“The walls have ears” used to be a metaphorical expression. These days, as the era of the Internet of Things dawns and marches on apace, it’s becoming a little more literal every day. And while that’s all well and good for the adults who buy and install a device in their home, it might not be quite so legal for the house to listen to their kids.

As The Guardian reports today, privacy advocates are starting to become concerned about the legal implications of devices that record and store childrens’ voice data without their parents’ permission.

Around the turn of the last century, people started to future out that this whole internet thing was only going to get bigger and more pervasive, and that childrens’ privacy needed protection. Enter the Children’s Online Privacy Protection Rule (COPPA), which was signed in 1998 and became effective in 2000.

The rule, in short, limits what personal data can be collected about users under age 13 and what it can be used for. That’s why you see so many sites that do collect personal data requiring users to be 13 or older: that way, they can wash their hands of the compliance problem.

But that rule was put in place in an era where “collecting personal data” meant “asking someone to go to a website and fill in a form.” Nearly two decades later, data collection is neither so limited nor so clear-cut.

You no longer have to intentionally hand data over to someone. Instead, we have a whole world of devices — from TVs to gaming consoles to phones to cars to “smart home” tools — that are in some way always listening to everything we do. And while it’s one thing for an adult to sign up for that, it’s legally different for a kid.

That’s particularly true with tools like Apple’s Siri, Amazon Echo and Google Home, the Guardian explains.

Marketing for all those devices explicitly includes families with young children, and shows the children talking to and interacting with the AI voices. And that’s where the trouble begins, according to activists. Khalilah Barnes, of EPIC, told the Guardian, ““When your advertising markets this product to children, and parents with children, that would absolutely trigger COPPA.”

Barnes added, “Recording children in the privacy of the home is genuinely creepy, and this warrants additional investigation by the FTC and states.”

Apple, Amazon, and Google all told the Guardian that they are in compliance with COPPA standards — but voice recordings, which those platforms can collect and learn from, are among the data protected by the rule. COPPA requires affirmative, explicit, verifiable consent from parents in order to collect that data from children, but none of the devices have any mechanism in place for collecting that acknowledgement from parents.

It’s a little different with devices like Microsoft’s Xbox One or Kinect platforms, which don’t allow children 12 or under to connect accounts. If you’ve got an Amazon Echo or a Google Home sitting on your coffee table, the whole point is that it can hear what anyone in the room says and respond as needed.

And that’s basically what Barnes noted, pointing out to the Guardian that even parental consent, under the current standard, may not be that useful in a world of permanently connected devices.

“Parents cannot reasonably review all the information that these ‘always on’ devices are collecting from children,” she said, which any parent who has heard the chaos of their child at play can probably agree with.

Virtual assistants such as Amazon’s Echo break US child privacy law, experts say [Guardian]

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.