Got a toy that can spy? Here’s how to know and what to do

NEW YORK — The toys your kids unwrap this Christmas could invite hackers into your home.

That Grinch-like warning comes from the FBI, which said earlier this year that toys connected to the internet could be a target for crooks who may listen in on conversations or use them to steal a child’s personal information.

The bureau did not name any specific toys or brands, but it said any internet-connected toys with microphones, cameras or location tracking may put a child’s privacy or safety at risk. That could be a talking doll or a tablet designed for kids. And because some of the toys are being rushed to be made and sold, the FBI said security safeguards might be overlooked.

Security experts said the only way to prevent a hack is to not keep the toy. But if you decide to let a kid play with it, there are ways to reduce the risks.

Before opening a toy, search for it online and read reviews to see if there are any complaints or past security problems. If there have been previous issues, you may want to rethink keeping it.

Reputable companies will also explain how information is collected from the toy or device, how that data is stored and who has access to it. Usually that type of information is found on the company’s website, typically under its privacy policy. If you can’t find it, call the company. If there isn’t a policy, that’s a bad sign.

“You shouldn’t use it,” said Behnam Dayanim, a partner at Paul Hastings in Washington, and co-chair of the law firm’s privacy and cybersecurity practice.

Companies can change their privacy policies, so read them again if you’re notified of a change.

Make sure the Wi-Fi the toy will be connected to is secure and has a hard-to-guess password. Weak passwords make it easier for hackers to access devices that use the Wi-Fi. Network. Never connect the toy to free Wi-Fi that’s open to the public. And if the toy itself allows you to create a password, do it.

When the toy is not being used, shut it off or unplug it so it stops collecting data.

“They become less of an attractive target,” said Alan Brill, who is a cybersecurity consultant.