Cybernews has looked into 10 Android companion apps from a range of brands - Loona, Dash and Dot, Sphero, mBlock, Miko, Eilik, SPIKE LEGO Education, Ozobot Evo, Petoi, and AIBI Pocket - and discovered the level of access and permissions which could be granted by children who aren't able to understand what they're agreeing to.
The company said: "Data minimisation for children's apps is essential.
"Responsibility falls both on developers to request fewer permissions and minimize sensitive trackers, and on parents to take greater control over the technology available to their children.
"Unlike adults, children are less likely to understand what data is being collected, how it may be used, or the privacy implications of sharing it.”
Of the 10 apps they looked into, the study found that all of them requested permissions which Android rules as "dangerous".
Up to six of them required microphone access, while five requested camera access, and eight asked for Bluetooth scanning capabilities.
While requests like those and location are necessary for some of the toys, some go against the FTC's updates to the Children's Online Privacy Protection Rule.
Then-FTC chair Lina M. Khan said the rules strengthened "key protections for kids' privacy online", particularly in terms of limited data retention and a required disclosure to prevent data abuse, plus requiring opt-in consent for targeted advertising aimed at kids.
Despite that, seven of the 10 apps had trackers, with two of them being advertising and profiling trackers.