Children's Privacy Protection Engine from Smart Anthropomorphic Toys to Robots

Patrick C. K. Hung Faculty of Business and IT Ontario Tech University, Canada

FSP, Toronto 1 September 13, 2019 • Laura Rafferty (Ph.D. Candidate) • Benjamin Yankson (Ph.D. Candidate) • Anna Priscilla de Albuquerq (Ph.D. Candidate) • Andre de Lima Salgado (Ph.D. Student) • David Mettrick (Master Student) • Otávio Albuquerque (Master Student) • Dariem Szeto (Undergraduate Student) • Jimmy Xue (Undergraduate Student) • Aaron Lu (Undergraduate Student) • Federico Hauque (Undergraduate Student) 2 What is Smart Toy?

3 • A toy is a product intended for learning or play. • Common examples include dolls, cars, and board games • Canada is one of the largest toy markets in the world. • Toy companies such as Hasbro, , and Tech4Kids have released toys that integrate with mobile platforms, providing new capabilities and add-ons to traditional functionality. • In these years, Toy Fair indicates the future of toys is Internet of Thing (IoT), such as Smart Toys.

4 Tamagotchi BANDAI NAMCO Entertainment Inc. 5 • Internet connected educational toys • IBM Watson’s knowledge Elemental Path’s “friendgine” which is a kid-friendly database • Using an Android or iOS app, parents connect CogniToys to their home’s Wi-Fi.

6 • A smart anthropomorphism toy is defined as a device consisting of a physical toy component in the humanoid form that connects to a computing system through networking and sensory technologies to enhance the functionality of a traditional toy. • Many studies found out that anthropomorphic designs resulted in greater user engagement. Children trusted such designs serve a good purpose and felt less anxious about privacy. 7 The Uncanny Valley

8

Adapted from: M. Mori, K. F. MacDorman, and N. Kageki, “The uncanny valley,” Robotics & Automation Magazine, IEEE, vol. 19, no. 2, pp. 98–100, 2012 Who is Hello ?

9 • saw her daughter Barbara play with paper dolls, but Ruth believed that her daughter would love to have a 3D doll. • Ruth brought a German doll called Lilli, which was a mildly pornographic doll for adults, from Switzerland.

10 • Ruth Handler used Lilli as a model to create a new doll called Barbie for girls and founded a company called Mattel Inc. • First Barbie debuted at the American International Toy Fair in March, 1959.

11 • By the early 1960s, Barbie Doll was the image of what little girls wanted to be when they were older. • With a curvaceous body, a glamorous if indefinite face, a huge closet of clothes and other accessories, and a handsome boyfriend names , she was every girl's dream doll. • Who are Barbie’s father, mother, and sister?

12 • Barbie has made Mattel the fourth biggest user of garment cloth in the United States.

13 • In 1992, Mattel had created 270 phrases for Teen Talk Barbie, and four of these would go into each doll. • One of these phrases was "Math class is tough." • The American Association of University Women, the National Council of Teachers of Mathematics, and other similar groups complained.

14

Ref: Andrew McClary, "Good Toys, Bad Toys: How Safety, Society, Politics and Fashion Have Reshaped Children's Playthings," McFarland & Company, May 2004 15

Source: www.cnn.com • “Hello Barbie can have real back-and-forth dialogue with a child about career goals, interests, favorite ice cream flavors and listen (and tell) jokes.” • “But Mattel makes it clear that it never asks about personal information, like where a child lives or even their name.” • Ref: Samantha Murphy Kelly, “The new Hello Barbie is like Siri trapped in a doll's body, MashableAsia, September 15, 2015.

16 Analysis of Hello Barbie Privacy Policy on ToyTalk.com

Privacy Requirement for Toy Computing (Hung, Hello Barbie Privacy Policy 2015) Last Revised: January 5, 2016 (https://toytalk.com/hellobarbie/privacy/)

1 The right for a parent/guardian to request We use Recordings only for limited purposes restrictions on the use or disclosure of private as described in this Policy. We use Recordings in information of their child. This allows order to provide and maintain the Services. We parents/guardians to provide restrictions to purpose, may also use, store, process, convert, recipients, obligations, and retention regarding their transcribe, analyze or review Recordings in child’s information. order to provide, maintain, analyze and improve the functioning of the Services, to develop, test or improve speech recognition technology and artificial intelligence algorithms, or for other research and development and data analysis purposes. We do not use Recordings or their content, including any personal information that may be captured therein, to contact children or to advertise to them. 2 The right for a parent/guardian to access, copy, and ToyTalk uses parental email in order to obtain inspect collected records on their child. This allows a parental consent for your children's use of the parent/guardian to access their child’s records to see Services and to create a parent account, which that data that is collected on them. allows you to access the Parental Settings section of the ToyTalk website. For your convenience, ToyTalk offers a unified parent account so if your children also use or want to use other ToyTalk children’s products or services, you may use the same account to manage your children's use of all such products or services. Analysis of the 8,000 Phrases in Hello Barbie

18 19 20 Source: Bill Nelson, "Children’s Connected Toys: Data Security and Privacy Concerns," Office of Oversight and Investigations Minority Staff Report, Committee on Commerce, Science, and Transportation, December 14, 2016 • Personal Information Protection and Electronic Documents Act (PIPEDA) Canada • 10 Privacy Principles • OPC comments about children’s privacy

• Children’s Online Privacy Protection Act (COPPA) United States • Amendment in 2010 to include geolocation information as “personal information”

• UNICEF/ITU Industry Guidelines on Child Online Industry Guidelines and Best Protection Practices • Mobile marketing regulations (MMA, CTIA)

• Toy safety guidelines do not mention privacy • North American Toy Industry Association (TIA) 21 Toy Industry • Identifies privacy and data security landscape in toy industry with emerging popularity of child- directed mobile apps 22 23 24 25 Conceptual Model of Toy Computing Environment

26 Companion (Service) Robots

27 28 29 30

Social Cue (e.g., Movement, Spoken Word or Phase) 31 32 33 34 35 36 AUthentic Robotic Assistant (AURA) Prof. Ruth Stock-Homburg Department of Marketing & Personal Management Technische Universität Darmstadt, Germany

37 A Privacy Policy Engine

38 • Data minimization – minimizing collection and retention of potentially sensitive user data • User participation – allowing parent/guardian to be in control of their child’s private data • Compliance with laws and regulations

39 • Constraint 1: The right for a parent/guardian to request restrictions on the use or disclosure of private information of their child. • Constraint 2: The right for a parent/guardian to access, copy, and inspect collected records on their child. • Constraint 3: The right for a parent/guardian to request deletion or correction if records are inaccurate. • Constraint 4: The right for a parent/guardian to request acknowledgements through a communication channel when private information of their child is collected. • Constraint 5: The right to file complaints to toy company. • Constraint 6: The right for a parent/guardian to find out where 40 private data has been shared for purposes other than a game. • While they will also likely be even more concerned with their child’s privacy, it is important to parents/guardians that they are able to understand and correctly control their child’s private data. • A children privacy protection engine is required to allow parents to easily and effectively set preferences to control and restrict the personal data that can be collected on their child. 41 • Mockup interface for parents/guardians to use as an initial setup to configure preferences and create policy rules • Initial setup of a toy computing application

42 • My email: [email protected]

43