Just a couple months after the Federal Trade Commission (FTC) slapped YouTube with a record $170 million penalty for collecting personal information from users under 13, Instagram has changed its signup system to — for the first time — require new users to provide their birthdays.
Like the vast majority of other online platforms, Facebook-owned Instagram specifies in its terms of service that users must be over age 13. But unlike many other digital destinations, it never asked new users to provide their birthdays during the registration process, or even to check a ‘Yes, I am over the age of 13’ box. Instead, it just asked for an email or phone number, a name, a username, and a password, informing users that by signing up, they automatically agreed to its terms.
Now, that’s changing. Starting this week, Instagram will ask all new users to provide their exact birthdate when signing up for an account, the platform announced in an official blog post. (It’s worth noting, though, that we were able to use the browser version of Instagram to sign up for a new account today, two days after this change rolled out, and were not asked for a birthdate).
Subscribe to get the latest creator news
“Asking for this information will help prevent underage people from joining Instagram, help us keep young people safer and enable more age-appropriate experiences overall,” Instagram wrote. It added that this change is “part of our ongoing commitment to ensuring Instagram remains a safe and supportive place, especially for the youngest people in our community.”
An Instagram spokesperson, asked by TechCrunch why it took so long to implement birthdate verification, issued this additional, rather odd statement: “Historically, we didn’t require people to tell us their age because we wanted Instagram to be a place where everyone can express themselves fully — irrespective of their identity.”
Starting today, we’ll ask for your birthdate when creating an account, and in the coming weeks, we’ll give you more control over who can message you.
This will help us keep young people safer and enable more age-appropriate experiences. Learn more: https://t.co/j7HuSB9Mng pic.twitter.com/8k1cejWal5
— Instagram (@instagram) December 4, 2019
The more than one billion users Instagram already has will not be asked to retroactively verify their birthdates; this will only apply to new users. Instagram also revealed that in coming months, it plans to employ new users’ birthday information to “create more tailored experiences, such as education around account controls and recommended privacy settings for young people.”
Adding birthdate verification is the most basic step Instagram could take to give itself a little protection from COPPA, aka the Children’s Online Privacy Protection Act, which provided the grounds for YouTube’s $170 million fine (and, earlier this year, TikTok owner Bytedance’s separate-but-also-child-privacy-related $5.7 million fine).
However, judging by YouTube’s settlement, simply adding an easily fooled birthday box isn’t going to protect Instagram if the FTC comes knocking. The agency’s settlement with YouTube hinged on its judgment that YouTube was aware there were under-13 users with over-13 accounts, but had not taken action to prevent those underage users from having their personal data collected. On top of paying its fine, YouTube agreed to mitigate this data collection by permanently turning off targeted ads (which are served to users based on their personal browsing data) on all videos that could draw viewers under 13 — something that is bound to significantly impact creators going forward.
There haven’t been any reports that the FTC is currently eyeing Instagram over children’s data issues, but considering YouTube and Bytedance’s suits — and the fact that Facebook recently paid a whopping $5 billion to settle its own data privacy charges (not related to under-13 users) — it’s not surprising that Instagram could be taking proactive measures.
