Facebook’s Messenger Kids app design flaw allowed adults to join group chats with children

Facebook’s app Messenger Kids, which launched in 2017, is supposed to be a safe space where children are able to chat to friends that have been approved by their parents.

However, as The Verge initially reported, Facebook has admitted that it was possible for unknown people - potentially adults - to join the group chats due to a design flaw.

"We recently notified some parents of Messenger Kids account users about a technical error that we detected affecting a small number of group chats,” the company confirmed on Monday (22 Jul).

"We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety.”

The Verge reported that “thousands” of parents had been notified of the risk, however this figure has not been verified by the tech giant.

What is Messenger Kids?

Children using Messenger Kids can only talk directly to one another when their ‘friendship’ has been approved by a parent on each side.

However, in a group chat with more than one person, it is possible for a new person to join with the approval of a parent of just one child within the group.

The app also allows adults approved by just one parent to talk to children in group chats, which is how an adult could come into contact with a child whose parent has not approved contact.

Facebook, which is currently facing $5bn fines over recent privacy violations, told the BBC that the flaw had been fixed as soon as it was noticed and that no complaints of inappropriate behaviour had been made to them. It was not confirmed how long the flaw had been present, and Facebook did not reveal when they had realised there was a problem.

Critics of Facebook have said that the security concern confirms fears vocalised when the app first launched.

James Steyer, founder and chief executive of US not-for-profit group Common Sense, which campaigns for children’s safety online, told the BBC, “Facebook Messenger Kids is just the latest example of a Facebook product that poses unknown privacy risks to parents and users.”