AI-powered plush toys, smart pets, and voice-clone services — what they collect from a child, how cloned voices are used to bait families into scams, and how to evaluate one before bringing it into the home.
AI Toys is the risk posed by internet-connected or AI-powered toys that can record, respond to, or imitate a child's voice, raising privacy and safety concerns.
A new generation of children's toys ships with cloud-connected microphones, large-language-model chatbots, and the ability to imitate a family member's voice. Some are aimed at toddlers (AI plush companions); some at older children (chatbot bracelets and pendants); and adjacent services let anyone clone a 30-second voice sample for a few pounds. The result is a category of products that hold extended conversations with children, store recordings on a third-party server, and — at the same time — make it trivially easy for scammers to fake a parent or grandparent's voice. The Children's Code (Age-Appropriate Design Code) and UK GDPR set the rules for how children's data may be processed; many imported AI toys do not meet them.
An AI toy typically streams a child's voice to a cloud service, transcribes it, sends it through a large language model, and streams a response back. Some keep recordings indefinitely; some do not encrypt them; some have been found exposing data through unsecured APIs. Separately, voice-clone services can take a short clip from a school play, YouTube video, or Instagram story and generate a near-identical synthesised voice — already used in UK family-impersonation phone scams ('Mum, I'm in trouble, please send money'). The two trends overlap: an AI toy is also a high-quality voice sample of a child.
In your child's behaviour
On their device
Check the privacy policy before the toy enters the house
Look for a clear UK or EU-based data controller, a stated retention period for recordings, an off-switch for the microphone, and parent access to delete recordings. If any of those are missing, treat the toy as unsuitable.
Keep voice samples of the family small and private
Avoid posting long, clean voice recordings of children or grandparents publicly. Voice-clone services need very little material to produce a convincing fake.
Agree a family code phrase
A short, mundane phrase only the family knows, used to verify any phone call asking for money, lifts, or sensitive information — this defeats almost all voice-clone scam calls.
Use the ICO if data is mishandled
Under UK GDPR you can request access to or deletion of a child's data. If a manufacturer refuses or ignores you, complain to the ICO on 0303 123 1113.
In immediate danger: call 999. For non-emergency police matters, call 101.
Concerned about a child but it's not an emergency? NSPCC helpline 0808 800 5000. Childline for young people 0800 1111.
This is practical educational content to support families. For case-specific concerns about a child's safety, contact the NSPCC helpline on 0808 800 5000 or your local safeguarding team.
Was this page helpful?
Last reviewed: 2026-06-14