Flaw in Facebook's Messenger Kids let kids invite a parent-approved user into a group chat even if that user wasn't authorized to chat with others in the group
‘We recently notified some parents... about a technical error,’ a Facebook representative said
Context & Ripple Effects
Messenger Kids was launched as the strict end of Facebook's messaging portfolio: kids under 13 can only chat with contacts their parents approve, a design meant to answer exactly the kind of adult-to-child contact risk Facebook had already stumbled on with its survey asking how it should handle adults requesting sexual images from minors. The product has since drifted looser — Facebook removed the requirement that children's parents be Facebook friends with one another before kids can connect (May 2018) — widening the contact graph the approval system must police.
This flaw sits at that seam: group chats, where Facebook elsewhere added admin-approval mechanics for new members, apparently let a parent-approved user invite someone into a group even though that user was not authorized to chat with everyone in it. Coming after reporting on financial ties between Facebook and most members of its own Messenger Kids advisory board (February 2018), each error lands on a product whose credibility already depends on its safeguards being airtight.
First-order effects
- Parents whose children used affected group chats received notifications from Facebook about the 'technical error' — meaning some kids' conversations included participants the approval flow never vetted against every member.
- The parental-approval promise, the app's core selling point, was demonstrably not enforced at the group level for an unknown set of chats.
Second-order effects
- The May 2018 decision to drop the parent-friendship requirement now reads differently: it expanded who counts as a connectable contact, so any enforcement gap compounds across a larger graph rather than a closed circle of family friends.
- Every subsequent safety incident gives child-development and privacy critics fresh grounds to challenge whether Facebook should operate a kids' product under self-set rules at all.
Third-order effects
- If approval-based gating keeps failing at scale, the durable outcome is external verification of minor-contact controls — audited permission architecture and regulator oversight replacing vendor assurances as the basis of trust for under-13 products.
- Kid-focused platforms would then need to treat authorization checks as a tested surface, not a marketing claim, reshaping how such apps are designed and certified.
The trend: Child-directed social products are moving from self-policed parental approvals toward externally verifiable contact controls as each enforcement slip erodes the case for trusting the operator alone.