SAN FRANCISCO — Jamie Perez of Napa, California, was a bit shocked to learn that her teenage daughter, Brianna, had exposed her own email address and phone number for anyone to find on Instagram.
“It’s just for her and her friends to have access to chat with each other and that’s it,” Jamie said, explaining that she allows Brianna to have social media accounts under strict conditions, including letting Jamie have the password.
Until contacted by NBC News, Jamie Perez was unaware her 15-year-old daughter had marked her Instagram profile as a “business,” exposing her personal contact details — including her email and cellphone number — to anyone who tried to find it. When Brianna converted her account to a business profile back in 2017, she selected the category “just for fun” from a menu of options including “supermarket/convenience store” and “product/service.”
“A lot of kids my age are doing it,” Brianna said of the switch. Besides giving her friends access to her phone number and email, she said, the business setting let her see metrics like how many people had visited her profile or seen individual posts.
Upon learning that Brianna’s number had been exposed, Jamie changed the setting immediately.
“It’s definitely not a business,” said her mother.
Back in 2016, Instagram announced new features for “business” profiles, including the ability to display contact details such as an email address and phone number and access to advanced analytics tools for understanding how many people were viewing an account’s pictures and videos.
Over time, some teenagers began converting their accounts to business profiles so they too could access these digital popularity scores. In making the switch, they exposed their phone numbers and email addresses to the world.
Social media platforms have millions of users under 18, particularly Instagram and Snapchat, which had more than 16 million users aged 12 to 17 (about 20 percent of total users) according to research by eMarketer. Like many Silicon Valley social media startups, Instagram has sought rapid user growth. It allows anyone 13 and up — or anyone who claims to be 13 and up, which is the legal age for users to create social media accounts in the U.S. — to easily open a public-by-default account with all of the same capabilities as any other account. But Instagram only requires documentation of age when an account is flagged, not before.
Instagram is not the only app that doesn’t check the ages of its users when they open an account. Other online services popular with teens, including Snapchat and TikTok, rely on users to self-report their age and do not mandate any age verification.
NBC News’ parent company NBCUniversal has invested in Snapchat’s parent company Snap.
The use of Instagram’s business accounts by minors is another example of how online products aimed at adults can have unintended consequences for children and teens.
How many teens are using Instagram’s business profile setting? Instagram says that worldwide there are currently around 25 million “business” accounts, of over a billion monthly active users worldwide, but doesn’t have any data on how many are run by users under 18. A California-based marketing professional who began raising the alarm about business profiles months ago thinks there could be 200,000 minors using the setting in the U.S.
NBC News did its own research and was quickly able to find numerous examples of children, some under 13, who have exposed their personal details to the world. NBC News contacted the minors — and immediately asked to speak to their parents.
“Making them that easy to contact is deeply reckless,” said Lindsey Barrett, a staff attorney and teaching fellow at Georgetown law school’s technology clinic.
In October, after receiving inquiries from NBC News, Instagram quietly allowed “business” profiles to hide their contact details. It did not notify users about this change.
When Instagram business profiles launched in May 2016, the goal was simple: let brands or small businesses use their Instagram accounts as a way to reach potential customers.
“After hundreds of interviews with businesses, three key needs became clear — stand out, get insights and find new customers,” said the company in a blog post.
For legitimate corporations or even small businesses, it made perfect sense to have contact information be readily accessible.
“Business accounts offer the ability for businesses to share their email, phone number or website so the Instagram community can connect with their business — we remind people during setup that their contact information will be available,” said Stephanie Otway, an Instagram spokeswoman. Such accounts also enable users to access certain analytics, to see how their engagements — likes and other metrics — are evolving. Over time, some teenage users began switching their accounts to access these new tools.
While some of these accounts are for aspiring child actors, wannabe models, or even “influencers,” many have no seeming relationship to any business whatsoever. Instagram said it doesn’t vet who is or isn’t a business.
In the United States, a 1990s-era law known as COPPA established that it is illegal for online services and companies to knowingly allow anyone under 13 to sign up without the consent of their parents or legal guardians. Essentially, this is the reason Instagram draws the line at 13.
“If someone sees an account that they think is run by someone under 13, we encourage them to report the account so we can investigate,” said Otway.
Instagram says that if a suspected under-13 user is reported, the account will be frozen temporarily, while the company seeks verification of their age. If that user cannot show that they’re 13 or older, the account will be deleted.
The company allows an account for a child under the age of 13 only if the bio clearly states it is being run by a manager or parent and posts are in the third person, Otway explained.
But it’s not difficult to find regular Instagram accounts that depict or appear to be operated by children under the age of 13. NBC News even found “business” profiles where the user is obviously under the age of 13, including one for a 10-year-old “aspiring actor” from Saratoga, California. The girl’s account was marked as “monitored by mom.”
Privacy and children’s safety experts say that while exposing minors’ phone numbers online isn’t the top-line problem for parents to worry about, it is troubling.
“There are lots of kids using Instagram, kids under 13, there is no airtight age verification,” said Christine Elgersma, an editor at Common Sense, a children’s advocacy group in San Francisco, noting that Instagram as a whole poses myriad challenges for underage users, including “mature content, social pressure of comparing yourself to other people, the pressure of being in constant contact.”
Instagram was unable to give numbers of users under the age of 18 nor the number of business accounts run by minors. It says it does not have any insight into most users’ ages because it doesn’t require people to state their age at the point of sign up–it only asks them to tick a box stating they are 13 or older.
Otway said that Instagram is aware that underage users are converting their accounts to business profiles. She noted that there is an optional “creator” account (which has existed since 2018) that lets users have the same analytics without exposing personal contact info.
Even outside of the “contact” feature, some teenage users — particularly girls — say they have been subject to unwanted and inappropriate messages through Instagram’s existing direct messaging tool. Sharon Brown, the mother of a 13-year-old Instagram user in Temecula, California, said that her daughter has received “marriage proposals” and “disgusting comments.”
“I didn’t realize the amount of pedophiles on Instagram,” she said. “I don’t know why any grown man would be following her on Instagram and telling her she’s cute.”
Neither regular Instagram uses nor business users can opt out of receiving direct messages from strangers. They can only opt out of seeing notifications for those messages. The addition of phone numbers and email addresses only creates more channels for contact with a minor.
“This an example of companies that did not grow up in the kids space,” said Linnette Attai, a privacy consultant and former vice president at Nickelodeon. Attai said that Instagram’s creators were unlikely to have had much experience in building apps or other services with under-18 users in mind.
“They have products that appeal to minors — they’re not thinking about what that means and where the responsibility lies, particularly on safety.”
Finding Instagram business profiles that belong to minors is as easy as picking search terms. NBC News found dozens of accounts with exposed emails and phone numbers simply by looking for words related to high school activities, like “cheerleading.”
NBC contacted several of the minors with such accounts. In each instance, NBC clearly disclosed the purpose of the contact and asked to speak to a parent.
One teenage boy immediately made his account private after being contacted.
Others who were contacted were undisturbed by the implications of making their contact information available. Several had chosen the business profile with commercial intent.
“I paint and I sell my paintings,” said Ava Moreci, a 16-year-old student at Napa High School, explaining that she wanted to see how many people were clicking on a given Instagram post along with related demographic data.
The California-based marketing professional and data scientist who began raising the alarm about the business profiles earlier this year did his own data analysis to estimate how many minors have chosen the business setting. David Stier of Walnut Creek said that in early 2019 he analyzed almost 7,000 Instagram accounts that had checked into locations in the U.S. as a way of identifying probably U.S. users. He then counted how many of them were business accounts that appeared to be run by under-18s.
Using industry estimates of teen Instagram users in the U.S., Stier extrapolated to estimate there are more than 192,000 U.S. users under the age of 18 who have exposed their contact details.
NBC News could not independently verify or replicate this figure.
Stier said he first discovered that the contact information of minors was being exposed in this way in January 2019.
“I think Instagram is a mess,” Stier said. He said he realized he could find any kid he wanted, and thought, “This is a big deal.”
Stier formally alerted Facebook — Instagram’s parent company — in a late February 2019 via an online feedback form, saying the problem had a global scale.
In his message he pointed out that the contact information was made easily available on public Instagram webpages, which meant it could be very easily gathered by a computer automatically, or “scraped.”
By March 2019, after prodding by Stier, Facebook removed contact details from each Instagram account’s source code, a change that meant that researchers could no longer easily scrape thousands of users’ data from the app. However, users browsing accounts within the app can still view email addresses and phone numbers by looking for the “contact” button on a business profile.
Throughout the summer, Stier repeatedly tried to raise the issue with government regulators. Stier got a response from Ireland’s Data Protection Commission (DPC), a government entity responsible for digital privacy on the Emerald Isle. As Facebook’s primary European headquarters are in Dublin, the Irish agency is responsible for such issues on behalf of the rest of the European Union.
“Please be advised that the issues raised in your email are being examined by the DPC as a matter of urgency, and we are grateful to you for having notified us directly,” wrote Jennifer Dolan, the assistant commissioner of the DPC’s Children’s Policy division in an Aug. 5 email to Stier.
Stier also informed the German data protection authority of a possible violation of Europe’s sweeping privacy protections under the General Data Protection Regulation, but the complaint was referred to Ireland.
To date, NBC News is unable to find an example of a government regulator in any nation taking action against Instagram over the use of business profiles by minors. The Irish Data Protection Commission declined to comment further on its investigation.
Elgersma sees the exposure of contact information as being a relatively easy problem to solve.
“I think it would be great to close this one loophole,” she said. “It’s probably true that kids aren’t aware that their phone numbers are exposed.”
Said Attai, “We shouldn’t need a law — it’s good common sense.”
Attai said that while the service is open to children as young as 13, parents should teach their children how to use it responsibly, just as they would teach them how to be safe around a hot stove.
“That doesn’t mean children 13 to 17 don’t need certain guardrails around how they’re able to interact and engage on these sites: it starts by making defaults private,” she said.
Children should have control over each piece of data they share, she added. “It shouldn’t be an all or nothing proposition.”
Barrett, the Georgetown scholar, also noted that Instagram could easily make some sort of visual distinction between different types of accounts — for example, commercial versus non-commercial and minor versus adult — so that other users know who they are interacting with.
“It’s essentially the worst of both worlds — they’re putting kids at risk without providing a distinguishing mechanism,” she said.
An Instagram spokeswoman said the company was actively exploring further privacy protections for under-18s, but would not provide further details.
For her part, Jamie Perez, who said that she and her husband deleted all of their own social media accounts years ago, has soured on the entire industry, particularly given that her daughter has received unwanted attention from older men online via Instagram direct messages.
“All in all, I wish there wasn’t social media,” she continued. “I think the world would be a better place. It’s too much hatred, too much drama.”
Similarly, her daughter, Brianna, said there could be an easy fix: “Maybe Instagram should take it into their hands and just not let [kids] put all their information on social media?”