Facebook's mandatory anti-malware scan for flagged devices lacks transparency in how scanned data is used and has locked out an undisclosed number of users
WHEN AN OREGON science fiction writer named Charity tried to log onto Facebook on February 11, she found herself completely locked out of her account.
Context & Ripple Effects
Facebook's anti-malware scan is the latest instance of a recurring pattern: a security feature that doubles as an access gate with no disclosed rules. The company had already been caught on the data-handling front — a letter shared by Sen. Ron Wyden showed Facebook admitted ignoring 2013 auditor warnings that device partners might misuse user data.
The lockout of users like Charity, an Oregon writer cut off from her account on February 11, previews what became a habit: four years later Meta would repeat the move at scale when Facebook Protect lockouts hit users whether or not they had enabled the feature. The through-line is that Facebook's security tooling keeps deciding who gets access, with little transparency about either the criteria or what happens to the data collected along the way.
First-order effects
- Flagged users like Charity lose their accounts outright, with no disclosed number affected and no published explanation of what the scan collects or how long it retains it.
- Facebook gains device-level inspection rights over machines it deems suspicious, effectively extending its reach from its own servers onto users' hardware.
Second-order effects
- The opacity invites the same regulatory and press scrutiny that followed the Wyden letter and the Oculus login requirement, both of which framed Facebook tying access to conditions users can't negotiate.
- Every lockout converts a security measure into a customer-support liability, pushing Facebook toward appeal processes and disclosures it has so far declined to publish.
Third-order effects
- If the pattern holds, platform security becomes an enforcement layer: the company that operates the service also scans the endpoint, adjudicates the threat, and revokes access — concentrating identity and access control across everything Facebook owns.
- Recurring lockout incidents give legislators and regulators a concrete accountability target, feeding the case for rules on how platforms may condition account access on device-level surveillance.
The trend: Platform security features are evolving into opaque enforcement gates where the same company scans devices, judges risk, and controls access with minimal user recourse.