Children’s toy maker VTech Holdings Ltd. has agreed to pay $650,000 to settle a complaint brought by the Federal Trade Commission related to the hacking and subsequent theft of data on its customers in 2015.

The FTC alleged in its complaint that VTech, through its Kid Connect app that collected personal information from hundreds of thousands of children, failed to provide direct notice to parents or obtain verifiable consent from parents concerning its information collection practices, as required under the Children’s Online Privacy Protection Act. The complaint went on to allege that VTech failed to use reasonable and appropriate data security measures to protect personal information it collected.

The hacking of VTech, first disclosed in November 2015, saw hackers gain access to the company’s database, allowing them to steal names, email addresses, passwords and home addresses of more than 4.8 million parents who bought its products and the details of some 200,000 children. A second report later the same month stated that to the horror of those affected, the data stolen included at least 190 gigabytes of photos of children and their chat logs, causing the hack to be named as one of the worst in 2015.

“As connected toys become increasingly popular, it’s more important than ever that companies let parents know how their kids’ data is collected and used and that they take reasonable steps to secure that data,” Acting FTC Chairman Maureen K. Ohlhausen said in a statement Monday. “Unfortunately, VTech fell short in both of these areas.”

As part of the settlement, criticized by some as being small in terms of how many were affected, VTech has also agreed to a stricter set of compliance requirements in the future, including regular third-party security audits to check whether it is properly storing and encrypting its collected information. It also has agreed to make sure it gets express consent from parents before it collects personal information for children.

Photo: Pixabay