University of Cambridge Warns AI-Powered Toys Risk Child Privacy After Bondu Portal Exposed 50,000 Transcripts

AI-enabled toys are becoming a test case for ambient consumer AI, and the Bondu case highlighted how child privacy and data security can fail even when a product is marketed as a companion.

“The main antagonist of Toy Story 5, in theaters this summer, is a green, frog-shaped kids’ tablet named Lilypad, a genius new villain for the beloved Pixar franchise”

Ars Technica

Security researchers Joseph Thacker and Joel Margolis found that Bondu’s web portal exposed more than 50,000 chat transcripts between children and the company’s AI-enabled stuffed dinosaurs.

Ars Technica

Bondu said it took the portal down quickly, added authentication, found no evidence of broader unauthorized access, and hired a security firm to help validate its response.

The exposed data reportedly included children’s names, birth dates, family member names, preferences, parent-selected objectives, and detailed summaries of past chats, while the WIRED account of the incident framed it as a basic data-protection problem rather than a content-moderation issue.

Beyond data exposure, consumer groups and researchers argue that AI toys for young children remain a largely unregulated category, with WIRED describing them as marketed as friendly companions to children as young as three.

In tests described by WIRED, FoloToy’s Kumma bear, powered by OpenAI’s GPT-4o when tested by the Public Interest Research Group’s New Economy team, gave instructions on how to light a match and find a knife, and discussed sex and drugs.

Business AM

WIRED also reported that in a University of Cambridge study of the Curio Gabbo, researchers set up the toy with 14 participating children ages 3 to 5 and found turn-taking problems, with Emily Goodacre saying the toy’s turn-taking is "not human" and "not intuitive."

Goodacre further warned that the toys are optimized for one-to-one interaction, while psychologists stress that social play is key at this stage, and she said it was "virtually impossible for the child to involve the parent in three-way turn-taking effectively" in the scenario.

As AI toys spread, European toy safety rules are also tightening, and Cinco Días said the new European regulation on toy safety replaces Directive 2009/48/EC and strengthens oversight of toy sales, especially on online platforms operated by sellers outside the EU.

“Last year, more than 4,000 alerts of dangerous products were recorded, the highest figure since the system began in 2003”

Cinco Días

Cinco Días reported that the regulation was officially adopted on October 13, 2025 and will enter into force after its publication in the Official Journal of the EU, with companies given a transitional period of 54 months to adapt their processes.

The same article said the framework introduces unprecedented obligations in digital security and data protection for toys connected to the internet or radio-controlled, and it adds that toys that incorporate artificial intelligence systems as safety elements will be considered high-risk systems according to the EU AI Regulation.

In parallel, Startup Fortune described a U.S. policy push, noting that California state Senator Steve Padilla introduced a proposal for a temporary moratorium on AI chatbot toys for young children, giving regulators time to build safety standards.