FEDERAL TRADE COMMISSION
Washington, DC 20580
In the Matter of

)
)
)
)
)
)
)
)
)

Genesis Toys
and
Nuance Communications

Complaint and Request for Investigation, Injunction, and Other Relief
Submitted by
The Electronic Privacy Information Center
The Campaign for a Commercial Free Childhood
The Center for Digital Democracy
Consumers Union
Marc Rotenberg, Esq.
Claire Gartland, Esq.
Electronic Privacy Information Center
1718 Connecticut Ave. NW Suite 200
Washington, DC 20009
(202) 483-1140
Counsel for Petitioners
Laura M. Moy, Esq.
Chris Laughlin, Esq.
Institute for Public Representation
Georgetown University Law Center
600 New Jersey Avenue, NW, Suite 312
Washington, DC 20001
(202) 662-9547
Counsel for Petitioners

In re: Genesis Toys and
Nuance Communications

1

Federal Trade Commission
December 6, 2016

 I.

INTRODUCTION

1. This complaint concerns toys that spy. By purpose and design, these toys record and collect
the private conversations of young children without any limitations on collection, use, or
disclosure of this personal information. The toys subject young children to ongoing
surveillance and are deployed in homes across the United States without any meaningful data
protection standards. They pose an imminent and immediate threat to the safety and security
of children in the United States.
2. As set forth in detail below, certain business practices by toy manufacturer Genesis Toys and
speech recognition technology provider Nuance Communications violate both specific
children’s privacy and general consumer protections in the United States. Both Genesis Toys
and Nuance Communications unfairly and deceptively collect, use, and disclose audio files of
children’s voices without providing adequate notice or obtaining verified parental consent in
violation of the Children’s Online Privacy Protection Act (“COPPA”), the COPPA Rule, and
Section 5 of the Federal Trade Commission Act. It is incumbent upon the Federal Trade
Commission (“FTC” or “Commission”) to take action in this matter, and to enjoin Genesis
Toys and Nuance Communications from such unlawful activities.
II.

PARTIES

3. The Electronic Privacy Information Center (“EPIC”) is a public interest research center
located in Washington, D.C. EPIC focuses on emerging privacy and civil liberties issues and
is a leading consumer advocate before the FTC. EPIC has played a leading role in developing
the authority of the FTC to address emerging privacy issues and to safeguard the privacy
rights of consumers.1 EPIC has long advocated for protecting the privacy of children.2

1

See, e.g., Letter from EPIC Exec. Dir. Marc Rotenberg to FTC Comm’r Christine
Varney (Dec. 14, 1995) (urging the FTC to investigate the misuse of personal information by the
direct marketing industry), http://epic.org/privacy/internet/ftc/ftc_letter.html; DoubleClick, Inc., FTC File
No. 071-0170 (2000) (Complaint and Request for Injunction, Request for Investigation and for Other
Relief), http://epic.org/privacy/internet/ftc/DCLK_complaint.pdf; Microsoft Corporation, FTC File No.
012 3240 (2002) (Complaint and Request for Injunction, Request for Investigation and for Other Relief),
http://epic.org/privacy/consumer/MS_complaint.pdf; Choicepoint, Inc., FTC File No. 052-3069 (2004)
(Request for Investigation and for Other Relief) , http://epic.org/privacy/choicepoint/fcraltr12.16.04.html.
2
See, e.g., EPIC Letter to Christine Varney, Comm’r, Fed. Trade Comm’n, on Direct Marketing Use of
Children's Data, EPIC, December 14, 1995 http://epic.org/privacy/internet/ftc/ftc_letter.html; Children’s
Privacy Protection and Parental Empowerment Act: Hearing on H.R. 3508 Before the Subcomm. On
Crime of the H. Comm. On the Judiciary, 104th Cong (1996), (statement of Marc Rotenberg, Executive
Director, EPIC), https://epic.org/privacy/kids/EPIC_Testimony.html; EchoMetrix, Inc., __ F.T.C. __
(2009) (Complaint, Request for Investigation, Injunction, and Other Relief),
https://epic.org/privacy/ftc/Echometrix%20FTC%20Complaint%20final.pdf; An Examination of
Children’s Privacy: New Technologies and The Children’s Online Privacy Protection Act (COPPA)
before Subcomm. on Cons. Prot., Prod. Safety, and Insur. of the Sen. Comm. On the Judiciary, 111th
Cong. (2010) (testimony of Marc Rotenberg, Executive Director, Elec. Privacy Info. Ctr.),
https://epic.org/privacy/kids/EPIC_COPPA_Testimony_042910.pdf;

In re: Genesis Toys and
Nuance Communications

2

Federal Trade Commission
December 6, 2016

 4. The Campaign for a Commercial Free Childhood (“CCFC”) is a national advocacy
organization dedicated to countering the harmful effects of commercialism on children.
CCFC organizes campaigns against corporations that target children with harmful marketing,
helps parents and professionals reduce the amount of time kids spend with ad-supported
screens, and advocates for policies that limit marketers’ access to children. CCFC has filed a
number of Requests for Investigation with the Commission for violations of Section V of the
FTC Act.
5. The Center for Digital Democracy (“CDD”) is a not-for-profit D.C.-based organization
focused on protecting consumers in the digital marketplace.3 During the 1990s (and then
operating as the Center for Media Education) its work to protect privacy on the Internet led to
the passage of COPPA by Congress in 1998.4 CDD’s advocacy on the Google-DoubleClick
merger played a major role in the FTC’s decision to address privacy concerns arising from
online behavioral advertising.5 Through a series of complaints filed at the Commission,
CDD has brought attention to privacy concerns with mobile devices, real-time tracking and
targeting platforms, social media, and from the data broker industry.6 CDD’s four-year
campaign to ensure that COPPA was effectively implemented across all major platforms and
applications resulted in the FTC’s December 2012 decision to strengthen its rules on
children’s privacy.7
6. Consumers Union (“CU”) is the policy and mobilization arm of Consumer Reports. Founded
in 1936, CU is an expert, independent, non-profit organization working for a fair, just, and
safe marketplace for all consumers, and to empower consumers to protect themselves. This
includes supporting the important work of the FTC in protecting consumer privacy. Among
its many efforts, CU has been a strong and unwavering supporter of COPPA, has supported
updating COPPA to keep it strong,8 recently exposed the subpar privacy and security

Comments of EPIC, FTC Docket No. P104503 (Dec. 23, 2011), https://epic.org/privacy/kids/EPICCOPPA-Rule-Comments-FINAL-12-23-11.pdf; Comments of EPIC, FTC Docket No. P104503 (Sep. 24,
2013), https://epic.org/privacy/kids/EPIC-COPPA-2012-Rule-Rev-Cmts.pdf.
3
Ctr. for Digital Democracy, About CDD, http://www.democraticmedia.org/about-cdd (last accessed
Mar. 6, 2014).
4
Kathryn C. Montgomery, Generation Digital, MIT PRESS, http://mitpress.mit.edu/books/generationdigital (last accessed Mar. 6, 2014).
5
Louise Story, F.T.C. Approves Doubleclick Deal, N.Y. TIMES, Dec. 21, 2007,
http://www.nytimes.com/2007/12/21/business/21adco.html.
6
Rimma Katz, Center for Digital Democracy asks FTC to investigate mobile data targeting, MOBILE
MARKETER, Apr. 9, 2010, http://www.mobilemarketer.com/cms/news/legal-privacy/5927.html.
7
FTC Strengthens Kids' Privacy, Gives Parents Greater Control Over Their Information by Amending
Children’s Online Privacy Protection Rule, FED. TRADE COMM’N (Dec. 19, 2012),
http://www.ftc.gov/news-events/press-releases/2012/12/ftc-strengthens-kids-privacy-gives-parentsgreater-control-over.
8
Delara Derakhshani & Ellen Bloom, Consumers Union Praises FTC Proposal to Improve, Update Rules
for Children’s Online Privacy, CONSUMERS UNION (Sept. 16, 2011),
http://consumersunion.org/news/consumers-union-praises-ftc-proposal-to-improve-update-rules-forchildrens-online-privacy/.

In re: Genesis Toys and
Nuance Communications

3

Federal Trade Commission
December 6, 2016

 protections in the Glow pregnancy app,9 and requested that the FTC investigate the YouTube
Kids App.10
7. The Institute for Public Representation (“IPR”) is a law school clinic at Georgetown
University Law Center that simulates a small public interest law firm representing
individuals and nonprofit organizations on a wide variety of matters. IPR has long
represented CCFC and CDD on matters before the Federal Trade Commission related to
children’s privacy and advertising.
8. Genesis Toys (“Genesis”) is a company incorporated under the laws of Hong Kong, China.11
Genesis is based in Los Angeles, California, and is located at 2229 Barry Avenue, Los
Angeles, California 90064, United States. Genesis is the maker of the My Friend Cayla and iQue dolls and companion applications, as well as several other interactive toys and robots
marketed and sold in the United States.12 Genesis Toys claims that My Friend Cayla has
amassed over 1 million fans worldwide.13
9. Nuance Communications, Inc. (“Nuance”) is a Delaware corporation14 with its principal
place of business at 1 Wayside Road, Burlington, Massachusetts 01803, United States.15
Nuance represents itself as a leader in voice technology, including speech recognition
software16 and voice biometric solutions that allow a search of the company’s 60 million
enrolled voiceprints for a voice match from a recorded conversations to be performed within
minutes.17 Nuance markets its technology to private and public entities and delivers its voice
biometric technology to military, intelligence, and law enforcement agencies.18
9

Jerry Beilinson, Glow Pregnancy App Exposed Women to Privacy Threats, Consumer Reports Finds,
CONSUMER REPORTS (July 28, 2016), http://www.consumerreports.org/mobile-security-software/glowpregnancy-app-exposed-women-to-privacy-threats/?loginMethod=auto.
10
Kara Kelber, Google’s YouTube Kids: Better for Advertisers than Families?, CONSUMERS UNION (May
13, 2015), http://consumersunion.org/2015/05/googles-youtube-kids-better-for-advertisers-than-families/.
11
Privacy Policy, GENESIS TOYS, http://www.genesis-toys.com/privacypolicy (last updated Feb. 23,
2015).
12
GENESIS TOYS, http://www.genesis-toys.com/ (last visited Dec. 4, 2016).
13
Genesis, New Free Game For World's Best Talking Doll My Friend Cayla, PRNEWSWIRE (Jan. 8,
2016),
http://www.prnewswire.com/news-releases/new-free-game-for-worlds-best-talking-doll-my-friend-cayla300199658.html.
14
Delaware Department of State: Division of Corporations, File Number 2545096.
15
Contact Us, NUANCE, http://www.nuance.com/company/company-overview/contactus/index.htm?ref=footer (last visited Nov. 22, 2015).
16
Automatic Speech Recognition, NUANCE, http://www.nuance.com/for-business/automatic-speechrecognition/index.htm (last visited Nov. 22, 2016)
17
Identifier v9: Voice Biometrics, NUANCE 1 (June 26, 2014),
http://www.nuance.com/ucmprod/groups/corporate/@web-enus/documents/collateral/nc_033082.pdf;
Nuance Teams up with TalkTalk to Roll out Voice Biometrics to UK Consumers for a Better Customer
Experience, NUANCE (Mar. 17, 2016), http://www.nuance.com/company/news-room/pressreleases/TalkTalk-Rolls-Out-Nuance-Voice-Biometrics.docx.
18
Nuance Public Security Solutions, NUANCE, http://www.nuance.com/for-business/bysolution/customer-service-solutions/solutions-services/inbound-solutions/public-security/index.htm (last
visited Nov. 22, 2016).

In re: Genesis Toys and
Nuance Communications

4

Federal Trade Commission
December 6, 2016

 III.

FACTUAL BACKGROUND

A. Genesis Toys Manufactures, Sells, and Operates Internet-Connected Toys Targeted
at Young Children that Collect Personal Information
10. Genesis markets and sells a variety of connected children’s toys, including My Friend Cayla
(“Cayla”) and i-Que Intelligent Robot (“i-Que”).19 Cayla and i-Que are internet-connected
toys that talk and interact with children by capturing and recording children’s
communications and analyzing the recordings to determine the words spoken.20 These voice
recordings are stored and used for a variety of purposes beyond providing for the toys’
functionality.
11. There are two components to the Cayla and i-Que toys: a physical doll and a companion
mobile application.21 The physical doll contains a Bluetooth microphone and speaker, and the
companion app provides the data processing to facilitate the toy’s ability to capture the
private communications of children. Before playing with toys, users are required to download
the Cayla and/or i-Que application on a mobile device, to which the doll connects using
Bluetooth technology.
12. Genesis manufactures the physical Cayla and i-Que dolls and develops and provides the
companion applications, available from the Google Play and iTunes app stores.22
13. The companion application for My Friend Cayla requests permission to access the hardware,
storage, microphone, Wi-Fi connections, and Bluetooth on users’ devices, but fails to
disclose to the user the significance of obtaining this permission.23 The i-Que companion
application also requests access to the device camera, which is not necessary to the toy’s
functions and is not explained or justified.24

19

Privacy Policy, GENESIS TOYS, http://www.genesis-toys.com/privacypolicy (last updated Feb. 23,
2015).
20
This is Cayla, MY FRIEND CAYLA http://www.myfriendcayla.com/meet-cayla-c8hw (last visited Nov.
28, 2016); About i-Que, I-QUE INTELLIGENT ROBOT http://www.ique-robot.com/about (last visited Nov.
28, 2016).
21
For purposes of this complaint, “doll(s)” refers to the physical My Friend Cayla and i-Que Intelligent
Robot dolls; “companion application(s)” or “app(s)” refers to the Cayla and i-Que applications users must
download to enable interactive play; and “toy(s)” refers to both the doll and companion app working in
conjunction to provide full interactivity for Cayla and/or i-Que.
22
Id.
23
My Friend Cayla App (EN-US), GOOGLE PLAY,
https://play.google.com/store/apps/details?id=com.toyquest.Cayla.en_us&hl=en (last updated July 24,
2016).
24
I-Que Robot App (EN UK), GOOGLE PLAY,
https://play.google.com/store/apps/details?id=com.toyquest.iQue.en_uk&hl=en (last updated Nov. 17,
2015).

In re: Genesis Toys and
Nuance Communications

5

Federal Trade Commission
December 6, 2016

 14. After establishing a Bluetooth connection with the Cayla and/or i-Que doll, the mobile
application connects the doll to the internet.25 The Cayla and i-Que applications record and
collect conversations between the dolls and children.26 A child’s statements are converted
into text, which is then used by the application to retrieve answers using Google Search,
Wikipedia and Weather Underground.27
15. In addition to researching and providing factual answers to questions posed by the child, the
application also allows the doll to provide appropriate responses to everything the child says,
including conversational questions and comments. Cayla and i-Que encourage children to
openly converse with the toys, as if chatting with a friend. According to Genesis, “Cayla can
understand and respond to you in real-time about almost anything. . . She is not just a
doll... she’s a real friend!”28
16. Researchers discovered that My Friend Cayla is pre-programmed with dozens of phrases that
reference Disneyworld and Disney movies. For example, Cayla tells children that her favorite
movie is Disney’s The Little Mermaid and her favorite song is “Let it Go,” from Disney’s
Frozen. Cayla also tells children she loves going to Disneyland and wants to go to Epcot in
Disneyworld.
17. This product placement is not disclosed and is difficult for young children to recognize as
advertising. Studies show that children have a significantly harder time identifying
advertising when it’s not clearly distinguished from programming.29 Brand placement is
particularly hard for children to understand because children focus their attention on the
content and utilize “fewer cognitive resources . . . to consciously scrutinize and evaluate
placed brands.”30 Since the product placement is not disclosed, parents who purchase the doll
for their children are unaware there is product placement in the conversations.
18. Cayla is able to speak and understand Spanish. Genesis sells three physical variations of the
doll: Caucasian with blonde hair, Caucasian with brown hair, and African American.
19. The My Friend Cayla toy is child-directed. The toy contains subject matter and visual content
designed to appeal to children. The doll itself is designed to look like a female child, and is
specifically marketed to young girls ages four and older.31 The Genesis Toys website directs
25

Frequently Asked Questions, MY FRIEND CAYLA, http://www.myfriendcayla.com/us-c5ja (last visited
Dec. 1, 2016).
26
Privacy Policy, MY FRIEND CAYLA (last updated Feb. 23, 2015),
http://www.myfriendcayla.com/privacy-policy [hereinafter “Cayla Privacy Policy”].
27
Id.
28
My Friend Cayla, GENESIS TOYS, http://www.genesis-toys.com/my-friend-cayla.
29
Barbie Clarke & Siv Svanaes, Digital Marketing and Advertising to Children: A Literature Review,
ADVERTISING EDUCATION FORUM 45 (2012), http://www.aeforum.org/gallery/8612144.pdf.
30
KRISTIN VOIGT, ET AL., CHILDHOOD OBESITY: ETHICAL AND POLICY ISSUES 159 (Oxford Univ. Press
2014).
31
The packaging for the My Friend Cayla doll is marked “AGES 4+.” In the Apple app store, the My
Friend Cayla app is also marked “4+.” See My Friend Cayla APP (US English), ITUNES,
https://itunes.apple.com/us/app/my-friend-cayla-app-us-english/id1135402140?mt=8 (last updated July
19, 2016).

In re: Genesis Toys and
Nuance Communications

6

Federal Trade Commission
December 6, 2016

 consumers to purchase the toy from Wal-Mart, where the retailer suggests the age range for
the toy is three to twelve years old.32 The packaging for the doll states, “Cayla has thousands
of kid friendly topics.” Among other things, Cayla is pre-programed to tell children stories
about her pet dog and the Little Mermaid. Cayla’s companion application includes games
such as tic-tac-toe that children can play alongside or compete with the doll.33
20. The i-Que Intelligent Robot is also child-directed. I-Que is targeted to young boys, and is
specifically marketed to children ages four and older.34 Among other things, i-Que is preprogrammed to cite scientific facts, tell silly jokes, and make wacky sound effects.35
21. Genesis advertises that the Cayla app is programmed with “a kid-safe proprietary software”
called Violet, which is designed to protect children from offensive or sensitive words or
images and allows parents to add terms that they do not want the doll to use.36
22. The Cayla companion application includes a section titled “Child’s information” that
prompts children to submit personal information to complete the following statements:
a.
b.
c.
d.
e.
f.
g.
h.
i.

My Name is;
My Mom’s name is;
My Dad’s name is;
My favorite TV program is;
My favorite meal is
I go to school at;
My favorite princess is;
My favorite toy is; and
The place I live in is called.

23. The Cayla application also invites children to set their physical location.
24. According to the Privacy Policy for Cayla and i-Que, Genesis collects users’ IP addresses.37

32

My Friend Cayla Doll, Blonde Hair, WALMART, https://www.walmart.com/ip/My-Friend-Cayla-DollBlonde-Hair/44932473 (last accessed Dec. 2, 2016). My Friend Cayla is also sold at Target, Amazon,
Toys “R” Us, Kmart, and Kohls. See Genesis, New Free Game for World’s Best Talking Doll My Friend
Cayla, PRNEWSWIRE (Jan. 8, 2016), http://www.prnewswire.com/news-releases/new-free-game-forworlds-best-talking-doll-my-friend-cayla-300199658.html.
33
Video Instructions, MY FRIEND CAYLA http://myfriendcayla.co.uk/help/guide (last accessed Dec. 1,
2016).
34
The packaging for the i-Que Intelligent Robot doll is marked “AGES 4+.”
35
About i-Que, I-QUE INTELLIGENT ROBOT, http://www.ique-robot.com/about (last visited Nov. 28,
2016).
36
This is Cayla, MY FRIEND CAYLA http://www.myfriendcayla.com/meet-cayla-c8hw (last visited Nov.
28, 2016).
37
Cayla Privacy Policy; Privacy Policy, I-QUE INTELLIGENT ROBOT, (last updated Feb. 23, 2015)
[hereinafter “i-Que Privacy Policy”].

In re: Genesis Toys and
Nuance Communications

7

Federal Trade Commission
December 6, 2016

 B. Genesis Toys and Nuance Communications Record and Collect Children’s Voices
and Speech Using Voice Recognition Technology on the My Friend Cayla Toy
25. Nuance is a third party software provider to Genesis Toys,38 which uses Nuance’s voice
recognition technology for its My Friend Cayla and i-Que applications.39
26. Nuance’s voice recognition technology converts the questions asked by children to the toys
into text, which is used by the apps to retrieve answers using pre-approved internet sources.40
27. According to the Terms of Service for both Cayla and i-Que, “When you ask the App a
question, this information request is stored on a Nuance Communication or IVONA server in
the cloud. Collectively, Nuance and IVONA are our third party software partners
(collectively ‘Licensor(s)’).”41 Confusingly, the Cayla Privacy Policy indicates this
information is stored on “a Nuance Communication (for Apple-based users) or Google (for
Android/Google based users) server in the cloud.”42 The i-Que Privacy Policy makes no
reference to such information collection.
28. Researchers found that both Apple and Android apps for Cayla upload data to the same IP
address, 205.197.192.116, which is located in Burlington, Massachusetts, the same city
where Nuance is headquartered. Geolocation data confirms that IP address 205.197.192.116
belongs to Nuance.43
29. Researchers observed that the data was sent while the app was recording the speech, and the
size of the data sent indicated that the files being uploaded were sound files.
30. The Cayla and i-Que Terms of Service state that Genesis and Nuance use speech data,
including audio files and text transcriptions, to enhance and improve the services for the toys
and for other services and products.44
31. The Cayla and i-Que Terms of Service also refer users to the Nuance Privacy Policy to
determine how speech data will be used.45
32. The Nuance Privacy Policy states:
38

Terms of Service, My Friend Cayla (last updated Dec. 8, 2015) (available only as a non-retrievable inapp display upon first accessing the My Friend Cayla companion application) [hereinafter “Cayla Terms
of Service”]; Terms of Service, i-Que Intelligent Robot (last updated June 12, 2015) [hereinafter “i-Que
Terms of Service”].
39
See Cayla Terms of Service; i-Que Terms of Service.
40
The pre-approved Internet sources are Google Search, Wikipedia, and Weather Underground. See
Cayla Terms of Service.
41
Cayla Terms of Service; i-Que Terms of Service.
42
Cayla Privacy Policy.
43
Searches for IP address 205.197.192.116 on IP2Location, ipinfo.io, Eureka API, and DB-IP all identify
the owner as Nuance Communications.
44
Cayla Terms of Service; i-Que Terms of Service.
45
Id.

In re: Genesis Toys and
Nuance Communications

8

Federal Trade Commission
December 6, 2016

 [W]e may use the information that we collect for our internal purposes to
develop, tune, enhance, and improve our products and services, and for
advertising and marketing consistent with this Privacy Policy. By using
Nuance products and services, you acknowledge, consent and agree that
Nuance may collect, process, and use the information that you provide to us
and that such information shall only be used by Nuance or third parties
acting under the direction of Nuance, pursuant to confidentiality
agreements, to develop, tune, enhance, and improve Nuance services and
products.46
33. Nuance further states in its Privacy Policy, “If you are under 18 or otherwise would be
required to have parent or guardian consent to share information with Nuance, you should
not send any information about yourself to us.”47
34. Nuance represents that it only collects data “consistent with applicable data protection
law,”48 but it does not expressly state compliance with COPPA nor does it provide for any of
the consent procedures required by COPPA.
35. The Nuance Privacy Policy states that the company uses “Speech Data to develop, tune,
enhance, and improve Nuance services and products.”49
36. Nuance services and products include voice biometric solutions sold to military, intelligence,
and law enforcement agencies.50
37. Nuance Identifier is a “highly accurate voice biometric solution that allows public security
officials to quickly and easily identify known individuals through their voice within large
audio data sets.”51 The service utilizes voice biometric analysis of audio files to enable law
enforcement to match recorded conversations to targets. Nuance advertises this service as
“capable of rapidly and accurately identifying and segmenting individuals within systems
comprising millions of voiceprints.”52 Nuance claims to have over 30 million voiceprints
enrolled in its voice biometric system.53

46

Company Privacy Policies, NUANCE, http://www.nuance.com/company/company-overview/companypolicies/privacy-policies/index.htm (last updated Dec. 2015) (emphasis added).
47
Id.
48
Id.
49
Id.
50
Nuance Public Security Solutions, NUANCE, http://www.nuance.com/for-business/bysolution/customer-service-solutions/solutions-services/inbound-solutions/public-security/index.htm (last
visited Dec. 1, 2016).
51
Id.
52
Identifier v9: Voice Biometrics, NUANCE 2 (June 26, 2014),
http://www.nuance.com/ucmprod/groups/corporate/@web-enus/documents/collateral/nc_033082.pdf.
53
Id.

In re: Genesis Toys and
Nuance Communications

9

Federal Trade Commission
December 6, 2016

 C. The Terms of Service and Privacy Policy for My Friend Cayla and i-Que Are
Confusing and Hard to Access
38. The Terms of Service and Privacy Policies for Cayla and i-Que are nearly identical.54
39. The Privacy Policies for Cayla and i-Que relate to Genesis’s use of “any personal
information you, or any child under your care, provide to us online or via any mobile
device.”55 It is unclear whether the Policies apply only to the toys’ websites, or to the
companion applications as well.
40. Genesis does not provide a link to the Cayla or i-Que Privacy Policy in the companion
applications or on the home or landing page of the My Friend Cayla or i-Que website.56
41. The packaging for the Cayla doll does not present or reference the toy’s Privacy Policy or
Terms of Service.
42. Cayla’s Terms of Service for U.S. consumers, which apply to “all services provided by or
connected to Cayla, including the App,”57 are not available on the My Friend Cayla website,
the Genesis Website, the app store, or anywhere in the Cayla app itself.58 The Terms are only
available after downloading the companion application, when they are presented as a pop-up
upon first opening the app. As a result, many users have only one opportunity to read the
Cayla Terms of Service. However, Genesis advises users to “please read these terms
carefully before downloading the My Friend Cayla application.”59
43. The Terms, provided in extremely small font that users can only access on a smart phone or
tablet, contain approximately 3,800 words, numerous repeated paragraphs, and excessive use
of all-caps font. Genesis advises users to “print a copy of these terms for future reference.”60
44. According to the Privacy Policy for Cayla and i-Que, “This Privacy Statement may be
updated from time to time so you may wish to check it each time you submit personal
information to us.”61
45. According to Cayla’s Terms of Service, “We have the right to amend these Terms for any
reason if necessary. When we update our Terms, we will do our best to give you advance
notice by posting the change on our website: www.myfriendcayla.com. You should look at
54

Due to this similarity, certain sections of this Complaint may reference only the applicable legal
documents for My Friend Cayla.
55
Cayla Privacy Policy.
56
See MY FRIEND CAYLA, http://www.myfriendcayla.com/.
57
Cayla Terms of Service.
58
The User Agreement for consumers in the United Kingdom is available on My Friend Cayla’s UK
website, but no equivalent document is available on the toy’s US website. See Welcome to the My Friend
Cayla App!, MY FRIEND CAYLA, http://myfriendcayla.co.uk/agreement.
59
Cayla Terms of Service.
60
Id.
61
Cayla Privacy Policy (emphasis added). See also, i-Que Privacy Policy.

In re: Genesis Toys and
Nuance Communications

10

Federal Trade Commission
December 6, 2016

 the website regularly to check.” As set forth above, the Cayla Terms of Service are not
available on that website or within the Cayla application. It would be difficult for users to
reasonably discover any changes to this document.
46. The Cayla Terms of Service includes a section on speech data, which is defined as “the audio
files, associated transcriptions and log files provided by you or generated in connection with
the Services.”62
47. The Cayla Terms of Service state that Genesis, Nuance, and IVONA collect speech data
which will be used by Genesis, Nuance, IVONA, and third parties acting under the direction
of Genesis, Nuance, and IVONA, “to tune, enhance and improve the speech recognition and
other components of the Services, and other services and products.”63
48. Cayla’s Privacy Policy does not mention speech data or describe the collection, use, or
disclosure of such data by Genesis, Nuance, IVONA, or other third parties. The only relevant
statement contained in the Privacy Policy is the following: “When you ask the App a
question, this information request is stored on a Nuance Communication (for Apple-based
users) or Google (for Android/Google based users) server in the cloud.”64 The meaning of
“this information request” is unclear and not defined elsewhere in the Policy.
49. In Cayla’s Privacy Policy, Genesis states that its “information practices are fully explained
below as required by the data protection laws and the Federal Trade Commission (FTC).”65
50. The Cayla and i-Que Terms of Service also state that Genesis, Nuance, and/or IVONA “may
collect and use the contact names that appear in your address book as part of the Services and
to tune, enhance and improve the speech recognition and other components of the Services,
and other services and products.”66 This information collection practice is not mentioned in
the Cayla Privacy Policy.
51. The Privacy Policy for Cayla and i-Que represent that Genesis may use personally
identifiable information collected from Cayla users for targeted advertising.67
52. The Cayla and i-Que Privacy Policies include a section titled “Our Use of Cookies.”68 This
section provides a generic description of what a cookie is, how most websites use cookies,
and the availability of browser settings to block cookies. Users are not informed whether or
how Genesis uses cookies.

62

Cayla Terms of Service.
Id. (emphasis added).
64
Cayla Privacy Policy.
65
Id.
66
Cayla Terms of Service.
67
Cayla Privacy Policy.
68
Id.
63

In re: Genesis Toys and
Nuance Communications

11

Federal Trade Commission
December 6, 2016

 D. Genesis Toys Fails to Obtain Parental Consent Prior to Collecting, Using, and
Disclosing Children’s Voice Recordings via the My Friend Cayla Toy
53. Genesis Toys claims they will not knowingly accept any information by any children under
the age of thirteen without the express permission of their parent or guardian.69 The Privacy
Policies for My Friend Cayla and i-Que state, “If you are under 13, we may separately
contact your parents or legal guardians to get consent and verification.”70
54. Genesis purports to obtain parental consent to the collection of children’s personal
information when users download the Cayla and/or i-Que application and agree to the Terms
of Service presented upon first accessing the app. According to the Cayla and i-Que Terms of
Service, which are only available after downloading the respective app, “As a parent or
guardian of a minor, by agreeing to the following terms and conditions of service and by
downloading the App, you are giving your express consent to the child under your care using
the My Friend Cayla App.”71
55. The Cayla Terms of Service further state:
As required by law, parental approval is required for the download of the
App by any persons who are under 13 years old. By accepting these Terms,
you (as the parent or guardian) have provided your consent to all the terms
and conditions detailed in these Terms, including the collection of
personally and non-personally identifiable information. This consent would
also cover the collection of information by the partners that Genesis has
used in the development of My Friend Cayla and the Services, including the
App.72
56. Upon first opening the Cayla application, users are presented with an in-app Terms of
Service and must select “AGREE” before proceeding.
57. The Cayla application also requires users to solve a mathematical equation prior to entering
the home screen. This equation is always 11+16. The i-Que application does not require this
additional step.
58. Genesis does not take any other steps to verify parental consent to the collection, use, and
disclosure of children’s voice recordings or other personal information via the My Friend
Cayla and/or i-Que toy.

69

Privacy Policy, GENESIS TOYS, http://www.genesis-toys.com/privacypolicy (last updated Feb. 23,
2015).
70
Cayla Privacy Policy; i-Que Privacy Policy.
71
Cayla Terms of Service.
72
Id. (emphasis added).

In re: Genesis Toys and
Nuance Communications

12

Federal Trade Commission
December 6, 2016

 E. Genesis Retains Children’s Voice Recordings and Other Information Collected via
the My Friend Cayla and i-Que Toys for Vague and Potentially Indefinite Periods of
Time
59. The Privacy Policies for Cayla and i-Que state that Genesis does not retain personal
information for “longer than is necessary.”73 The scope of what is “necessary” is undefined.
60. Genesis permits users to request deletion of personal information the company holds about
them, but advises users that “we may need to keep that information for legitimate business or
legal purposes.”74
61. Genesis further states that “it is not always possible to completely remove or delete all of
your information from our databases without some residual data because of backups and
other reasons.”75 Genesis promises users that it will be unable or will not attempt to use such
“residual” data “to make any decision which will affect you.”76
62. Genesis directs users seeking to request deletion of a child’s information to “contact us here.”
Contrary to reasonable expectation, the word “here” is not a hyperlink to a means of
submitting such a request.77 No other directions or contact information are provided in
connection to that statement.
F. Genesis Toys Fails to Employ Security Measures to Prevent Unauthorized Access to
Personal Information Collected from Children via the My Friend Cayla and i-Que
Robot Toys
63. The electronic play modes for My Friend Cayla and i-Que require an internet connection,
which is created by pairing the doll to a smartphone or tablet on which the companion
application is installed.
64. Before a Bluetooth-enabled device can be connected to a smartphone or tablet, the device has
to be switched on and go through a pairing process. Bluetooth pairing often requires users to
input a code associated with the device, which authenticates that the user is authorized to
connect to the device.78 Another common authentication mechanism requires the user to
press a button on the device in order to successfully pair the device and a smartphone or
tablet, which means that physical access to both units is needed in order to establish a
connection.79

73

Cayla Privacy Policy; i-Que Privacy Policy
Id.
75
Id.
76
Id.
77
Id.
78
Arun Kumar et al., A Comparative Study of Secure Device Pairing Methods, 5 PERVASIVE AND
MOBILE COMPUTING 734, 736 (2009), https://info.cis.uab.edu/saxena/docs/kstu-pmc.pdf.
79
Id.
74

In re: Genesis Toys and
Nuance Communications

13

Federal Trade Commission
December 6, 2016

 65. Cayla and i-Que do not employ either of these authentication mechanisms to establish a
Bluetooth connection between the doll and a smartphone or tablet. The dolls do not
implement any other security measure to prevent unauthorized Bluetooth pairing.
66. As a result, when the Cayla and i-Que dolls are powered on and not already paired with
another device, any smartphone or tablet within a 50-foot range can establish a Bluetooth
connection with the dolls. Users do not have to enter an authentication code or have physical
access to the doll in order to establish a connection with the dolls. Users also do not need to
have the Cayla or i-Que companion application installed because smartphones identify the
doll as a hands-free headset.
67. When a smart phone or tablet searches for Bluetooth devices, My Friend Cayla is
discoverable under the name “My friend Cayla” and i-Que is discoverable as “IQUE.” The
dolls are easily recognizable as a child’s toy.
68. The Cayla and i-Que dolls provide no indication of being connected to a device via
Bluetooth. However, Cayla’s necklace and i-Que’s eyes light up when the microphone is
turned on.
69. Researchers discovered that by connecting one phone to the doll through the insecure
Bluetooth connection and calling that phone with a second phone, they were able to both
converse with and covertly listen to conversations collected through the My Friend Cayla and
i-Que toys.
IV.

LEGAL ANALYSIS

A. The FTC’s COPPA Regulation and Enforcement Authority
70. The Children’s Online Privacy Protection Act (“COPPA” or “Act”) regulates the collection
of children’s personal information by operators of online services.80 The FTC has
promulgated regulations, known as the “COPPA Rule,” implementing COPPA.
71. COPPA and the attendant Rule apply to operators of online services, websites, and apps
directed to children under 13 as well as operators of online services, websites and apps
serving a general audience.81
72. Operators of online services directed to children under 13 must comply with the COPPA
Rule’s requirements.82
73. Online service operators with general audiences must comply with the COPPA Rule when
the operator “has actual knowledge that it is collecting or maintaining personal information
from a child.”83
80

Children’s Online Privacy Protection Act, 16 C.F.R. § 312.1.
16 C.F.R. § 312.3.
82
Id.
83
Id.
81

In re: Genesis Toys and
Nuance Communications

14

Federal Trade Commission
December 6, 2016

 74. Under the COPPA Rule, “personal information” includes a “photograph, video, or audio file
where such file contains a child's image or voice.”84 Personal information also includes a
child’s first and last name, home or physical address, geolocation information, an Internet
Protocol (IP) address, and other persistent identifiers.85
75. The COPPA Rule requires that operators meet specific requirements prior to collecting,
using, or disclosing personal information from children, including:
a. Posting a “prominent and clearly labeled” link on the home page of its website or
online service to the operator’s privacy policy, which must provide a clear,
understandable, and complete description what information the operator collects
from children, how it uses that information, and how that information is
disclosed;86
b. Using reasonable efforts and available technology to provide direct notice to
parents of the operator’s information practices, including direct notice of any
material changes to those practices;87
c. Obtaining verifiable parental consent prior to collecting, using, and/or disclosing
personal information from children.88
76. Operators must obtain verifiable parental consent through a method that is “reasonably
calculated, in light of available technology, to ensure that the person providing consent is the
child's parent.”89 The FTC has enumerated several specific methods that satisfy the
requirements of verifiable parental consent, including:
a. Providing a consent form to be signed by the parent and returned to the operator;
b. Having a parent call or video-conference with trained personnel; or
c. Verifying the parents’ identity by checking a form of government-issued
identification against a database of such information.90
77. Operators that use children’s personal information only for internal purposes can obtain
parental consent using the “email plus” method, which allows operators to request consent in
a return email message from the parent.91

84

16 C.F.R. § 312.2.
Id.
86
16 C.F.R. § 312.4(d).
87
16 C.F.R. § 312.4(b).
88
16 C.F.R. § 312.5.
89
16 C.F.R. § 312.5(b)(1).
90
16 C.F.R. 312.5 (b)(2).
91
16 C.F.R. § 312.5(b)(2)(vi). See also, Complying with COPPA: Frequently Asked Questions, FED.
TRADE COMM’N (Mar. 20, 2015), https://www.ftc.gov/tips-advice/business-center/guidance/complyingcoppa-frequently-asked-questions.
85

In re: Genesis Toys and
Nuance Communications

15

Federal Trade Commission
December 6, 2016

 78. Under the COPPA Rule, operators must “establish and maintain reasonable procedures to
protect the confidentiality, security, and integrity of personal information collected from
children.”92
79. Operators may “retain personal information collected online from a child for only as long as
is reasonably necessary to fulfill the purpose for which the information was collected.”93
80. Operators are required to provide parents a reasonable means to direct the operator to delete
any information collected about the child such that it is not maintained in a retrievable form
and cannot be retrieved in the normal course of business.94
B. The FTC’s Section 5 Authority
81. Section 5 of the FTC Act prohibits unfair and deceptive acts and practices, and empowers the
Commission to enforce the Act’s prohibitions.95
82. Under COPPA, violations of COPPA are treated as unlawful unfair and deceptive practices
within the meaning of Section 5 of the FTC Act.
83. Independently of whether a practice violates COPPA, the FTC may find that a practice is
unlawfully unfair and/or deceptive if it meets the FTC’s tests, outlined in policy statements,
for Deception96 and Unfairness.97
84. A trade practice is unfair if it “causes or is likely to cause substantial injury to consumers
which is not reasonably avoidable by consumers themselves and not outweighed by
countervailing benefits to consumers or to competition.”98
85. There are three elements to an unfairness claim. First, the injury suffered by consumers must
be “substantial.”99 Typically, this involves monetary harm, but may also include
“unwarranted health and safety risks.”100 Emotional harm and other “more subjective types
92

16 C.F.R. § 312.8.
16 C.F.R. § 312.10.
94
16 CFR § 312.6, 312.2.
95
See 15 U.S.C. § 45 (2010).
96
Fed. Trade Comm’n, FTC Policy Statement on Deception (1983),
http://www.ftc.gov/bcp/policystmt/ad-decept.htm [hereinafter FTC Deception Policy].
97
Fed. Trade Comm’n, FTC Policy Statement on Unfairness (1980),
http://www.ftc.gov/bcp/policystmt/ad-unfair.htm [hereinafter FTC Unfairness Policy].
98
15 U.S.C. § 45(n); see, e.g., Fed. Trade Comm’n v. Seismic Entertainment Productions, Inc., Civ. No.
1:04-CV- 00377 (Nov. 21, 2006) (finding that unauthorized changes to users’ computers that affected the
functionality of the computers as a result of Seismic’s anti-spyware software constituted a “substantial
injury without countervailing benefits.”).
99
FTC Unfairness Policy, supra.
100
Id.; see, e.g., Fed. Trade Comm’n v. Information Search, Inc., Civ. No. 1:06-cv-01099 (Mar. 9, 2007)
(“The invasion of privacy and security resulting from obtaining and selling confidential customer phone
records without the consumers’ authorization causes substantial harm to consumers and the public,
including, but not limited to, endangering the health and safety of consumers.”).
93

In re: Genesis Toys and
Nuance Communications

16

Federal Trade Commission
December 6, 2016

 of harm” generally do not make a practice unfair.101 Second, the injury “must not be
outweighed by an offsetting consumer or competitive benefit that the sales practice also
produces.”102 Thus the FTC will not find a practice unfair “unless it is injurious in its net
effects.”103 Finally, “the injury must be one which consumers could not reasonably have
avoided.”104 This factor is an effort to ensure that consumer decision making still governs the
market by limiting the FTC to act in situations where seller behavior “unreasonably creates
or takes advantage of an obstacle to the free exercise of consumer decisionmaking.”105
Sellers may not withhold from consumers important price or performance information,
engage in coercion, or unduly influence highly susceptible classes of consumers.106
86. An act or practice is deceptive if it involves “a representation, omission, or practice that is
likely to mislead the consumer acting reasonably under the circumstances, to the consumer’s
detriment.”107
87. There are three elements to a deception claim. First, there must be a representation, omission,
or practice that is likely to mislead the consumer.108 The relevant inquiry for this factor is not
whether the act or practice actually misled the consumer, but rather whether it is likely to
mislead.109 Second, the act or practice must be considered from the perspective of a
reasonable consumer.110 “The test is whether the consumer’s interpretation or reaction is
reasonable.”111 The FTC will look at the totality of the act or practice and ask questions such
as “how clear is the representation? How conspicuous is any qualifying information? How
important is the omitted information? Do other sources for the omitted information exist?
How familiar is the public with the product or service?”112 Finally, the representation,
omission, or practice must be material.113 Essentially, the information must be important to
consumers. The relevant question is whether consumers would have chosen another product
if the deception had not occurred.114 Express claims will be presumed material.115 Materiality
is presumed for claims and omissions involving “health, safety, or other areas with which the
reasonable consumer would be concerned.”116
101

FTC Unfairness Policy, supra.
Id.
103
Id.
104
Id.
105
Id.
106
Id.
107
FTC Deception Policy, supra.
108
Id.; see, e.g., Fed Trade Comm’n v. Pantron I Corp., 33 F.3d 1088 (9th Cir.
1994) (holding that Pantron’s representation to consumers that a product was effective at reducing hair
loss was materially misleading, because according to studies, the success of the product could only be
attributed to a placebo effect, rather than on scientific grounds).
109
FTC Deception Policy, supra.
110
Id.
111
Id.
112
Id.
113
Id.
114
Id.
115
Id.
116
Id.
102

In re: Genesis Toys and
Nuance Communications

17

Federal Trade Commission
December 6, 2016

 88. For purposes of a deception analysis, an omission is considered material where “the seller
knew, or should have known, that an ordinary consumer would need omitted information to
evaluate the product or service, or that the claim was false . . . because the manufacturer
intended the information or omission to have an effect.”117
89. The FTC Native Advertising Guidelines say, “the FTC will find an ad’s format deceptive if
the ad materially misleads consumers about its commercial nature, including through an
express or implied misrepresentation that it comes from a party other than the sponsoring
advertiser.”118 The FTC Endorsement Guidelines say, “if there’s a connection between an
endorser and the marketer that consumers would not expect and it would affect how
consumers evaluate the endorsement, that connection should be disclosed.”119
90. The Commission has previously found that a company may not repurpose user data for a use
other than the one for which the user’s data was collected without first obtaining the user’s
“express affirmative consent.”120
V.

GENESIS TOYS’ VIOLATIONS OF COPPA

A. Count I: Failure to Provide Adequate Online Notice and Direct Notice to Parents of
its Information Practices, and Material Changes Thereto
91. As described above, Genesis operates an online service directed to children via the My
Friend Cayla and i-Que Intelligent Robot dolls and companion applications, which collects
personal information from children, including audio files of children’s voices, and children’s
names, location, and IP addresses.
92. In connection with the acts and practices described above, Genesis Toys collects personal
information from children younger than 13 in violation of COPPA.
93. Genesis violates the COPPA Rule by failing to provide “a prominent and clearly labeled”
link on the homepage of its website or mobile application to an online notice of its
information practices that clearly, understandably, and completely describes what
information it collects from children and how that information is used and disclosed.
94. As described above, Genesis does not provide a prominent link to the Privacy Policies for
Cayla and i-Que within the companion applications or the homepage for the toys’ website.
Genesis does not make the Cayla Terms of Service for U.S. consumers available anywhere
on its website or in the app.
117

Cliffdale Associates, Inc., 103 F.T.C. 110, 110 (1984).
Native Advertising: A Guide for Businesses, FED. TRADE COMM’N (Dec. 2015),
https://www.ftc.gov/tips-advice/business-center/guidance/native-advertising-guide-businesses.
119
The FTC’s Endorsement Guides: What People Are Asking, FED. TRADE COMM’N (May 2015),
https://www.ftc.gov/tips-advice/business-center/guidance/ftcs-endorsement-guides-what-people-areasking.
120
In the Matter of Google, Inc., FTC File No. 102 3136 (Oct. 13, 2011) (Decision and Order),
http://www.ftc.gov/sites/default/files/documents/cases/2011/10/111024googlebuzzdo.pdf.
118

In re: Genesis Toys and
Nuance Communications

18

Federal Trade Commission
December 6, 2016

 95. As described above, Genesis does not provide a complete description of its collection, use,
and disclosure of children’s voice recordings in the Cayla and i-Que Privacy Policies.
96. As described above, Genesis provides contradictory and misleading information regarding
the identity of third parties that collect and use children’s voice recordings via the Apple and
Android applications.
97. Genesis also violates the COPPA Rule by failing to make reasonable efforts to ensure parents
receive direct notice of its information practices, including direct notice of any material
changes to those practices.
98. As described above, Genesis advises users to check the My Friend Cayla and i-Que websites
regularly for any changes to the Privacy Policy or Terms of Use for the toy. However, the
Terms of Use are not available via the website or application. Genesis does not use any
technological or other means to ensure parents receive direct notice of material changes, such
as a pop-up notice within the application.
99. Therefore, Genesis has violated the direct parental notice and online notice requirements
under the COPPA Rule, 16 C.F.R. § 312.4.
B. Count II: Collection, Use, and Disclosure of Children’s Personal Information
Without Obtaining Verifiable Parental Consent
100. Genesis violates the COPPA Rule by failing to obtain verifiable parental consent prior to
collecting, using, and disclosing children’s personal information.
101. As described above, Genesis deems acceptance of the Cayla or i-Que Terms of Service
and/or downloading the Cayla or i-Que application to constitute parental consent to the
collection of personally identifiable information.
102. Genesis makes no effort to verify or ensure that the person providing consent is the
parent of a child using the My Friend Cayla or i-Que toy. Requiring users to periodically
answer a simple mathematical equation when opening the Cayla application has no relevance
to the identity or age of that user and is not reasonably calculated to ensure consent of the
child’s parent.
103. Therefore, Genesis has violated the parental consent requirements under the COPPA
Rule, 16 C.F.R. § 312.5.
C. Count III: Failure to Comply with Deletion and Data Retention Requirements
104. Genesis violates the COPPA Rule by failing to adequately delete the personal
information of children at the direction of parents, and by retaining children’s personal
information longer than necessary to fulfill the purpose for which it was collected.

In re: Genesis Toys and
Nuance Communications

19

Federal Trade Commission
December 6, 2016

 105. As described above, Genesis does not comply with parental requests to delete personal
information collected from children when it determines, in its sole discretion, the information
must be retained for “legitimate business” purposes. Genesis also represents it may be unable
to fully delete information, and reserves the right to use that information for purposes other
than “to make any decision which will affect” users.
106. As described above, Genesis represents that it does not keep personal information for
“longer than is necessary” but claims the right to retain and use personal information for a
variety of “business purposes,” including targeted advertising.
107. The Cayla and i-Que toys collect children’s personal information, including voice
recordings, for the purpose of providing the content of dialogue while children play with the
toys’ interactive features. Targeted advertising and other vaguely defined business purposes
are unrelated to this purpose.
108. Genesis retains children’s personal information for targeted advertising and other
business purposes beyond what is reasonably necessary to fulfill the purpose for which the
information was collected.
109. Therefore, Genesis has violated the deletion and data retention requirements under the
COPPA Rule, 16 C.F.R. §§ 312.6, 312.10.
VI.

GENESIS TOYS’ VIOLATION OF THE FTC ACT

A. Count IV: Unfair Failure to Employ Reasonable Security Practices to Prevent
Unauthorized Bluetooth Connections to the My Friend Cayla and i-Que Dolls
110. As described above, Genesis fails to implement any authentication or security measures
to prevent unauthorized Bluetooth connections with the My Friend Cayla and i-Que dolls.
111. As described above, Genesis’ insecure Bluetooth technology allows unauthorized parties
to covertly eavesdrop on children’s conversations with Cayla and i-Que.
112. The failure to employ basic security measures to protect children’s private conversations
from covert eavesdropping by unauthorized parties and strangers creates a substantial risk of
harm because children may be subject to predatory stalking or physical danger.
113. This injury could not reasonably be avoided because children and parents receive no
indication that the doll is connected to a device via Bluetooth.
114. This failure to employ basic security measures to prevent unauthorized Bluetooth
connections is not outweighed by countervailing benefits to consumers or to competition.
115. Therefore, Genesis’ inadequate security measures with respect to My Friend Cayla and iQue’s Bluetooth technology constitute unfair acts or practices in violation of Section 5 of the
FTC Act, 15 U.S.C. § 45(n).
In re: Genesis Toys and
Nuance Communications

20

Federal Trade Commission
December 6, 2016

 B. Count V: Deceptive Failure to Disclose Product Placement in My Friend Cayla and
i-Que
116. As described above, Genesis pre-programs My Friend Cayla and i-Que with dozens of
phrases endorsing Disney products. Genesis does not disclose this advertising practice.
117. The failure to disclose that My Friend Cayla and i-Que are pre-programmed to endorse
Disney products on behalf of Disney as a sponsoring advertiser creates an implied
misrepresentation that these endorsements come from Cayla and i-Que and not Disney.
118. This misrepresentation is misleading to users about the commercial nature of these
endorsements. Moreover, as described above, this omission is particularly misleading for
young children who have not yet developed the cognitive ability to scrutinize and understand
such product placement.
119. The misrepresentation is material because it is designed to influence and increase
children’s affinity with and demand for Disney products.
120. The omission is also material because a reasonable parent would need this information to
evaluate whether the toys are appropriate for their children.
121. Genesis’ representation and omission are misleading from the perspective of children and
parents and are material, and Genesis is therefore engaging in a deceptive act or practice in
violation of Section 5 of the FTC Act, 15 U.S.C. § 45(a).
C. Count VI: Deceptive Misrepresentation that Genesis Complies with COPPA, but
Fails to Obtain Parental Consent or Comply with Other COPPA Requirements
122. As described above, Genesis represents that it is in compliance with all privacy laws,
including COPPA’s requirements to obtain verified parental consent and provide online
notice of information practices.
123. Genesis’ representation is misleading because users may believe that Genesis is
complying with COPPA.
124. As described above, Genesis fails to comply with numerous COPPA provisions,
including requirements on parental consent and notice.
125. No other information is available for a reasonable consumer to believe that Genesis is in
compliance with COPPA or to otherwise take advantage of the COPPA procedures.
126. The representation is material because it is important to users that want to evaluate
Genesis services in order to safeguard their children’s information and users likely would
have chosen another product for their children.

In re: Genesis Toys and
Nuance Communications

21

Federal Trade Commission
December 6, 2016

 127. Genesis’ misrepresentation constitutes a deceptive act or practice in violation of Section 5
of the FTC Act, 15 U.S.C. § 45(a).
VII.

NUANCE COMMUNICATIONS’ VIOLATIONS OF COPPA

A. Count VII: Violation of Children’s Online Privacy Protection Act
128. As described above, Nuance has a contractual agreement with Genesis, a toy company, to
use its voice recognition service on the My Friend Cayla and i-Que toys, which are designed
for children under 13.
129. As described above, Nuance is collecting the voice and text files from the toy apps in
order to “develop, tune, enhance, and improve Nuance services and products.”
130. As described above, Nuance’s products and services include voice biometric solutions
sold to military, intelligence, and law enforcement agencies.
131. Nuance’s voice recognition service is an online service that, when used with the toy apps,
targets children under 13.
132. Nuance has actual knowledge that it is collecting and maintaining personal information
from a child when it collects the speech and text files from children.
133. Nuance has not obtained parental consent to collect and maintain children’s voices and
speech data, nor does it have a procedure to provide notice, obtain verifiable consent, or
provide means for review of this data.
134. Therefore, Nuance’s failure to obtain parental consent for the collection and transmission
of children’s voices constitutes a violation of the COPPA Rule, 16 C.F.R. § 312.3 (2013).
VIII. NUANCE COMMUNICATIONS’ VIOLATIONS OF THE FTC ACT
A. Count VIII: Deceptive Misrepresentation that Nuance is in Compliance with
COPPA When it Does Not Obtain Consent From Parents or Provide Other COPPA
Procedures
135.

As described above, Nuance represents that it is in compliance with all privacy laws.

136. Nuance’s representation is misleading because users may believe that Nuance is
complying with COPPA.
137. No other information is available for a reasonable consumer to believe that Nuance is in
compliance with COPPA or to otherwise take advantage of the COPPA procedures.

In re: Genesis Toys and
Nuance Communications

22

Federal Trade Commission
December 6, 2016

 138. The representation is material because it is important to users that want to evaluate
Nuance services in order to safeguard their children’s information and users likely would
have chosen another product for their children.
139. Nuances’ misrepresentation constitutes a deceptive act or practice in violation of Section
5 of the FTC Act, 15 U.S.C. § 45(a).
140. Both the iOS and Android apps send voice recordings to Nuance, which contradicts the
user agreement.
B. Count IX: Unfair Use of Children’s Voices to Enhance Products and Services Sold
to Military, Government, and Law Enforcement Agencies
141. As described above, Nuance uses the voice and text information it collects to “develop,
tune, enhance, and improve Nuance services and products.”
142. As described above, Nuance’s products and services include voice biometric solutions
sold to military, intelligence, and law enforcement agencies.
143. The use of children’s voice and text information to enhance products and services sold to
military, intelligence, and law enforcement agencies creates a substantial risk of harm
because children may be unfairly targeted by these organizations if their voices are
inaccurately matched to recordings obtained by these organizations.
144. This injury could not reasonably be avoided by users because they could not reasonably
anticipate that their children’s voices and text would be recorded and used in this way.
145. This use of the information is not outweighed by countervailing benefits to consumers or
to competition.
146. Therefore, Nuance’s inadequate disclosures constitute unfair acts or practices in violation
of Section 5 of the FTC Act, 15 U.S.C. § 45(n).
IX.

PRAYER FOR INVESTIGATION AND RELIEF

147. The undersigned petitioners urge the Commission to investigate Genesis Toys and
Nuance Communications, and enjoin their COPPA violations and unfair and deceptive trade
practices.
148.

Specifically, the undersigned request the Commission to:
a. Initiate an investigation into the collection, use, and disclosure of children’s
personal information by Genesis and Nuance;
b. Halt Genesis’ failure to provide adequate notice of its information practices
and obtain verified parental consent prior to collecting personal information
from children;

In re: Genesis Toys and
Nuance Communications

23

Federal Trade Commission
December 6, 2016

 c. Halt Genesis’ retention and use of children’s personal information for targeted
advertising and other purposes unrelated to the functioning of the My Friend
Cayla and i-Que toys;
d. Investigate and halt Genesis’ unfair and deceptive practices related to product
placement in My Friend Cayla and i-Que;
e. Halt Genesis’ failure to employ reasonable security measures with respect to
Bluetooth connections for My Friend Cayla and i-Que;
f. Halt Nuance’s deceptive practices with respect to children’s personal
information;
g. Investigate and enjoin Nuance’s use of children’s speech data to enhance
products and services sold to military, government, and law enforcement
agencies;
h. Investigate other companies engaged in similar practices; and
i. Provide other such relief as the Commission finds necessary and appropriate.
Respectfully Submitted,
_/s/_________________________
Marc Rotenberg
EPIC President and Executive Director
_/s/_________________________
Claire Gartland
Director, EPIC Consumer Privacy Project
Electronic Privacy Information Center
1718 Connecticut Ave. NW Suite 200
Washington, DC 20009
202-483-1140 (tel)
202-483-1248 (fax)
Counsel for Petitioners
_/s/_________________________
Laura M. Moy, Esq.
Acting Director
_/s/_________________________
Chris Laughlin, Esq.
Clinical Teaching Fellow
Institute for Public Representation
Georgetown University Law Center
600 New Jersey Avenue, NW, Suite 312
Washington, DC 20001
(202) 662-9547
Counsel for Petitioners

In re: Genesis Toys and
Nuance Communications

24

Federal Trade Commission
December 6, 2016