How Instagram Collects Child Data Without Parental Consent

3. Meta does not obtain verifiable parental consent before collecting personal information from users under the age of 13 on Instagram.

806. Despite Meta’s “actual knowledge” of under-13 users and the fact that Instagram is “directed to children,” Meta does not obtain verifiable parental consent, as required by COPPA, before collecting the personal information of its child users.

807. To obtain verifiable parental consent, Meta would need to (1) first provide notice to the parent of the company’s “personal information collection, use, and disclosure practices,” then (2) obtain the parent’s authorization for the company to “collect[], use, and disclos[e], as applicable . . . personal information and the subsequent use of that information”—all in conformity with the COPPA regulations and all prior to the child’s information being collected. 15 U.S.C. § 6501(9).

808. On information and belief, Meta does not provide sufficient notice on its Instagram websites or Platform, through a prominently posted link or directly to parents, about what information it collects from children, how it uses such information, its disclosure practices, and parents’ rights to review or delete their children’s information

809. [Redacted]

810. Meta nonetheless collects “personal information” from all registered users of Instagram, including all users under the age of 13 on Instagram, without first obtaining verifiable parental consent.

811. Meta collects “personal information” of children through Instagram including, but not limited to, geolocation information, persistent identifiers of the child, unique device identifiers, photos and videos of the child, and other individually identifiable information about each user under the age of 13.