Meta Monetizes the Personal Information of Minors on Instagram

B. Meta does not comply with COPPA with respect to Instagram.

1. Meta possesses actual knowledge of children on Instagram and collects their personal information without obtaining parental consent.

642. Meta is subject to COPPA’s verifiable parental consent requirement, among other reasons because it collects the personal information of users under the age of 13 on Instagram despite having “actual knowledge that it is collecting personal information from [children].” 15 U.S.C. § 6502(a)(1).

643. Publicly, for example in congressional testimony provided by Meta executive Antigone Davis on September 30, 2021, Meta has downplayed its actual knowledge of under-13 users on Instagram by pointing out that its terms of service nominally disallow use of Instagram by under-13 users—and that, in recent years, Meta has prompted users to self-report that they are at least 13 years old.

644. Despite Meta’s efforts to avoid its responsibilities under COPPA by attempting to maintain willful ignorance of its users under the age of 13, Meta routinely obtains actual knowledge of under-13 users on Instagram.

645-647. [Redacted]

a. [Redacted]

648. Despite its public-facing claims that users under the age of 13 are not allowed on Instagram, including in congressional testimony provided by Meta executive Davis in September 2021, [Redacted]

649-655. [Redacted]

656. Despite possessing actual knowledge of Instagram users under the age of 13 [Redacted], Meta refuses to obtain verifiable parental consent as required by COPPA for users under the age of 13.

657-659. [Redacted]

660. [Redacted] Meta did not obtain verifiable parental consent for its ongoing collection of personal information from those users.

661-663. [Redacted]

664. Externally, Meta denies that it strives to attract underage users to its Platforms. For example, in September 2021, in response to a Wall Street Journal article regarding underage users on Instagram, Meta provided a written statement claiming that “[l]ike all technology companies, of course we want to appeal to the next generation, but that’s entirely different from the false assertion that we knowingly attempt to recruit people who aren’t old enough to use our apps.”

665-666. [Redacted]

667. [Redacted] for their children under the age of 13 does not satisfy Meta’s obligation to obtain verifiable parental consent under COPPA for the collection and use of the child’s personal information. [Redacted] does not provide parents with the notices required by COPPA, including notices of what personal information Meta is collecting from their children, nor does it satisfy COPPA’s requirement to ensure that the person providing consent is actually the parent of the child.

668. [Redacted]

669. In this instance and many others, Meta did not meaningfully enforce its nominal age restriction on Instagram, despite its external claims to the contrary, including in Davis’s September 30, 2021 congressional testimony, in which she stated that “we will remove [underage accounts].”

670-677. [Redacted]

678. Meta collects information that identifies accounts on its various Social Media Platforms that belong to the same individual user. For example, Meta collects email addresses from users when they set up new Facebook and Instagram accounts. Meta instructs its Instagram and Facebook users to provide an email address “that only you can access.” In or around September 2020, Meta released a feature called “Accounts Center,” which allows users to link their accounts on Facebook, Instagram, and Messenger using a single sign on.

679-681. [Redacted]

682. [Redacted] Externally, however, Meta claimed in a July 27, 2021 post, titled “How Do We Know Someone Is Old Enough to Use Our Apps?,” that it used a users’ age stated to either Platform to gate users’ access to both Platforms.

682-684. [Redacted]

685. Meta deceives the public regarding its policies when underage accounts are reported. If someone reports that an account belongs to an individual under the age of 13, Meta claims on its Instagram Help Center that “we will delete the account if we can’t verify the account is managed by someone over 13 years old.” [Redacted] Zuckerberg told Congress on March 25, 2021, “if we detect that someone might be under the age of 13, even if they lied, we kick them off.”

686-695. [Redacted]

696. [Redacted]; this research, provided by an organization called Thorn, revealed that of children ages 9-12, 45% used Facebook and 40% used Instagram daily.

697. [Redacted] In this way, Meta goes through great lengths to avoid meaningfully complying with COPPA, looking for loopholes to excuse its knowledge of users under the age of 13 and maintain their presence on the Platform.

698. [Redacted]

e. Meta knows that Instagram’s lack of effective age-gating elicits false self-reports of children’s ages

699. For most of its history, up until December 2019, Instagram did not require new users to disclose their age or date of birth in order to create an Instagram account. During that time, Meta did not require users to take even the minimal step of self-attesting that they were over the age of 13. Instead, for over seven years, under-13 users faced no practical obstacles to creating accounts on Instagram.

700-701. [Redacted]

702. Eventually, in response to pressure from regulators and the public, Meta purported to implement an age gate as part Instagram’s account registration process—but the term “gate” was a misnomer because it did not prevent under-13 users from creating and using Instagram accounts.

703. To the contrary, Meta initially designed its age gate in a way that prompted all users, including children under the age of 13, to provide an age over 13. Specifically, Meta’s sign-up page contained a drop-down menu that automatically generated a date and year of birth representing the user to be 13 years old. The design of the age gate signaled to children the specific date that they could affirm to advance through the registration process, even though the date automatically populated by Instagram was not their actual date of birth.

704. Meta knew that its use of a sign-up page automatically generating a date 13 years prior to the date of registration aided under-13 users in misrepresenting their age in order to access Instagram.

705. “[E]ncourag[ing] children to falsify their ages to gain access” is impermissible under COPPA. See COPPA July 2020 Guidance § H(3).[35]

706. Meta only recently changed Instagram’s sign-up page to automatically generate the instant date and year, rather than a date 13 years prior.

707. Meta’s adoption of an age gate that permits the user to enter any date of birth, regardless of its accuracy, still does not prevent under-13 users from using Instagram.

708. [Redacted]

709. In sum, Meta’s age gate efforts for Instagram have long been ineffective: first, Instagram utilized no age gate for several years, then implemented an age gate that defaulted to an entry of ages over 13, and now uses an age gate that still depends on an under-13 user to correctly self-report their own age, without any verification.

710. [Redacted]

711. [Redacted] Nonetheless, Meta externally touts its age-gating as an effective means to keep children under the age of 13 off Instagram and Facebook.

712. While testifying before Congress on September 30, 2021, Meta executive Davis stated: “if we see someone trying to, repeatedly, change the [birth] date to get past that [age screen], we actually will restrict their ability to access the app.” [Redacted]

713-722. [Redacted]

723. [Redacted] While Meta externally claimed that it built under-13 products for kids and tweens in a September 27, 2021 post on Instagram’s website entitled “Pausing ‘Instagram Kids’ and Building Parental Supervision Tools,” [Redacted]

724. [Redacted]

725. Meta has access to, and chooses not to use, feasible alternative age verification methods that would significantly reduce or eliminate the number of underage users on Meta’s Social Media Platforms, for example, by requiring young users to submit student IDs upon registration.

726-728. [Redacted]

729. Externally, Meta misleads the public by claiming, in a March 17, 2021 post on Instagram’s website, that “we know that young people can lie about their date of birth. We want to do more to stop this from happening,” [Redacted]

730. Rather than excluding under-13 users from Instagram, Meta could alternatively comply with COPPA by obtaining informed parental consent after providing notice to parents of its intent to collect and use children’s personal information. Meta chooses not to do so.

731. Despite knowing that its lack of age gates and later implementation of minimal age gate designs have allowed users under age 13 onto Instagram, Meta does not obtain verifiable parental consent before collecting the personal information of those users who routinely register for, and provide their personal information to, Instagram.

f. [Redacted]

732-736. [Redacted]

737. Meanwhile, Meta publicly maintains that it does not allow under-13 users on its Platforms, relying primarily on its faulty age-collection at sign-up [Redacted]

738-742. [Redacted]

743. Meta externally claimed, through congressional testimony provided by Mosseri on December 8, 2021, that “we train our technology to identify if people are above or below 18 using multiple signals,”—including birthday posts—and that Meta is building new technology to do the same for users under 13. [Redacted]

744. Former Meta Director of Site Integrity and former consultant to Meta Bejar testified that Meta does not meaningfully utilize birthday posts to identify users who claim to be over 13 years old but are not. In fact, Meta’s internal reporting mechanism for using birthday posts is complicated which prevents most reports from reaching “completion,” or the point where a person successfully submits a report to Instagram.

745. Despite Meta’s actual knowledge, acquired through its possession and review of estimated age data and/or acquired through other sources, that Meta collects personal information of users under the age of 13 in the ordinary course of its operations, Meta does not obtain verifiable parental consent for under-13 users.

[35] Complying with COPPA: Frequently Asked Questions, Fed. Trade Comm’n (July 2020), https://archive.ph/PEj8q (hereinafter “July 2020 COPPA Guidance”).