Flaw with Facebook's chat app for kids could have let strangers into conversations
A chat app from Facebook designed to be used safely by children under 13 was found to have a significant flaw, potentially letting strangers into chats without parental permission.
Launched in December 2017 and called Messenger Kids, the app is designed to let children chat only with those people approved by parents or guardians. But a flaw in how group chats are set up meant children could have found themselves talking to strangers, potentially adults, not known by them or their parents.
Read More:
- How bad is Facebook's spam problem? Over 1 million fake accounts are removed every hour
- Facebook kept millions of passwords unencrypted for years
- Facebook to push further into smart home with new Portal products this fall
Rather than go public about discovering a major flaw in its own app, Facebook has been quietly alerting parents over the past week, reports The Verge.
The issue centered on how a child could be invited into a group chat which contained the parent-approved friend — but also people approved by the friend's parents. That way, those approved for the friend, an adult relative for example, could communicate with the original child, even though they are actually strangers. And parents of the original child would never know.
Messenger Kids can be used to message, create group chats, and also conduct group or one-on-one video calls. Users in video chats can wear augmented reality masks in this app, and there are also animated reactions and sound effects available that are not included with the regular Messenger app.
Being able to communicate with only parent-approved people is core to how Messenger Kids works — and is marketed. It's also meant to be a more child-friendly environment than the regular Facebook Messenger app. Facebook says on the app's website: "Kids can only connect with parent-approved contacts, which creates a more controlled environment."
Facebook adds on its website: "Parents fully control the contact list and decide who can connect with their children." The company also claims its app is "compliant with important child privacy laws like the Children's Online Privacy Protection Act (COPPA)."
As published by The Verge, the message sent by Facebook to parents of children using the Messenger Kids app reads: "Hi [parent], We found a technical error that allowed [child]'s friend [friend's name] to create a group chat with [child] and one or more of [friend]'s parent-approved friends.
"We want you to know that we've turned off this group chat and are making sure that group chats like this won't be allowed in the future."
Facebook said the error had affected "a small number of group chats," adding: "We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety."
The social network has not said when it became aware of the flaw, or how long it had been active for.
In October 2018, a coalition of 17 public health advocacy groups called on the Federal Trade Commission (FTC) to investigate Facebook for violating COPPA with Messenger Kids and its collection of personal information from children without verifiable parental consent. The complaint claimed Messenger Kids does not meet a COPPA requirement to ensure it is receiving consent from a parent, as anyone of any age with a Facebook account can claim to be the child's parent or guardian, and set them up with Messenger Kids.