← IoT Privacy Database

VTech / LeapFrog Kids Tablets

VTech Holdings Ltd. · Kids' Device / Parental Monitor

Staff Reviewed — a person at DeSpy reviewed this rating.

3.1Surveillance
Index
Policy — what its policy permitsC
Evidence — what research provesC

VTech and LeapFrog kids' tablets and connected toys collect children's names, genders, birthdays, photos and parent-child chat logs through the Learning Lodge account platform. In 2015 an intruder took data on about 4.8 million parents and at least 200,000 children (including kids' photos and chats), which VTech had stored unencrypted despite claiming otherwise; a 2018 FTC COPPA settlement followed.

Why this rating

Collects sensitive children's identity data, photos and chats (-15) with historically vague/misleading policy language (-7), partly offset by the FTC-mandated 20-year independent security audit program (+4). Evidence: a 2015 breach exposing millions of parents and children (major-breach, half-weighted as >5yr) plus the 2018 FTC COPPA regulatory action over unencrypted storage and misrepresentation.

What it is

Manufacturer
VTech Holdings Ltd.
Category
Kids' Device / Parental Monitor
Model years
2010-present
Market status
Current
Companion app
Learning Lodge

The evidence 2

Independent research, regulatory action, lawsuits and journalism about how this device handles personal data — the "what actually happens" axis. Each links to its source.

  1. S4Electronic Toy Maker VTech Settles FTC Allegations That it Violated Children's Privacy Law and the FTC Act
    Regulatory action · Federal Trade Commission · 2018-01

    VTech paid $650,000 and was ordered into a 20-year audited security program for collecting kids' data without proper consent and falsely claiming it encrypted the data.

    Why it matters here: Federal enforcement directly about children's data collected by VTech's kids' tablets and toys.

  2. S4After breach exposing millions of parents and kids, toymaker VTech handed a $650K fine by FTC
    Journalism · TechCrunch · 2018-01

    Recaps the 2015 breach that exposed 4.8M parents and 200K+ children including photos and chat logs, and the resulting FTC action.

    Why it matters here: Documents the scale of the children's-data breach on this product line.

Are you the maker? Respond to this finding

Free. There is no paid or faster path, and nothing about a rating is for sale. Prove you control your company's domain with one DNS record; a person then reads your statement beside our finding and decides whether to publish it.

An email is encrypted at rest and opened only to answer you; it is erased 30 days after we resolve this (or 180 days if still open), and you can erase it sooner. Unproven filings are deleted after 14 days.

Think something here is wrong?

Evidence and research improve when people push back. Tell us what to re-check — a misattributed domain, an outdated classification, a claim about your own app — and a human will review it. Responses can take up to 30 days.

If you leave an email it is encrypted at rest and opened only to answer you — never shared, never used for anything else. It is erased 30 days after we resolve this (or 180 days if it is still open) without you asking, and you can erase it sooner at any time; either way your correction stays, anonymously. Leave it blank and your request is fully anonymous from the start (we store no IP address either way).

Descriptive, cited, not legal advice; ratings are versioned and corrections create a new version. Data from the IoT Info Grabber DB research project, CC BY-SA 4.0.

← Back to the IoT Privacy Database