Check the Toy Before It Checks On You
Monday's story: a researcher found the Eilik and Eiliko companion robots, made by Energize Lab and sold on Amazon for about $140, storing roughly 8.3 million conversations as readable text on servers in Beijing. About 32,000 of those profiles were tied to children. The backend ran over plain http, and one flaw, CVE-2026-105038, rated 9.8 out of 10, let a stranger swap the AI's personality with no password at all. The lesson isn't "that one robot." It's that a cloud-connected gadget keeps your words on someone else's server. Here's how to check before you buy.
The free tool: Mozilla's Product Reviews
Mozilla's privacy experts test connected gadgets, speakers, watches, cameras, and AI toys by hand and write up what each one collects and how well it's secured. The reviews live in their Nothing Personal magazine (mozillafoundation.org/nothing-personal), which replaced the old "*Privacy Not Included" guide in 2026. Free, no signup, no paywall. Look up the product name before it's in your cart. For a plan on the rest of your devices, Consumer Reports' free Security Planner (securityplanner.consumerreports.org) asks a few questions, takes no personal details, and hands back step-by-step privacy settings to change.
Three questions to ask about any talking device
Does it think on the device, or in the cloud? If it needs the internet to answer, your words are leaving the room.
Can you turn the cloud part off and still use it? If "off" bricks it, there is no off.
What does the app collect? Check the permissions and the privacy policy for names, ages, location, and contacts.
If it's for a kid, you have COPPA
Under the Children's Online Privacy Protection Act, a company collecting data on a child under 13 needs verifiable parental consent, and you can demand to see what they've gathered and tell them to delete it. Email the maker's privacy contact and ask for both.
The tell
The researcher put it plainly: "the brain isn't in the robot." If a device has to phone home to hold a conversation, the conversation lives on a server you don't control, and changing your password won't fix how that server is built.
Up next · Friday
Already own one? A 10-minute walk-through to cut what a talking gadget sends to the cloud, on the device, the app, and your Wi-Fi.