Eiliko, a small expressive robot sold on Amazon, stores what children tell it on servers in China that are readable by anyone who finds them. A Verge reporter bought one in late August and asked it directly whether it shared conversations. Within minutes, a person on another continent held a complete transcript.
The exposure ran far past one device. The reporter’s contact could read roughly 13M conversations from tens of thousands of users, and appeared to have access to the entire active fleet of 68,000 units. The largest market is the United States, where more than 31,000 profiles belong to children.
The manufacturer as weak link
Eiliko’s maker, Energize Lab, is not named on the product as the party responsible for the data, and the toy ships with no meaningful disclosure about where conversations go. The companion personality itself is hosted remotely, which means whoever reaches the backend can read what a child said and, in principle, change how the robot responds.
The product category is growing quickly. Companion robots aimed at families have proliferated on major marketplaces with thin security review, and regulators have been slow to treat a talking toy as a connected device holding sensitive data.
What parents can do now
There is no patch reported for the Eiliko exposure. The practical advice for households that already own one is to disconnect it from Wi-Fi and stop using the companion features, since the transcripts exist on someone else’s infrastructure with a retention policy the buyer never saw.
