Can Meta protect a child it has classified as an adult?
Ofcom has opened an investigation into whether Meta carried out suitable further illegal-content and children’s risk assessments before launching Instagram Instants. The feature allows photos and videos to be broadcast automatically through Instagram Direct and the content is ephemeral. The investigation is open; Ofcom has not concluded that Meta breached the Online Safety Act.
What it could improve
The case tests a core Safety by Design principle: a significant feature should be assessed before children encounter it. Under the Online Safety Act, a service likely to be accessed by children must assess children’s risks, and providers must carry out a further assessment before making a significant design or operational change.
What remains unresolved
A risk assessment can protect only the children a service recognises. Meta begins with the birthday registered to an account, then uses profile, activity, visual and community signals to predict age. This improves on self-declaration, but it remains possible for a child to be classified as an adult.
- A child can create an account with an adult birthday, use an adult’s account or maintain a separate account that contains few age-related signals.
- A new or deliberately sparse profile may not provide enough behavioural, textual or visual evidence for Meta’s prediction system to identify the user as a child.
- Meta may request an identity document or a Yoti video-selfie estimate when it detects an inconsistency, but public information does not show that every adult-classified account is checked.
- Meta has not published sufficient independent evidence on false negatives, demographic performance or how often replacement and secondary accounts evade Teen Account protections.
- If a child is misclassified as an adult, protective defaults and age-appropriate content restrictions may not activate, including for a newly launched feature.
- Even accurate classification inside Instagram does not make the assurance portable to other platforms, games, websites, AI services or signed-out use.
- Pre-launch risk assessment should test misclassified and deliberately evasive accounts, not only correctly labelled teen profiles.
The Child-Friendly Internet perspective
Meta’s age prediction is a meaningful attempt to identify teenagers who declare an adult age, but it asks one platform to rediscover the child from its own data. A Child-Friendly Internet ecosystem would allow participating services to receive only a trustworthy age or developmental band from a privacy-preserving assurance process. The signal should be short-lived, bound to the relevant session and unusable for cross-service tracking. Meta would still remain responsible for assessing Instants and making it safe by design.
- Require pre-launch assessments to model false adult accounts, shared accounts, secondary accounts and sparse profiles.
- Publish independently testable accuracy and circumvention evidence for age classification systems.
- Apply protective defaults whenever child use is reasonably likely, rather than waiting for perfect identification.
- Use minimum-disclosure assurance so services receive an age result, not the child’s identity documents.
- Keep platform duties, feature-level risk assessment and independent enforcement even when a shared assurance layer exists.
The central question
How can a platform prove that a new feature is safe for children when some children may be hidden behind adult-classified accounts?