the same questions apply to all of them.

What can go wrong with a connected toy or watch?

Italy’s data protection authority, the Garante, lists the main risks on its smart toys page: someone getting into the toy over the network and reaching its data, microphone or camera; toys collecting more than they need, such as location; a listening toy building up a picture of the family’s habits; and data kept on the maker’s servers after the toy is gone.

Tests have shown these risks are real. In October 2017 the Norwegian Consumer Council published WatchOut, a test of four children’s smartwatches. On some of them a stranger could, in a few steps, take control of the watch to track the child, listen in and talk to them. Some data was sent and stored without encryption, SOS and approved-number features on some models were poorly made, and alerts when the child left a set area were unreliable. The makers said some flaws had been fixed, and models have changed since 2017, but the lesson holds: a safety feature that does not work gives a false sense of security.

In January 2018 the US Federal Trade Commission settled its first children’s privacy case involving internet-connected toys, alleging that the maker had collected children’s information through an app without getting parents’ consent and had not kept it secure.

Why is a watch that can listen in a special case?

Some children’s watches have offered a “monitor” or “baby phone” mode: from the app, a parent sets the watch to call a number silently, so the caller hears the child and everyone nearby without anyone noticing. Germany’s federal network agency, the Bundesnetzagentur, banned the sale of children’s watches with this function as unauthorized transmitting equipment, as a German federal government page explains. The agency had found such watches being used to listen to teachers in class, and advised parents who had one to make it unusable and keep proof that they had done so.

The ban is about a feature, not about smartwatches as such. A later government page on smart toys says watches with a built-in phone raise no concerns in principle, and passes on the agency’s test: if the microphone or camera can be accessed secretly from outside, the device is prohibited in Germany. It is a useful question to ask anywhere.

What should you check before buying?

Most answers are on the product page, in the app store listing or in the privacy notice, which the Garante advises reading before use.

Who can contact the child. Look for a list of approved contacts that only the parent’s account can change, and check what happens to calls from other numbers.
Who can see the location. Find out whether location is shared only with the parent’s account and whether it can be switched off.
What needs the internet. A toy that works offline carries less risk than one that sends voice recordings to a server.
A visible sign of recording. The UK’s Children’s code asks makers of connected toys to show when the device is recording, for example with a light, and to offer an easy way to switch listening off.
Updates. Check whether the maker states how long it will provide security updates; the guide to end of support explains why that matters.
Deleting data. Look for a way to delete the child’s data and close the account.

If a maker answers none of these questions anywhere, count that as part of the answer.

How do you set one up safely?

This short routine builds on the Garante’s advice to parents:

Register with only the information the service needs, using a nickname for the child where you can.
Protect the parent account with a strong password you use nowhere else. Shared or default credentials are a common way in.
Give the app only the permissions it needs, and question requests for more.
Turn off features you will not use, such as location on a toy, and choose the most protective privacy settings.
Install firmware and app updates when they are offered.
Switch the toy off, or disconnect it, when it is not in use.
Stay with young children when they use features that share photos or videos.

For a watch, add one step: set the approved contacts, then try the SOS button and any area alerts together with the child before relying on them.

Should the child know when they are being located?

The UK Children’s code asks services that let a parent track a child’s location to give the child an obvious sign that they are being monitored, and to keep location off by default unless there is a compelling reason. The rule binds companies, but the idea travels well: a child who knows what the watch shares, and with whom, is better placed to tell you when something seems wrong.

What do the rules ask of makers?

EU. Since 1 August 2025, radio-connected toys, childcare equipment and wearables that process personal data must include safeguards for the user’s data and privacy, under Delegated Regulation (EU) 2022/30. The Cyber Resilience Act, Regulation (EU) 2024/2847, applies from 11 December 2027 and puts internet-connected toys that talk, film or track location, and wearables made for children, among the “important” products that face a stricter conformity check.
UK. Under the PSTI product security regulations, in force since 29 April 2024, connectable consumer products cannot ship with a universal default password, and makers must publish how to report security problems and the minimum period of security updates. The Children’s code covers connected toys and devices likely to be used by anyone under 18.
US. The COPPA Rule requires online services for children under 13 to get verifiable parental consent before collecting their personal information, and lets parents review it and have it deleted.

None of these rules makes a product safe on its own. The IoT security regulation guide covers them in more depth.

What happens to the data when the toy moves on?

Before a toy or watch is handed down, sold or thrown away, the Garante advises closing the linked accounts, deleting the data on the device and in the app, and considering a request to the maker to delete what it holds.

Where to go next

Are cheap smart devices and TV boxes safe? covers warning signs on low-cost gadgets.
When smart devices lose support explains what stops working when updates end.
IoT security regulation covers these rules in detail.
IoT security fundamentals is the technical view of how devices get attacked.

Topics: children, privacy, smartwatches, connected toys, wearables, everyday questions