Children's Smartwatches Have Security Flaws, According to BSI

What happened

The BSI checked three kids' smartwatches and their phone apps. It looked at how data is sent, how accounts are protected, how updates are handled, and what happens when a watch is reset or given away. Every device had weak default settings, which are the settings a device has when you first switch it on.

Key facts

• 3 watches were tested: Connect Neo (One2Track), Garmin Bounce and Imoo Z3.
• 0 of the 3 watches had a secure default setting out of the factory.
• The Imoo Z3 sent some chat messages, chat media files and nearby Wi-Fi info without encryption.
• Only 1 manufacturer gave clear, long-term promises about security updates.
• Personal data stayed on all tested models after an account was deleted or the watch was passed on.

Why these watches are popular

Kids' smartwatches let parents reach their child and see where the child is. They work without a child needing a smartphone. But they connect to the internet and apps, so they can also be hacked or leak data.

Why it matters

Some leaked data, like chat messages and nearby Wi-Fi details, could help someone figure out where a child is. Weak settings also let kids reset the watch or add unsafe Wi-Fi networks. Without updates, known security holes stay open. The BSI says manufacturers must build safety in from the start, and the new EU Cyber Resilience Act (CRA) will require this in the future.

What to watch

• Whether manufacturers fix the gaps with software updates, as they have said they will.
• How the CRA rules, which require secure default settings, will change these products.
• Parents can check that the watch is updated, turn on any lock or safety settings, and remove personal data before selling or giving away a watch.