Before the box is open, parents see plush fabric, a screen and a face drawn to look endearing. What they cannot see is where the data goes. In 2026 more vendors are leaning on the phrase on-device AI, and under that one label the architectures differ enormously.
Three Architectures, and Price Is a Poor Guide
The first design is fully offline. Voice and interaction are processed inside the body, little leaves the device, and third-party analytics components are usually absent. The second is hybrid: core functions run locally, but some usage logs or anonymised data still get uploaded, which is when you need to check whether that anonymised data carries identifiers that point back to one specific child. The third is cloud-dependent. Every question, answer and error may travel to a remote server, and over time that builds a remarkably complete archive of a child's voice and curiosities.
There is a counter-intuitive point here. Price and privacy correlate weakly. Expensive does not mean safer, and a finely stitched AI plush can handle data exactly the way a pricier connected robot does.
The phrase on-device also deserves a second look. A January 2026 industry commentary argued that some so-called edge designs are little more than a marketing veneer: even a fully local product still takes periodic firmware updates, and if the vendor's update server is compromised, a malicious patch can reach an entire fleet. That judgement may not fit every vendor, but it makes a useful point. Local processing removes risk from the transmission leg, it does not zero out risk.
Three Red Flags and a Checklist You Can Use
Keep three red flags in mind while shopping. First, a toy that is basically unusable without constant Wi-Fi is likely streaming audio and data to the cloud. Second, a privacy policy phrased around vague third-party AI service providers means your child's conversation may be routed to an external model. Third, the absence of a physical disconnect matters: if the software offers a mute button but the body has no sliding cover or hardware cut-off, that is not off.
Then comes a question set worth carrying along. Does core play still work with the network down? Does the collection list name specifics such as voice, images and location? Can parents view, export and delete their child's data? Are firmware updates signed, and does the vendor state a support window? Where is data stored, how long is it kept, and which server processes it?
Regulatory expectations are tightening too. In the United States, COPPA treats audio recordings containing a child's voice as personal information, and the 2025 amendments brought biometric identifiers into scope and now require a written security policy. EU privacy law layers its own consent requirements on children's data. Back in 2017, the FTC settled with VTech over its Kid Connect service precisely because children's voice recordings and records sat unprotected for years, which is the pattern to avoid: data that piles up at the toy end is very hard to clean up later.
One last note: do not stop at the age label on the box. Fit also depends on whether a child can understand the interaction model, operate it independently, and whether the toy amounts to open-ended chat without boundaries. Filter first on whether it still plays offline, then compare features and price. The shortlist gets much clearer that way.
© SWPO. All rights reserved.