VTech, a maker of online learning products for children, has settled a complaint with the Federal Trade Commission that it violated privacy safeguards, in what the agency says is the first such case focused on “connected toys.”

As part of an agreement with the FTC, VTech will pay a $650,000 penalty and take a series of steps to better protect the personal information of children and families using its products.

In a statement released Monday, VTech officials said the company was resolving a case that was linked to a 2015 cyberattack on its online products.

The settlement addresses “long-resolved issues,” company officials said, adding that they were not admitting to any legal violations or liability.

The FTC’s complaint accused the company of collecting the personal information of hundreds of thousands of children through an app called Kid Connect that was used with some of VTech’s electronic toys.

First Case of Its Kind

The company failed to provide direct notice to parents, or get verifiable consent from them for the information that was collected, the agency said. Failing to do that put VTech out of step with the Children’s Online Privacy Protection Act, or COPPA. 

The company also neglected to use “reasonable and appropriate” measures to secure the personal information it collected, the FTC alleged.

The commission added that the complaint brought against VTech, which is based in Hong Kong, and its U.S.-based subsidiary is the first privacy case focused on “Internet-connected toys.”

“As connected toys become increasingly popular, it’s more important than ever that companies let parents know how their kids’ data is collected and that they take reasonable steps to secure that data,” said Maureen K. Ohlhausen, the acting FTC chair. “Unfortunately, VTech fell short in both of these areas.”

In a conference call with reporters Monday, Tom Pahl, the acting director of the FTC’s bureau of consumer protection, said the agency is sending a message to parents to be vigilant in choosing “smart toys.” Sales of those products will reach an estimated $15.5 billion in revenue by 2022, he said.

Parents “have the opportunity to compare not only prices and services offered, but also the companies’ stewardship of their kids’ data,” Pahl said.

In its complaint, the FTC had claimed VTech collected personal information from parents on an online platform called Learning Lodge Navigator, where the Kid Connect app could be downloaded. It also took personal information from a now-defunct web-based gaming and chat platform called Planet VTech.

Before using the platforms, the parents were required to register and provide personal information–including their name, e-mail address, their child’s name, date of birth, and gender. Information was also collected through the Kid Connect app, federal officials said.

The FTC says VTech fell short in protecting personal information in a number of ways, including not having safeguards and security to adequately guard transmitted and stored material, and not having a rigorous enough system to alert the company to intrusions of its network.

In November of 2015, the FTC says that VTech was told by a journalist that a hacker had accessed its computer network and the personal information of customers, including children using the Kid Connect app.

Millions of Users

In addition, the federal agency said VTech ran afoul of the FTC Act by stating in its privacy policy that most personal information turned in by users through the platforms in question would be encrypted. Yet VTech did not encrypt the information, the agency stated.

VTech describes itself as a maker of “internet-enabled physical learning products.”  The company sells portable devices known as “electronic learning products” in the United States and around the world, according to the FTC.

Those products are generally marketed as being appropriate for children ages 3–9, federal officials said. The company also offers online games, as well as the Learning Lodge Navigator online service, similar to an app store, that allows customers to download child-directed apps, e-books, games, and other content.

By the end of 2015, the FTC estimated that about 2.2 million parents in the United States had registered and created accounts with Learning Lodge, for almost 3 million children.

The company issued a statement through VTech Holdings Limited, saying its wholly owned subsidiaries–VTech Electronics Limited and VTech Electronics North America, LLC, had agreed to resolve the case.

“We are pleased to settle this two-year old investigation by the FTC,” said Allan Wong, chairman and group CEO of VTech Holdings Limited. “Following the cyberattack incident, we updated our data-security policy and adopted rigorous measures to strengthen the protection of our customers’ data.”

The company said that parents “can rest assured that the data they entrust with VTech is well protected,” and that it is a “market leader in providing innovative products that parents can trust.”