The Real Accusation Buried in Meta's Lawusit: They Were Tracking Your Children

A child who lies about their age to join Instagram can leave behind far more than a few posts.

The platform can collect contact details, photographs, voice recordings, device identifiers, viewing histories, likes, and information about whom that child interacts with. Together, those details can reveal the child’s identity, interests, relationships, and online behavior.

Instagram requires users to be at least 13. However, a multistate lawsuit against Meta alleges the company knew millions of younger children were using the platform and collected their information without notifying their parents or obtaining verifiable parental consent.^[1]

A federal jury must now decide whether Meta knew it was collecting data from children under 13.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

Meta allegedly knew children were using Instagram

According to the states’ complaint, a 2018 report prepared for CEO Mark Zuckerberg estimated that four million children under 13 used Instagram in the U.S. in 2015. That represented roughly 30% of American children ages 10 to 12.

Internal records allegedly included charts tracking Instagram’s reach among 11- and 12-year-olds, age-estimation systems identifying likely underage accounts, and a dashboard that divided users into under-13, 13-to-17, and adult groups.

One internal Meta document from 2018 reportedly acknowledged, “we do very little to keep U13s off our platform.”

Former Meta engineering director Arturo Béjar also testified that Instagram took a “don’t ask, don’t tell” approach to users under 13, according to Associated Press reporting.

Meta allegedly received more than one million reports of underage Instagram users between early 2019 and mid-2023 but disabled only a fraction of those accounts.

The company argues that reports, photographs, and age estimates may raise suspicions without proving an account belongs to a child. The states say Meta had enough information to identify many underage users and avoided conclusions that could trigger privacy obligations.

What Instagram collected

In a June 2026 pretrial ruling, U.S. District Judge Yvonne Gonzalez Rogers found that Meta collects several types of personal information from its users, including:

• Email addresses and phone numbers
• Facial images and voice recordings
• Cookie IDs and IP addresses
• Profile details and user-created content
• Likes, viewing histories, and interactions with other users

Some details identify a child directly. Others help Meta recognize users over time, predict what holds their attention, and personalize content or advertising.

A child’s likes, follows, and viewing history could reveal hobbies, friendships, insecurities, and other interests. Parents may never see the behavioral profile assembled from that activity, even when they can view the child’s public posts.

Children’s data may have trained Meta’s algorithms

The states also allege that Meta continued using information from children under 13 to train recommendation algorithms, machine-learning systems, and generative AI models.

Court documents indicate Meta generally uses user data to personalize content and advertising. Evidence presented by the states suggested that some training continued using information from accounts that were flagged, disabled, or scheduled for deletion.

Meta acknowledged that information from certain flagged accounts was historically retained for as long as six months or one year. However, the company says data awaiting deletion was marked as “not intended for business purposes” and was not used for model training.

The judge found enough conflicting evidence for the dispute to proceed to trial but did not rule that Meta used children’s data to train its models.

For parents, the distinction matters because deleting an account and determining how its historical data was used are separate questions.

Meta denies violating children’s privacy

Meta says it removes underage accounts when it identifies them and has introduced age-estimation technology, parental supervision, and additional protections for teenagers.

The company maintains that age verification is difficult because many children lack government-issued identification.

Meta’s Teen Accounts place users under 18 into more restrictive settings by default. Those protections are primarily intended for teenagers who are old enough to use the platform. Under Meta's rules, children under 13 generally cannot maintain personal Instagram accounts.

What parents can do now

Parents can take several steps to help keep their kids safe online:

• Ask children which social media accounts they use and whether they entered a false birth date.
• Review profiles, posts, followers, direct interactions, contact details, and connected apps.
• Remove details revealing the child’s school, home, schedule, full birth date, or regular locations.
• Download the account’s data before deletion, particularly if it contains evidence of harassment or inappropriate contact.
• Disconnect apps and websites linked through the child’s Instagram or Facebook login.
• Report an underage Instagram account through Meta’s official reporting form.
• Keep older teenagers’ accounts private, enable two-factor authentication, and review accumulated data regularly.

Instagram says it will delete an account if it cannot verify that someone over 13 manages it. An account representing a younger child must state that a parent or another adult manages it.

Bottom line

The states allege Meta knew children under 13 were using Instagram while collecting information that revealed their identities, interests, relationships, and behavior.

Meta disputes that it knowingly collected children’s information or used data from flagged accounts to train its models. The jury must decide whether Meta’s internal research and enforcement systems established actual knowledge under COPPA.

Parents should not assume an age restriction prevents data collection when a child enters a false birth date. Finding the account, reviewing its information, disconnecting outside services, and requesting deletion can reduce further exposure.

Take Control of Your Online Privacy

5.0

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On Incogni's website

2026 Editors’ Choice

Best Overall Data Removal Service

Privacy Protection

Incogni

PROMOTION: Get 55% Off Annual Plans With Code COOKIE

• Top-rated data removal service that scrubs your info from 420+ data broker sites automatically
• Independently verified by Deloitte, meaning removals are actually sent, confirmed, and not just claimed
• The Unlimited plan extends coverage to 2,000+ additional sites with human-assisted custom removals

Author Details

Thomas Kent

About the Author

Thomas Kent is a multi-disciplined reporter with over a decade of experience covering online platforms, digital trends, and consumer-facing tech. Tom focuses on digital privacy, data tracking, and user behavior, with a particular interest in how cookies, online surveillance, and platform design shape the modern internet experience. His reporting takes a research-driven, news-focused approach, translating complex technical topics into clear, accessible insights.