Facebook Messenger Kids app flaw allowed group chats with unapproved contacts

In the most recent days, Facebook has sent notices to parents of kids who use the Facebook Messenger Kids app. The notice outlined a “technical error” that allowed kids to join group chats with other approved contacts and their approved contacts.

Basically, Messenger Kids inadvertently allowed kids to communicate with non-approved contacts through the group chat feature. Facebook quietly notified parents but has not addressed the issue publicly.

We found a technical error that allowed [CHILD]’s friend [FRIEND] to create a group chat with [FRIEND]’s parent-approved friends. We want you to know that we’ve turned off this group chat and are making sure that group chats like this won’t be allowed in the future. If you have questions about Messenger Kids and online safety, please visit our Help Center and Messenger Kids parental controls. We’d also appreciate your feedback.

The Verge confirmed the authenticity of the notice with Facebook and the notice was sent to “thousands of users in recent days” according to The Verge.

Facebook Messenger Kids is a version of Facebook Messenger that lets children communicate with contacts that are strictly approved by the parents. Thus, a child can only start a chat with pre-approved contacts.

The actual bug came from the complexity of permissions when it comes to group chats. Just because Timmy starts a group chat with his older cousins Tracy and Tom, doesn’t mean that Timmy’s pre-approved friend James should be allowed to enter the group chat. James parent(s) don’t necessarily know who Timmy’s pre-approved contacts are.

Currently, it is not clear how long the bug has been present. But the issue at hand is a grave one since it involves children below the age of 13. Messenger Kids must follow the COPPA (Children’s Online Privacy Protection Act) which outlines regulations pertaining to the collection of data of children. Due to this bug, Facebook could face hefty fines from the FTC (Federal Trade Commission).

Source