Skip to Content
Security & privacy

This massive Facebook security flaw put children at risk

A security flaw in an already controversial Facebook app is putting your child’s privacy and safety at risk. The flaw allows complete strangers to chat with children.

It involves the Messenger Kids app, which was designed to allow children to only chat with users approved by their parents. But a feature in the app has left the door wide open for strangers to talk to kids.

We’ll explain this dangerous flaw and what the social media giant is doing to fix it. We’ll also offer tips on how to protect your children online.

Facebook flaw could endanger children

When Facebook launched Messenger Kids in 2017 for children under 12, the company boasted that it was providing a safe place for kids to communicate with each other. Not so much.

Messenger Kids works well for one-on-one chats. Children are supposed to only chat with users who have been approved by their parents.

But the engineers at Facebook didn’t secure chat groups as stringently as it should have. As first reported by The Verge, a design flaw allows users to get around the parental permission requirements, allowing children in chat rooms to talk to strangers.

In a one-on-one chat, Messenger Kids’ permissions allow children to initiate conversations with someone approved by the child’s parents. But the permissions aren’t so simple when applied to group chats with multiple users.

Whoever launches a group chat can invite any user they were authorized to chat with. That has created a situation in which thousands of children are left free to chat with strangers — friends of friends, possibly including adults — that their parents have not authorized.


Related: Shocking NY Times exposé about YouTube and pedophiles


Facebook responds

A spokesperson for Facebook told, “We recently notified some parents of Messenger Kids account users about a technical error that we detected affecting a small number of group chats. We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety.”

It’s not clear yet how many parents have been contacted, though it could be in the thousands. This latest revelation comes at a time when Facebook already has been accused of not protecting children’s privacy.

Because Messenger Kids is designed for children under the age of 13, it is subject to the Children’s Online Privacy Protection Act (COPPA). Some privacy groups already have accused Messenger Kids of violating COPPA by collecting user data, and this latest privacy flaw will only heighten those concerns.

Last year, a number of consumer groups filed a complaint with the Federal Trade Commission (FTC), asking it to investigate Facebook for possibly violating COPPA. In January, the Campaign for a Commercial-Free Childhood (CCFC)  joined 14 other groups in sending a second letter to Facebook CEO Mark Zuckerberg calling for the discontinuation of Messenger Kids.

“Even in the hands of an ethical company, social media for young children would be a terrible idea,” said CCFC’s Executive Director Josh Golin at the time. “But Facebook especially cannot be trusted with a platform that gives the company access to children’s most private moments. It’s past time to pull the plug on Messenger Kids.”

This latest Facebook fail comes as the company is settling charges with the FTC regarding the Cambridge Analytica scandal. The settlement, which has yet to be publicly released, is rumored to include $5 billion in fines against Facebook, but no action against Zuckerberg.


Related: FBI warns sextortion scams targeting teens is on the rise; how to protect your kids


Keeping your kids safe on social media

As part of our efforts to help protect your children while they are on Facebook or other social media sites, Kim Komando has created the Tech Safety Contract for parents and their children. The contract gives specifics on how kids should behave or what to watch out for while on websites and apps.

We also offer five steps every parent should take to not only keep their children safe but also alive. The steps include limiting screen time, having total control over the child’s device and keeping track of all of the child’s correspondence. You can learn more about all five steps here.

Stop robocalls once and for all

Robocalls are not only annoying, but they scam Americans out of millions every year. Learn Kim's tricks for stopping them for good in this handy guide.

Get the eBook