Target and Walmart stop selling the superhackable kids’ toy CloudPets after pressure from Mozilla

CloudPets, stuffed animals that contain Bluetooth and a built-in microphone, have been the center of several hacking scandals. In advance of a petition from Mozilla, CloudPets smart toys will be removed from Target and Walmart store shelves.

CloudPets allow children to send and receive audio messages through a stuffed toy with the help of the cloud and an iOS or Android app. In February of 2017, the service saw a breach that leaked email addresses, passwords, profile pictures and 2 million voice recordings of CloudPets users. Soon after, researchers discovered that the toy could be compromised so that hackers could make CloudPets toys say whatever they wanted.

Now, in 2018, CloudPets are being removed from store websites following rumblings of a campaign by Mozilla to prevent CloudPets from being sold by three major retailers: Amazon, Target and Walmart. The campaign won’t see the light of day but it accomplished part of what it set out to do: first Target and Walmart — and now Amazon — have agreed to cease selling CloudPets.

Mic has reached out to Walmart for more information.

The petition, which will go unreleased, would have included a letter sent to retailers detailing three issues in CloudPets products, regarding data breaches, spying capabilities and potential phishing risks. “The concern we have around CloudPets is that the vulnerability has been clear for a while and there’s been no action,” Ashley Boyd, Mozilla’s vice president of advocacy, said by phone. “Some smart toys are better at security than others, but we felt like CloudPets was an egregious example. Our goal was to reach out to retailers to make sure they knew exactly what kind of product they were selling.”

Boyd recounted a similar situation when Mozilla spoke out against Amazon’s Echo Dot Kids Edition. Many know that Amazon holds onto and makes listenable previous Alexa searches, but things get murky when Amazon is encouraging children to upload audio that it then archives. “The page describing the Echo Dot Kids Edition was quite detailed, but offered no mention on the collection of data,” Boyd said. “They said they cared about children’s privacy, but didn’t include any information. We’d like to see the marketplace change so that manufacturers actually include that information.”

Boyd notes that we could see a future in which smart toys like CloudPets are compliant with Europe’s recently passed the General Data Protection Regulation bill, allowing for users to be notified when a data breach has occurred, as well as download or delete their data. Despite CloudPets being taken off store shelves, the real win would be putting proper laws in place so the next smart toy company doesn’t put its customers at risk.

June 5, 2018, 3 p.m. Eastern: This story has been updated.