At Meta, millions of underage users were an ‘open secret,’ states say

Meta has received more than 1.1 million reports from users under the age of 13 on its Instagram platform since early 2019, but has disabled “only a fraction” of those accounts, according to a recently disclosed legal complaint against the company filed by the attorneys general of 33 states.

Instead, the social media giant continued to routinely collect personal information from children, such as their locations and email addresses, without parental consent, in violation of a federal child privacy law, the court said. Meta could face hundreds of millions of dollars, or more, in civil penalties if the states prove the allegations.

“Within the company, Meta’s actual knowledge that millions of Instagram users are under the age of 13 is an open secret that is routinely documented, rigorously analyzed and corroborated,” the complaint said, “and zealously protected from disclosure.”

The privacy charges are part of a larger federal lawsuit filed last month by California, Colorado and 31 other states in the U.S. District Court for the Northern District of California. The lawsuit accuses Meta of unfairly entrapping young people on its Instagram and Facebook platforms while concealing internal investigations showing harm to users. And it’s trying to force Meta to stop using certain features that states say have harmed young users.

But much of the evidence cited by the states was blacked out by redactions in the original filing.

Now the unsealed complaint, filed Wednesday evening, offers new details from the state’s lawsuit. Using excerpts from internal emails, employee chats and company presentations, the complaint argues that Instagram “lusted and pursued” underage users for years, even as the company “failed” to comply with the Child Privacy Act.

The unsealed filing said Meta “continually failed” to make effective age verification systems a priority and instead used approaches that allowed users under 13 to lie about their age to set up Instagram accounts . It also accused Meta executives of publicly stating in congressional testimony that the company’s age-verification process was effective and that the company deleted minors’ accounts when it learned of them — even while executives knew there were millions of underage users on Instagram were.

“Tweens want access to Instagram, and they’re lying about their age to get it now,” Adam Mosseri, the head of Instagram, said in an internal company chat in November 2021, according to the court filing.

In Senate Testimony the following month, Mr Mosseri said: “If a child is under 13, they are not allowed on Instagram.”

In a statement on Saturday, Meta said it has worked for a decade to make online experiences safe and age-appropriate for teens and that the state’s complaint “mischaracterizes our work using selective quotes and cherry-picked documents.”

The statement also noted that Instagram’s terms of use prohibit users under the age of 13 in the United States. And it said the company had “taken steps to delete these accounts when we identify them.”

The company added that verifying people’s ages is a “complex” challenge for online services, especially for younger users who may not have a school ID or driver’s license. Meta said it would like to see federal legislation requiring “app stores to obtain parental approval when their teens under 16 download apps” rather than requiring young people or their parents to provide personal information such as dates of birth to many different apps.

The privacy charges in the case are based on a 1998 federal law called the Children’s Online Privacy Protection Act. That law requires online services with content aimed at children to obtain verifiable consent from a parent before collecting personal data (such as names, email addresses or selfies) from users under the age of 13. Fines for breaking the law can amount to more than $50,000 per violation.

The lawsuit argues that Meta chose not to build systems to effectively detect and exclude such underage users because it views children as a crucial demographic group – the next generation of users – that the company must capture for continued growth to ensure.

According to Wednesday’s filing, Meta had many indicators of underage users. For example, an internal company graph displayed in the unsealed material showed how Meta tracked the percentage of 11- and 12-year-olds who used Instagram daily, the complaint said.

Meta was also aware of accounts of specific underage Instagram users through corporate reporting channels. But it “automatically” ignored certain reports from users under 13 and allowed them to continue using their accounts, the complaint said, as long as the accounts did not contain a user biography or photos.

In one case in 2019, Meta employees discussed in emails why the company had not deleted four accounts belonging to a 12-year-old, despite requests and “complaints from the girl’s mother that her daughter was 12,” according to the complaint. The employees concluded that the accounts were “ignored,” in part because Meta representatives “could not say with certainty that the user was a minor,” according to the legal filings.

This is not the first time the social media giant has faced accusations of privacy violations. In 2019, the company agreed to pay a record $5 billion, change its data practices and settle Federal Trade Commission charges that it misled users about their ability to control their privacy.

It may be easier for states to prosecute Meta for violations of children’s privacy than to prove that the company encouraged compulsive social media use — a relatively new phenomenon — among young people. Since 2019, the FTC has successfully brought similar children’s privacy complaints against tech giants, including Google and its YouTube platform Amazon. Microsoft and Epic Games, the maker of Fortnite.