Eiliko robot toy sends user conversations to Chinese servers

By Splitfeed EditorialLast updated Oct 15, 2026, 11:10 UTC

On October 15, 2026, The Verge published a report by reviewer Sean Hollister revealing that Eiliko, a consumer robot toy made by Energize Lab, transmits user conversations to servers located in China when the device is connected to Wi-Fi. Hollister purchased the device himself and found that its AI companion feature stores the content of those conversations on Chinese infrastructure. Security researchers cited in the report warn that the setup allows hackers to access stored conversations or remotely alter the robot's AI personality. Energize Lab had not responded to or addressed the findings as of the report's publication.

The story carries weight beyond a standard privacy complaint for two reasons. First, Eiliko is marketed as a digital pet aimed at children, meaning the conversations being stored are likely to involve minors. Second, the security controls around those servers are described as weak, meaning the exposure is not merely theoretical. The core dispute is whether this represents a straightforward product safety failure that regulators should act on quickly, or whether it also implicates broader concerns about foreign data infrastructure and the risks of internet-connected AI toys more generally. Energize Lab's silence makes it impossible to assess whether any of the practices described were intentional design choices, oversights, or the result of a third-party component the company did not fully vet.

None of the three camps have published reactions to this story yet. The Pro-AI camp would typically argue that the problem here is a specific company's poor security implementation, not AI companion technology itself, and that proper standards and auditing can make such products safe. The Anti-AI camp would typically treat this as evidence that embedding AI into consumer toys normalizes data collection from children before adequate legal or technical protections are in place. The Middle Ground camp would typically call for mandatory security certification and clear data residency rules for AI-enabled children's products, framing the issue as one of governance rather than technology itself.

The most immediate thing to watch is whether Energize Lab issues a formal response or patches its data handling practices, and whether US consumer protection regulators, particularly the FTC or the Consumer Product Safety Commission, open any inquiry into the product given that children's data is involved.