Parents have a whole new world to worry about: the new wave of toys out there that are connected to the Internet 24/7 and and can potentially spy on their children.

Sales of these smart toys took off over a year ago, but few people have been living with them long enough to understand all their ins and outs. One feature they share is the ability to record, store and transmit conversations that they have with children.

Among the many possible bad outcomes, one stands out: strangers might now be able to identify and locate children.

There have already been problems with theft and misuse of children's data. VTech, a company that produces tablets for children, was storing the personal data of 5 million parents and over 200,000 children when it was hacked. The stolen information included names, email addresses, passwords, home addresses of parents, and names and birthdays of children, as well as pictures, chat logs and audio recordings. Among the many possible bad outcomes, one stands out: strangers might now be able to identify and locate children.

The potential for information collected by smart toys to share the same fate as these tablets has made them controversial. Some people see them as a threat to children, including one editorial calling them the stuff of nightmares. Earlier this year, Germany banned the Cayla doll over fears that personal data could be stolen.

To better understand how people feel about Internet-connected toys, researchers interviewed nine parent-child pairs about their attitudes and concerns. Three major finding emerged: most parents had privacy concerns, few children understood that they were being recorded and the toys themselves seemed insufficiently complicated and flexible to be fun for the children to play with.

The children, ages 6 to 10, got to play with two popular toys, CogniToys Dino and Hello Barbie. These toys were chosen for the study because they are among the industry leaders for their stated privacy measures. Hello Barbie has an extensive permissions process for parents to complete during setup of the toy, and it has been complimented for its strong encryption practices, though one analysis found vulnerabilities in its websites.

Children and parents were asked a variety of questions, both before seeing the toys and after. Most parents were concerned about their child's privacy. All wanted parental controls, such as the ability to disconnect Barbie from the Internet or control the types of questions to which the toys will respond. And all said they would not want the toys to be able to share recordings the toys made of their child on social media.

Some children understood that the toys could record them, but still more did not understand this or were unsure. Six of the nine children mistakenly thought their parents could not hear what they said to the toy unless they were nearby. And children had their own privacy concerns — when informed by a parent that everything they shared with the toy could end up on the computer, one replied: “That's pretty scary.”

A good indication that children do not fully understand the privacy issues was the child who understood that the toy records but was still willing to tell it a secret. Children rely on adults to protect their privacy, but you're never too young for data miners.

The authors suggest that manufacturers, at a minimum, include an obvious indicator of when a toy is recording. This could be anything from a red light that turns on while recording to having the toy itself tell the child when it is recording. Another suggestion is that manufacturers re-evaluate the need for their toys to record and monitor children's conversations.

Other possibilities include automatically deleting recordings after a week or allowing parents to delete them.

Parents who like the idea of being able to monitor what their child is saying might want to consider that with an Internet-connected toy, they may not be the only person able to monitor them.

The authors suggest that future smart toys draw on features of conversational agents such as Siri and Alexa which many children already are familiar with. That would certainly please the seven-year old who kept asking Dino for Seattle Mariner scores.

The study was presented at CHI 17, the 2017 CHI Conference on Human Factors in Computing Systems, held in Denver, Colorado on May 6-11 and is freely available.