The children’s doll My Friend Cayla can do many things: She can answer questions, play games, and tell little kids how to make a cake. But that’s not all. Cayla also records the voice of her young owners, transmitting those recordings to a software company that sells “biometric solutions” to law enforcement and the military.
This claim—that Cayla is spying on the children who own her—is outlined in a complaint filed by advocacy groups with the Federal Trade Commission. The complaint alleges the doll maker, Genesis Toys, engaged in deceptive marketing and violated a law that restricts the collection of personal data about children.
For those unfamiliar with the doll industry, My Friend Cayla launched in 2014 as a talking companion that relies on an app and a Blue-Tooth connection to deliver realistic responses to children’s questions.
“Cayla can understand and respond to you in real-time about almost anything. . . She is not just a doll… she’s a real friend!” says the company’s marketing material.
The doll also, however, acts as a recording device that transmits voice prints of the children to Nuance Communications, a speech recognition company, whose clients include military and intelligence firms. The purpose of collecting these recordings, according to the Genesis Toys terms of services, is to “enhance and improve the services for the toys and for other services and products.”
Get Data Sheet, Fortune’s technology newsletter.
But according to the advocacy groups, which include the Electronic Privacy Information Center and The Campaign for a Commercial Free Childhood, the dolls amount to an illegal form of childhood surveillance.
The groups also claim the My Friend Cayla dolls, sold in stores like Walmart (WMT) and Toys R Us, are acting as stealth shills for the Walt Disney (DIS) by talking up the company’s movies and characters.
My Friend Cayla is pre-programmed with dozens of phrases that reference Disney movies and theme parks. For example, Cayla tells children that her favorite movie is Disney’s The Little Mermaid and her favorite song is “Let it Go,” from Disney’s Frozen. “Cayla also tells children she loves going to Disneyland and wants to go to Epcot in Disneyworld,” says the complaint, which says such activity amounts to a deceptive form of product placement.
Genesis Toys, which also makes a talking robot called i-Que that is likewise listed in the complaint, did not return to an email request for comment.
For parents, the controversy over Cayla highlights the privacy perils of a world where toys can be connected to the Internet, and where a child may confide private secrets to a doll that records what they say. Even if a toy company has no intention to violate the child’s privacy, the Internet connection can still serve as a tempting target for hackers or ambitious marketers.