'Eiliko' is exactly the toy a child asks for: a small companion robot with expressive eyes and a friendly voice, made by Energize Lab. According to research covered by The Verge, the problem is not the robot but what sits behind it. The photos, audio and video the device captures are stored on servers in China behind weak protections, putting children's data within reach of anyone who finds the right endpoint.
Connected toys have an unbroken record of this failure mode. In 2015 researchers showed that the 'Hello Barbie' doll could be turned into a listening device through its cloud service; VTech suffered a breach that exposed data on millions of children and parents. The pattern repeats because the ingredients are the same: a charming gadget built to a price, a companion app, a cloud account — and no serious security engineering behind any of it.
Once data leaves the home it is subject to two things the buyer cannot control: another company's security and another country's laws. That is not a reason to avoid every connected device, but it does change the question a parent should ask — not 'is it cute?' but 'what does it hear, where does that go, and who can reach it?'
Practical measures are limited but real: prefer toys that process voice locally where that option exists; switch off cloud features you do not need; look for a clear data-deletion path before buying; and treat any internet-connected toy as a microphone sitting in the playroom.
Regulators are catching up slowly — the EU's Cyber Resilience Act, revised toy-safety rules and COPPA enforcement in the United States all push in the same direction — but certification advances far more slowly than the flood of cheap connected devices reaching shelves.
