Children should not talk to users who have not been approved by their parents. This is the premise around which Facebook’s Messenger Kids app is built. But a design flaw in Messenger Kids has allowed users to sidestep that protection through the group chat system, allowing children to enter group chats with strangers.
Facebook which has not made any public statements about the issue has for past whole week been quietly shutting down those group chats and alerting parents through a message. Facebook confirmed that the message was authentic, and said the alert had been sent to thousands of users in recent days. “We recently notified some parents of Messenger Kids account users about a technical error that we detected affecting a small number of group chats,” a Facebook representative said. “We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety.”
The bug arose from the way Messenger Kids’ unique permissions were applied in group chats. In a standard one-on-one chat, children can only initiate conversations with users who have been approved by their parents. But those permissions became more complex when applied to a group chat because of the multiple users involved. Whoever launched the group could invite any user who was authorized to chat with them, even if that user was not authorized to chat with the other children in the group.
As a result of this flaw, thousands of children were left in chats with unauthorized users, a violation of the core promise of Messenger Kids.It is also not clear how long the bug was present in the app, which launched with group features in December 2017. The privacy flaw is particularly legally sensitive because Messenger Kids is designed for children under the age of 13, and thus subject to the US Children’s Online Privacy Protection Act (COPPA). Some privacy groups have already accused Messenger Kids of violating COPPA by collecting user data, and this latest privacy flaw will only heighten those concerns.
The issue also comes at an awkward time for Facebook as a company, which is currently settling charges related to Cambridge Analytica breach with the US Federal Trade Commission. The settlement, which could be publicly revealed as soon as this week, is rumored to include a mandatory privacy committee and $5 billion in fines for Facebook as a company, but no move towards personal liability for CEO Mark Zuckerberg. As a result, it has been widely criticized as insufficient to force the company to adopt stricter privacy protections.