• by Wendy Davis  @wendyndavis, November 27, 2023

Meta Platforms routinely knew that children under the age of 13 were on Instagram, and “frequently” continued to collect their data in violation of the federal children's privacy law, a state attorneys general alleged in newly unsealed portions of a lawsuit against the platform.

“Within the company, Meta’s actual knowledge that millions of Instagram users are under the age of 13 is an open secret that is routinely documented, rigorously analyzed and confirmed, and zealously protected from disclosure to the public,” the attorneys general alleged.

The complaint -- which also charged Meta with misleading the public about the “substantial dangers” of Facebook and Instagram -- was filed in October, but most of the allegations regarding the children's privacy law were blacked out. Many of those portions of the complaint were made public last week.

The attorneys general allege that Meta kept “extensive internal records documenting its actual knowledge of its under-13 Instagram users,” including “charts boasting [of] Instagram’s penetration into 11- and 12-year-old demographic cohorts, and “emails and policies documenting Meta’s mishandling of known under-13 user accounts.”

The federal Children's Online Privacy Protection Act (COPPA) prohibits sites and apps from collecting personal data of users under 13 without parental consent. That law, which is more than 20 years old, applies to companies that actually know users' ages, and to companies that operate sites -- or “portions” of sites -- directed at children.

The newly unsealed portions of the 233-page complaint include allegations that Meta employees knew of specific users under the age of 13, and still “frequently elected to continue retaining and collecting data from those accounts without obtaining verifiable parental consent.”

For instance, according to the attorneys general, company employees learned of one “potential under-13 user” and exchanged emails discussing how to speak with the user's mother to obtain her consent to data collection. The attorneys general add: “'Coaching' or offering parents ways to keep accounts open for their children under the age of 13 does not satisfy Meta’s obligation to obtain verifiable parental consent under COPPA for the collection and use of the child’s personal information. Meta’s 'coaching' does not provide parents with the notices required by COPPA, including notices of what personal information Meta is collecting from their children, nor does it satisfy COPPA’s requirement to ensure that the person providing consent is actually the parent of the child.”

Meta said last month it prohibits users under 13 on the service. The company requires users to provide a birthdate when they sign up for accounts, and rejects users who say they are under 13.

Meta has also said it deactivates accounts of users it suspects are under 13.