Connected Child Device Security Research Note

Connected Child Device Security Research Note

A child-directed AI device is a consumer IoT product, an account system, a microphone, a display, a battery-powered physical product, a cloud service, an AI application, and a parent-control surface at the same time.

NIST IR 8425 describes consumer IoT outcomes for the whole product. Relevant capabilities include identifying the product and its components, changing configuration, protecting data, controlling interfaces, securely updating software, reporting cybersecurity state, and supporting vulnerability response.

The UK Information Commissioner's Office connected toys guidance adds child-specific design questions. It emphasizes clear collection indicators, avoiding passive collection, a practical connection-off control, data minimization, understandable notices, multiple users, and clear responsibility across outside providers.

The FTC's connected-toy buyer questions remain useful for setup, collection, parent control, security, deletion, and vendor practices.

The KID public policy names Firebase, OpenAI, Google Cloud, and Pushy. A complete threat model should include account takeover, device theft, unauthorized parent access, nearby Bluetooth setup, WiFi credentials, microphone activation, prompt injection, creator content, model-provider changes, cloud breach, malicious updates, unsupported devices, and resale.

Security review needs a support period, signed update process, vulnerability contact, incident notice, reset procedure, export and deletion behavior, and end-of-service plan. Encryption alone does not answer those questions.