Instagram Has Urged Underage Users to Give Away Their Data and the Irish Are on It

• Instagram made a mistake last year, and the Irish Data Protection Commission is investigating it.
• Apparently, the social media platform urged underage users to publish their phones and email addresses.
• The data protection officers will also look into the strength of the age verification system in the platform.

According to the Irish Data Protection Commission (DPC), Instagram has made a mistake that may have led to user personal data exposure. The mistake and the subsequent investigation concerns users who are under the age of 18 and thus belong to an extra-sensitive category. The DPC will now look deeply into the matter, trying to figure out if there were any violations of the General Data Protection Regulation and on which articles in particular.

According to the investigation file, Instagram has made a mistake back in the summer of 2019, offering users as young as 13 years old to change their profiles to a “business account”. This is just an option on the platform that Instagram thought it would be nice to inform its userbase of, but they’ve failed to consider the implications it has to underage users. Business accounts display the user’s email address and phone number, something that should remain private for minors.

Unfortunately, a significant number of the users who received Instagram’s urge to consider that option took it and changed their profile to a business one. The DPC will have a lot of digging to make, as the number of underage users who received Instagram’s notice is estimated to be around 60 million. The investigators will have to figure out how many of them took it, who were below the age of 18 at the time of the action, and who reside in the EU and so they are protected by the GDPR.

Graham Doyle, a deputy commissioner at DPC, has stated the following about the investigation:

The DPC will also look into how Instagram and its parent platform, Facebook, verify user age. The age of 13 is the minimum required to set up an account on these platforms, but there’s no vigorous verification if there’s no indication that the user has lied. Also, even for those who haven’t received Instagram’s notice about the “Business Account” option, the choice was still there, and they could manually change their profiles without restriction.