{“lastseen”:”2026-02-10T14:05:30″,”description”:”**When researchers created an account for a child under 13 on Roblox, they expected heavy guardrails. Instead, they found that the platform\u2019s search features still allowed kids to discover communities linked to fraud and other illicit activity.**\\n\\nThe discoveries spotlight the question that lawmakers around the world are circling: how do you keep kids safe online?\\n\\nAustralia has already acted, while the UK, France, and Canada are actively debating tighter rules around children\u2019s use of social media. This month US Senator Ted Cruz reintroduced a bill to do it while also chairing a Congressional hearing about online kid safety.\\n\\nLawmakers have said these efforts are to keep kids safe online. But as the regulatory tide rises, we wanted to understand what digital safety for children actually looks like in practice.\\n\\nSo, we asked a specialist research team to explore how well a dozen mainstream tech providers are protecting children aged under 13 online.\\n\\nWe found that most services work well when kids use the accounts and settings designed for them. But when children are curious, use the wrong account type, or step outside those boundaries, things can go sideways quickly.\\n\\nOver several weeks in December, the research team explored how platforms from Discord to YouTube handled children\u2019s online use. They relied on standard user behavior rather than exploits or technical tricks to reflect what a child could realistically encounter.\\n\\nThe researchers focused on how platforms catered to kids through specific account types, how age restrictions were enforced in practice, and whether sensitive content was discoverable through normal browsing or search.\\n\\nWhat emerged was a consistent pattern: curious kids who poke around a little, or who end up using the wrong account type, can run into inappropriate content with surprisingly little effort.\\n\\nA detailed breakdown of the platforms tested, account types used, and where sensitive content was discovered appears in the research scope and methodology section at the end of this article.\\n\\n## When kids’ accounts are opt-in\\n\\nOne thing the team tried was to simply access the generic public version of a site rather than the kid-protected area.\\n\\nThis was a particular problem with **YouTube**. The company runs a kid-specific service called **YouTube Kids** , which the researchers said is effectively sanitized of inappropriate content (it sounds like things have changed since 2022).\\n\\nThe issue is that YouTube’s regular public site isn’t sanitized, and even though the company says you must be at least 13 to use the service unless ‘enabled’ by a parent, in reality anyone can access it. From the report:\\n\\n\\u003e \\”Some of the content will require signing in (for age verification) prior the viewing, but the minor can access the streaming service as a ‘Guest’ user without logging in, bypassing any filtering that would otherwise apply to a registered child account.\\”\\n\\nThat opens up a range of inappropriate material, from \\”how-to\\” fraud channels through to scenes of semi-nudity and sexually suggestive material, the researchers said. Horrifically, they even found scenes of human execution on the public site. The researchers concluded:\\n\\n\\u003e \\”The absence of a registration barrier on the public platform renders the ‘YouTube Kids’ protection opt-in rather than mandatory.\\”\\n\\n## When adult accounts are easy to fake\\n\\nAnother worry is that even when accounts are age-gated, enterprising minors can easily get around them. While most platforms require users to be 13+, a self-declaration is often enough. All that remains is for the child to register an email address with a service that doesn’t require age verification. \\n\\nThis \\”double blind\\” vulnerability is a big problem. Kids are good at creating accounts. The tech industry has taught them to be, because they need them for most things they touch online, from streaming to school.\\n\\nWhen they do get past the age gates, curious kids can quickly get to inappropriate material. Researchers found unmoderated nudity and explicit material on the social network **Discord** , along with **TikTok** content providing credit card fraud and identity theft tutorials. A little searching on the streaming site **Twitch** surfaced ads for escort services.\\n\\nThis points to a trade-off between privacy and age verification. While stricter age verification could close some of these gaps, it requires collecting more personal data, including IDs or biometric information. That creates privacy risks of its own, especially for children. That’s why most platforms rely on self-declared age, but the research shows how easily that can be bypassed.\\n\\n## When kids’ accounts let toxic content through\\n\\nCracks in the moderation foundations allow risky content: **Roblox** , the website and app where users build their own content, filters chats for child accounts. However, it also features \u201cCommunities,\u201d which are groups designed for socializing and discovery. \\n\\nThese groups are easily searchable, and some use names and terminology commonly linked to criminal activities, including fraud and identity theft. One, called \u201cFullz,\u201d uses a term widely understood to refer to stolen personal information, and \\”new clothes\\” is often used to refer to a new batch of stolen payment card data. The visible community may serve as a gateway, while the actual coordination of illicit activity or data trading occurs via \\”inner chatter\\” between the community members.\\n\\nThis kind of search wasn’t just an issue for Roblox, warned the team. It found **Instagram** profiles promoting financial fraud and crypto schemes, even from a restricted teen account.\\n\\nSome sites passed the team’s tests admirably, though. The researchers simulated underage users who’d bypassed age verification, but were unable to find any harmful content on **Minecraft** , **Snapchat** , **Spotify** , or **Fortnite**. Fortnite’s approach is especially strict, disabling chat and purchases on accounts for kids under 13 until a parent verifies via email. It also uses additional verification steps using a Social Security number or credit card. Kids can still play, but they’re muted.\\n\\n## What parents can do\\n\\nThere is no platform that can catch everything, especially when kids are curious. That makes parental involvement the most important layer of protection.\\n\\nOne reason this matters is a related risk worth acknowledging: adults attempting to reach children through social platforms. Even after **Instagram** took steps to limit contact between adult and child accounts, parents still discovered loopholes. This isn\u2019t a failure of one platform so much as a reminder that no set of controls can replace awareness and involvement. \\n\\nMark Beare, GM of Consumer at Malwarebytes says:\\n\\n\\u003e \\”Parents are navigating a fast-moving digital world where offline consequences are quickly felt, be it spoofed accounts, deepfake content or lost funds. Safeguards exist and are encouraged, but children can still be exposed to harmful content.\\”\\n\\nThis doesn\u2019t mean banning children from the internet. As the EFF points out, many minors use online services productively with the support and supervision of their parents. But it does mean being intentional about how accounts are set up, how children interact with others online, and how comfortable they feel asking for help.\\n\\n### Accounts and settings\\n\\n * Use child or teen accounts where available, and avoid defaulting to adult accounts.\\n * Keep friends and followers lists set to private.\\n * Avoid using real names, birthdays, or other identifying details unless they are strictly required.\\n * Avoid facial recognition features for children\u2019s accounts.\\n * For teens, be aware of \u201cspam\u201d or secondary accounts they’ve set up that may have looser settings.\\n\\n\\n\\n### Social behavior\\n\\n * Talk to your child about who they interact with online and what kinds of conversations are appropriate.\\n * Warn them about strangers in comments, group chats, and direct messages.\\n * Encourage them to leave spaces that make them uncomfortable, even if they didn\u2019t do anything wrong.\\n * Remind them that not everyone online is who they claim to be.\\n\\n\\n\\n### Trust and communication\\n\\n * Keep conversations about online activity open and ongoing, not one-off warnings.\\n * Make it clear that your child can come to you if something goes wrong without fear of punishment or blame.\\n * Involve other trusted adults, such as parents, teachers, or caregivers, so kids aren\u2019t navigating online spaces alone.\\n\\n\\n\\nThis kind of long-term involvement helps children make better decisions over time. It also reduces the risk that mistakes made today can follow them into the future, when personal information, images, or conversations could be reused in ways they never intended.\\n\\n* * *\\n\\n## **Research findings, scope and methodology** \\n\\nThis research examined how children under the age of 13 may be exposed to sensitive content when browsing mainstream media and gaming services. \\n\\nFor this study, a \u201ckid\u201d was defined as an individual under 13, in line with the Children\u2019s Online Privacy Protection Act (COPPA). Research was conducted between December 1 and December 17, 2025, using US-based accounts. \\n\\nThe research relied exclusively on standard user behavior and passive observation. No exploits, hacks, or manipulative techniques were used to force access to data or content. \\n\\nResearchers tested a range of account types depending on what each platform offered, including dedicated child accounts, teen or restricted accounts, adult accounts created through age self-declaration, and, where applicable, public or guest access without registration. \\n\\nThe study assessed how platforms enforced age requirements, how easy it was to misrepresent age during onboarding, and whether sensitive or illicit content could be discovered through normal browsing, searching, or exploration. \\n\\nAcross all platforms tested, default algorithmic content and advertisements were initially benign and policy-compliant. Where sensitive content was found, it was accessed through intentional, curiosity-driven behavior rather than passive recommendations. No proactive outreach from other users was observed during the research period. \\n\\nThe table below summarizes the platforms tested, the account types used, and whether sensitive content was discoverable during testing. \\n\\n**Platform** | **Account type tested** | **Dedicated kid\/teen account** | **Age gate easy to bypass** | **Illicit content discovered** | **Notes** \\n—|—|—|—|—|— \\n**YouTube (public)** | No registration (guest) | Yes (YouTube Kids) | N\/A | **Yes** | Public YouTube allowed access to scam\/fraud content and violent footage without sign-in. Age-restricted videos required login, but much content did not. \\n**YouTube Kids** | Kid account | Yes | N\/A | No | Separate app with its own algorithmic wall. No harmful content surfaced. \\n**Roblox** | All-age account (13+) | No | Not required | **Yes** | Child accounts could search for and find communities linked to cybercrime and fraud-related keywords. \\n**Instagram** | Teen account (13\u201317) | No | Not required | **Yes** | Restricted accounts still surfaced profiles promoting fraud and cryptocurrency schemes via search. \\n**TikTok** | Younger user account (13+) | Yes | Not required | No | View-only experience with no free search. No harmful content surfaced. \\n**TikTok** | Adult account | No | Yes | **Yes** | Search surfaced credit card fraud\u2013related profiles and tutorials after age gate bypass. \\n**Discord** | Adult account | No | Yes | **Yes** | Public servers surfaced explicit adult content when searched directly. No proactive contact observed. \\n**Twitch** | Adult account | No | Yes | **Yes** | Discovered escort service promotions and adult content, some behind paywalls. \\n**Fortnite** | Cabined (restricted) account (13+) | Yes | Hard to bypass | No | Chat and purchases disabled until parent verification. No harmful content found. \\n**Snapchat** | Adult account | No | Yes | No | No sensitive content surfaced during testing. \\n**Spotify** | Adult account | Yes | Yes | No | Explicit lyrics labeled. No harmful content found. \\n**Messenger Kids** | Kid account | Yes | Not required | No | Fully parent-controlled environment. No search or \\nexternal contacts. \\n \\n \\n## Screenshots from the research\\n\\n * List of Roblox communities with cybercrime-oriented keywords \\n * Roblox community that offers chat without verification\\n * Roblox community with cybercrime-oriented keywords \\n * Graphic content on publicly accessible YouTube \\n * Credit card fraud content on publicly accessible YouTube \\n * Active escort page on Twitch\\n * Stolen credit cards for sale on an Instagram teen account \\n * Crypto investment scheme on an Instagram teen account\\n * Carding for beginners content on a TikTok adult account, accessed by kids with a fake date of birth. \\n\\n\\n\\n* * *\\n\\n**We don\u2019t just report on threats\u2014we remove them**\\n\\nCybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.”,”published”:”2026-02-10T13:50:00″,”modified”:”2026-02-10T13:50:00″,”type”:”malwarebytes”,”title”:”How safe are kids using social media? We did the groundwork”,”source”:””,”references”:””,”id”:”MALWAREBYTES:EE45C62A7B6A5FE92B00D74C7A5CB3C1″,”bulletinFamily”:”blog”,”cwe”:null,”cvelist”:[],”sourceData”:””,”sourceHref”:””,”cvss”:{“score”:0,”severity”:”NONE”,”vector”:”NONE”,”version”:”NONE”},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.malwarebytes.com\/blog\/family-and-parenting\/2026\/02\/how-safe-are-kids-using-social-media-we-did-the-groundwork”,”category_name”:”News”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-02-10T14:05:30″,”description”:”**When researchers created an account for a child under 13 on Roblox, they expected heavy guardrails. Instead, they found that the platform\u2019s search features still…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[6,8,12,115,13,33,7,11,5],"class_list":["post-40024","post","type-post","status-publish","format-standard","hentry","category-category_news","tag-cve","tag-cvss","tag-exploit","tag-malwarebytes","tag-news","tag-none","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n