Dozens of devices from numerous brands are vulnerable. 

The devices, their associated apps, and their behind-the-scenes software were traced back to a handful of companies: NewGPS2012, SETracker, and SinoTrack. Those names might not sound familiar, but they are responsible for smartwatches sold under a variety of product names and brands — a common practice called white-labeling — which makes determining exactly which watches are at risk of being attacked more difficult. 

But the researchers told us that some of the vulnerable devices are cheap smartwatches from unfamiliar brands like Aimoto Smart, Garett Kids, KidiWatch, SafeKid, SaveFamily, and Wonlex. Millions of those watches may have been sold. And this is only the latest in a long line of privacy and security flaws that have affected kids devices and services. 

“Our goal with the research was not to scare parents but to demonstrate that these risks are practical and need to be taken seriously,” Stykas said. Manufacturers, he said, needed to do more, including addressing vulnerabilities quickly. “If you build a product whose purpose is to protect children, cybersecurity has to be part of that protection from the beginning.”

Here’s how to make sure a smartwatch is safe for your child to use:

Consider our top kids smartwatch picks, which are unaffected. The Verizon Gizmo, our favorite smartwatch for younger kids, does not appear to be susceptible to the attacks, Stykas said. Verizon confirmed to us that the Gizmo does not rely on any of the manufacturers or software that the researchers cited.

The Apple Watch SE, our top pick for older kids, has robust security protections and is also not susceptible to the attacks.

Don’t buy a smartwatch just because it’s cheap. Instead, “look at products from established technology companies with mature security teams and a clearly documented family-account model,” Stykas said. The Apple Watch and the Fitbit Ace LTE are good examples of reputable devices for kids.

Practice good digital hygiene. Just like your devices and accounts, your kids’ devices and accounts need to be protected. Make sure that all of your accounts, and your kids’ accounts, have two-factor authentication enabled, and that you’ve set a unique, complex password that you’ve saved in a password manager. 

This article was edited by Signe Brewster and Caitlin McGarry.