Loading story…
Research into under-13 safety controls on mainstream platforms found that protections often work only when children stay within the intended kid account types and settings; when kids use the wrong account type or explore beyond guardrails, they can more easily encounter inappropriate or risky communities. Testing that mimicked normal child behavior (not exploits) reported that platform search and discovery features can still surface communities linked to fraud and other illicit activity, highlighting practical gaps between stated age protections and what children can access during routine browsing.
OpenAI updated its Europe-facing privacy policy to reflect revised EU requirements, expanding the categories of data covered (including files, images, audio, video, and content created via newer tools/integrations) and adding clearer explanations of user controls. The policy also details options such as opting out of model training where available, managing memory features, exporting/deleting data, and using temporary chats, and it describes broader disclosure scenarios (e.g., sharing with service providers for infrastructure/safety/age and identity checks, and sharing information with a parent/guardian for teen account oversight) as well as retention practices that may keep some data after deletion requests for legal, security, or compliance reasons.
See the reporting duties and controls this puts on the clock.
3 events from the most recent confirmed update back to the earliest known activity.
The researchers found that public or falsified-age access could expose children to fraud, sexually suggestive material, graphic violence, cybercrime-linked communities, escort promotions, and credit card fraud tutorials on platforms including YouTube, Roblox, Instagram, Discord, Twitch, and TikTok. They also reported stronger protections on Minecraft, Snapchat, Spotify, and Fortnite during the same testing period.
From December 1 to 17, 2025, a specialist research team evaluated mainstream platforms' protections for children under 13 using normal user behavior and US-based accounts. The testing examined whether kid and teen safety features could be bypassed without exploits.
Following an EU revision in November 2024, OpenAI updated its Europe-facing privacy policy to expand and clarify how it handles personal data across its website, applications, and services. The revised document added broader data categories, more detailed user controls, retention explanations, and updated controller information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK regulators **Ofcom** and the **Information Commissioner’s Office (ICO)** issued warnings to major social media and video platforms (including **Facebook, Instagram, Snapchat, TikTok, and YouTube**) demanding “urgent steps” to implement more robust **age assurance** controls to prevent access by children under 13. Regulators signaled potential enforcement if platforms continue relying primarily on easily bypassed self-declared ages, arguing this enables unlawful collection and use of children’s data and exposes under-13s to services not designed for them; Ofcom requested companies report back on their plans by the end of April. In the US, the House Energy and Commerce Committee advanced the **Kids Internet and Digital Safety (KIDS) Act** on a party-line vote amid Democratic objections that the bill could reduce platform accountability for harms to minors. Criticisms focused on provisions that could **preempt certain state laws**, a **knowledge requirement** that opponents argue may let companies claim ignorance of minors’ presence, and the lack of a proactive **“duty of care”** requirement; proposed amendments to strengthen protections were not adopted.
Jun 29, 2026
The European Commission’s proposed **EU Kids Act** would impose age-based access controls and child-safety duties on social media, video-sharing platforms, games, AI companions, chatbots, and app stores. Covered social-media and video-sharing services would be barred from offering accounts to children under 13; users aged 13–15 would require closely parent-supervised accounts, while users aged 15–18 would receive more autonomous accounts designed with safety protections by default. The proposal also targets addictive design features, harmful interactions, and emotional dependency risks. Critics warn that broad age-verification and age-gating mandates can require platforms to collect or validate sensitive identity data, creating privacy, security, and free-expression risks while limiting access to lawful information. They also argue that compliance costs could disproportionately affect smaller providers and consolidate the position of dominant technology firms. The Electronic Frontier Foundation identifies age verification as a wider digital-rights concern, and opposition to the EU proposal has focused on whether its restrictions are necessary, proportionate, and adequately supported by an impact assessment.
Sep 29, 2026
TikTok said it will roll out stronger **age-verification** capabilities across the EU in the coming weeks, following a year-long pilot that analyzes profile details, posted videos, and behavioral signals to estimate whether an account may belong to a user under 13. Flagged accounts are to be reviewed by specialist moderators rather than automatically removed; TikTok said a UK pilot resulted in the removal of thousands of accounts. The move reflects increasing regulatory and public pressure on major platforms to more reliably prevent underage access, particularly where services process significant personal data and use algorithmic recommendations. California launched a new consumer privacy mechanism—the **Delete Request and Opt-out Platform (DROP)**—that allows residents to request deletion of personal information held by more than 500 registered data brokers. The tool, available via `privacy.ca.gov/drop`, supports identity and residency verification either by entering personal details (e.g., name, date of birth, address) or by using a *login.gov* account (which may require uploading government ID). The platform operationalizes expanded state privacy rights by centralizing deletion requests, aiming to reduce the exposure and resale of personal data by the data broker ecosystem.
Jun 29, 2026