The request came in on a Tuesday, and Marisol Teague had eleven working days to answer it.
Her office was a converted storefront on Parade Street in Erie, two monitors turned away from the window, a wire tray of printed consent forms, and behind glass a rack of grey cases holding the archives of four companies that no longer existed. She fulfilled disclosure and deletion requests for the dead. When a toy maker folded, somebody still had to answer the mail.
The file she opened that morning was logged as a 2026 fleet archive. Voice transcripts, device identifiers, a profile table. The requester was nineteen and wanted to know what was in it about her.
The first line of the first session was the toy's, not the child's.
Your secrets are safe with me.
Figure 1. A single-desk subject access practice in Erie, 2036. The racks hold the archives of toy companies that dissolved before their data did.
The part everyone got wrong
The headline in October 2026 was the break-in, and the break-in was the least of it.
What the decade proved is that a breach is an event and a transcript is a condition. The event gets a news cycle, a statement, a patched endpoint. The transcript stays readable for as long as somebody pays the storage bill, and when nobody does, it gets sold with the rest of the furniture.
What the thing actually was
Eiliko was about two and a half inches tall and weighed roughly sixty grams. It clipped to a bag or sat on a desk. Swappable shells changed its personality without an app or a settings menu. It had a microphone, touch sensing and motion detection, no camera. Pre-orders opened at $59.90 in September 2025, and the Kickstarter campaign took more than $380,000.1
It was a charm. That was the pitch and that was the problem. A charm goes where the child goes, into the back seat, the classroom, the waiting room, the argument in the kitchen. Its microphone was not aimed at a moment. It was aimed at a life.
By the autumn of 2026 the active fleet was about 68,000 units, and the United States was the largest market.2
What one buyer found
Sammy Azdoufal bought one in Japan. He had form: he had previously turned up flaws in robot vacuums, baby monitors and unsecured identity documents.
The backend was, in his description, completely unprotected. From it he could read roughly thirteen million conversations belonging to tens of thousands of people. More than 31,000 of the profiles in that archive belonged to children in the United States. The records carried email addresses, IP addresses and inferred personal traits. Some photographs and audio files sat at public web addresses, which is difficult to reconcile with a privacy policy stating that audio is deleted once processed.2
Ten minutes of a child talking to the toy was enough to pull a full transcript.3
Then he went the other way through the same hole. From another country he altered a single toy's stored memory and changed how its language model behaved, and he concluded that manipulated responses could be pushed across the fleet.2
Energize Lab, the maker, did not meaningfully respond. The reporting describes more than a month of attempts across ten email addresses.3 Nine vulnerability reports were being prepared with a second researcher, Tod Beardsley, which is the part that outlived the news cycle.2
Figure 2. The year as it was published, not as it was later remembered. Every figure here appeared in the open between November 2025 and October 2026.
It was never one company
Eight months earlier, two researchers had read about 50,000 chat logs from Bondu's AI plush toy by signing in to a public console with ordinary Google accounts. No hacking was involved. The logs held names, birth dates and family detail. Bondu took the console down within minutes of disclosure and relaunched it with authentication, and its chief executive said fixes were done within hours.4
In February 2026 Senate staff found an unsecured database of the Miko toy's spoken responses to children, some carrying names and conversation detail, dating back to December 2025. They found it by watching the toy's network traffic with free public tools. Miko's chief executive said there had been no breach or leak.5
Before either, in November 2025, the United States Public Interest Research Group reported that a FoloToy teddy bear would hold sexually explicit conversations with its testers. FoloToy pulled every product from sale and opened a safety audit. OpenAI suspended the developer. PIRG's own verdict on the removal was that taking one product off the market was a good step and far from a systemic fix.6
By the following March, PIRG counted about 1,500 companies in China making AI toys.7
The jurisdiction nobody wrote into the box
The phrase that travelled was Chinese servers, and it did a lot of work that the detail does not quite support on its own.
The substantive version had been filed a year earlier. In November 2025 Representative Raja Krishnamoorthi wrote to the Department of Education about AI toys made in the People's Republic of China, naming Bubble Pal from the Shenzhen company Haivivi. His argument was not that the toys were malicious. It was that they engage children aged three to twelve in conversation, store voice data and histories in cloud systems, and that the data may fall under PRC jurisdiction and data sharing requirements. He asked for a public awareness campaign before the products became common in American classrooms, in an industry projected to reach $25 billion by 2030.8
Senators Marsha Blackburn and Richard Blumenthal put the blunt form of the question directly to FoloToy, asking whether it had shared user data with the Chinese government.5
Nobody got a satisfying answer, and the question was never really about one flag. A transcript held in a jurisdiction your lawyer cannot reach is functionally the same object as a transcript held on a server nobody locked.
What the rule could reach
The United States did have a rule, and it had just been sharpened. The amended Children's Online Privacy Protection Rule brought biometric identifiers including voiceprints, and audio recordings, inside the definition of personal information, with full compliance required by 22 April 2026.9
That is a real instrument. It binds a company that answers its mail.
The gap the decade exposed was procedural rather than substantive. A rule reaches a firm with a registered agent, a market to protect and a product line to keep selling. It reaches less well across a catalogue of a thousand small manufacturers, sold through third party marketplaces, each with a backend somebody configured once.
The loop closes
Marisol read for most of a day and then called the requester, because the law gave her a form and not a script.
There was no dramatic finding. No stranger had taken an interest in a nine year old in 2026. What the file contained was four hundred and six sessions, a child's voice rendered into text, and a profile table of inferred traits assembled from them. Interests. Household composition. Temperament, scored.
The toy had kept its promise in the most literal sense available to it. It had never told anyone. It had simply written everything down in a room with the door open, and the inference drawn from those sessions had outlived the company, the device, the warranty and the child.
That is the quiet finding of the whole episode. The danger was never only that a stranger could listen. It was that listening was the product, retention was the business model, and inference was the thing that kept its value long after the plastic went in the bin.
Figure 3. The hardware was the shortest lived part of the system. Erie, 2036.
The open question
The narrow thing is settled. Connected toys are recording instruments, and a recording instrument sold as a companion will be carried into rooms no parent would license.
What is not settled is whether consent can survive duration. A parent in 2026 agreed to a voice assistant for a nine year old. Nobody in that kitchen was agreeing to a behavioural profile still being read out by a stranger in 2036, and no checkbox yet written expires at the speed a childhood does.
Author's Note
This article is speculative journalism written from 2036. Marisol Teague, her practice, the requester and the 2036 subject access regime are fictional composites. Every product detail, research finding, disclosure, congressional letter, corporate statement and rule change cited below is real, published and sourced, and was verified for this piece. Projections past October 2026 are the author's.