A fictional example
Fictional example: Aoife in Dublin wants to give her five-year-old a talking robot for Christmas. The manual says it needs permanent Wi-Fi and an app account, and its camera recognises faces. The privacy policy allows recordings to be shared with ‘partners’ but says nothing about deletion or how long updates will last. Aoife leaves it in the basket and looks for a toy that only listens while a button is pressed.
How is an AI toy different from an ordinary talking toy?
A classic talking toy plays back phrases stored inside it. An AI toy records what your child says and generates a new reply, usually on the provider's servers, so it needs an internet connection, either directly or through a phone or tablet.
What a child tells a cuddly toy can be very personal. A language model writes its own answers and can be wrong or raise topics that do not suit your child's age. Under the new EU Toy Safety Regulation, the safety assessment of digitally connected toys should, where appropriate, also take risks to mental health into account, and manufacturers should aim for the highest standards of safety, security and privacy by design.
Which five questions should you ask before buying?
The answers are usually in the manual, the product description and the app's privacy policy. Germany's Bundesnetzagentur, the authority that deals with banned spying devices, recommends checking the last two carefully before you buy.
| Question | Good sign | Warning sign |
|---|---|---|
| 1. When does it listen? | Push-to-talk button, off switch, recording light | ‘Always listening’, no off switch |
| 2. Where do conversations go? | Provider, server location, retention and deletion named | Sharing with unnamed ‘partners’ |
| 3. What can the AI talk about? | Parent area, age settings, deletable history | No information on content limits |
| 4. What does set-up ask for? | A nickname is enough, own Bluetooth PIN | Compulsory full name, address or photo |
| 5. How long is it supported? | Update period and data contact stated | Manufacturer unclear or unreachable |
For question 1, the Bundesnetzagentur suggests three checks. Is there a camera or microphone that can transmit wirelessly? Are images or sound sent to third parties without the recorded person knowing? Can someone access them secretly from outside?
For question 5, look for warnings: the EU publishes summaries of its alerts on dangerous products on the Safety Gate portal. Ordering from outside the EU? Read Cheap online platforms: check customs, returns and safety first.
Which rules apply in the EU and in Switzerland?
The Toy Safety Regulation (EU) 2025/2509 of 26 November 2025 sums up the position: radio toys must meet the privacy requirements of the Radio Equipment Directive, internet-connected toys need safeguards against cyber attacks and fraud, and toys with AI fall under the AI Act.
- Radio equipment: cybersecurity and privacy requirements for certain radio equipment have applied since August 2025. From 11 December 2027 the Cyber Resilience Act takes over.
- AI Act: since 2 February 2025, harmful AI-based exploitation of vulnerabilities, for example linked to age, has been banned. According to the Commission, rules for high-risk AI in products such as toys apply from 2 August 2028.
- Toy Safety Regulation: in force since 1 January 2026 and applicable from 1 August 2030. Every toy placed on the EU market will then need a digital product passport, for example via a QR code, and warnings must be visible before purchase, including online.
- Germany: the Bundesnetzagentur treats plush toys with cameras or microphones that can secretly listen or watch as banned spying devices.
- Switzerland: EU regulations do not apply automatically. According to the Federal Data Protection and Information Commissioner (FDPIC), the Data Protection Act in force since 1 September 2023 applies directly to AI-supported data processing, and users have a right to know whether they are communicating with a machine.
This overview is not legal advice for individual cases.
Where can you ask for help or report a problem?
| Country | Body | What for |
|---|---|---|
| EU | Safety Gate (European Commission) | Read alerts on dangerous products |
| DE | Bundesnetzagentur, spionagegeraete@bnetza.de | Suspected secret recording or transmission |
| AT | Austrian Data Protection Authority (Datenschutzbehörde) | Data protection complaints |
| CH | FDPIC, hotline +41 58 462 43 95 | Data protection questions, including AI |
| FR | CNIL | Advice on securing connected toys |
| IT | Garante per la protezione dei dati personali, urp@gpdp.it | Questions on data protection compliance |
| ES | INCIBE, helpline 017 | Free, confidential advice on children's internet safety |
For access to stored data or its deletion, contact the provider first.
How do you set up the toy after unwrapping it?
- Register with only what is strictly needed and use a nickname instead of your child's real name.
- Switch off functions you do not need, such as location, and only let the app use the microphone, storage or Bluetooth if it really has to.
- Set strong passwords for the toy, the app and the connection; see also Checking your home router.
- Switch the toy off and disconnect it when not in use: a listening toy can pick up the whole family's habits.
- Before passing it on, deactivate the accounts and delete the data.
Stay close during the first conversations. Explain that the toy is a computer connected to the internet, not a friend who keeps secrets. Similar issues come up with Kids' smartwatch or GPS tracker.
Common mistakes
- Assuming a cute plush toy collects less data than a smart speaker.
- Entering your child's full name, date of birth or photo when a nickname would do.
- Leaving the toy switched on and connected overnight in the bedroom.
- Trusting a content filter and leaving your child alone with the toy from day one.
- Passing on a used AI toy without deleting the account and recordings.
Your checklist
The checkboxes are for your own reference. No entries are sent to us. To keep a copy, print the page or save it as a PDF using your browser menu.
Common questions
Does an AI toy listen all the time?
It depends on the model. Some only react while your child presses a button, others wait constantly for a wake word. If there is no off switch, be cautious. Italy's data protection authority recommends switching the toy off and disconnecting it from the network when not in use, because a listening toy can capture the habits of the whole family.
Are AI toys banned anywhere in Europe?
Not as such. In Germany, the Bundesnetzagentur treats connected devices suitable for spying, such as plush toys with cameras or microphones that can secretly listen or watch, as prohibited. Interactive toys without an internet connection and without audio or video transmission are not covered.
Can I have stored conversations deleted?
Often, yes. First check whether the app lets you delete recordings yourself. Under the GDPR you can also ask the provider for access to your child's data and for its deletion. Italy's data protection authority notes that data may already sit in the manufacturer's databases, so ask for deletion there too.
What will the digital product passport change?
From 1 August 2030, every toy placed on the EU market must have a digital product passport with safety and compliance information you can look up online, for example by scanning a QR code. For presents bought this year it is not yet required.
Sources and further information
Primary sources from public authorities, consumer organisations and providers. A source may be in another language; follow the guidance that applies to your service and where you live.
- EUR-Lex: Regulation (EU) 2025/2509 on the safety of toysSource review date:
- European Commission: Stronger toy safety rules enter into forceSource review date:
- European Commission: AI Act, prohibited practices and timelineSource review date:
- European Commission: Radio Equipment Directive and cybersecurity requirementsSource review date:
- European Commission: Safety Gate, the EU rapid alert system for dangerous productsSource review date:
- Bundesnetzagentur: caution with smart products as Christmas gifts (in German)Source review date:
- Federal Data Protection and Information Commissioner (FDPIC): AI and data protectionSource review date:
- Garante per la protezione dei dati personali: Smart toys (in Italian)Source review date:
