The National Institute for Access to Information and Protection of Personal Data ('INAI') issued, on 29 April 2022, a bulletin on measures to protect the personal data of children when using toys connected to the internet. In particular, INAI issued recommendations to ensure the security of children's personal data, including:

• identifying what personal data will be used, for what purpose, and if it will be shared with third parties;
• verifying how consent is requested and provided for the use of personal data on such devices;
• reviewing the information or the means to exercise the rights of access, rectification, cancellation, and opposition;
• providing information on how to disable GPS location if such data is collected; and
• checking how the connection is made and protected if the toy connects with any app, and the data that is exchanged during its use.

You can read the bulletin, only available in Spanish, here.