A flaw in Facebook's messaging app aimed at kids allowed thousands of users to enter group chats with unapproved strangers, The Verge reported on Monday. Messenger Kids, launched in 2017, enables children between 6 and 12 years old to chat with family members and a list of friends pre-approved by their parents. But a "technical error" in the app meant it was possible for a child to enter a group chat with friends-of-friends who hadn't been approved by their parents. Facebook sent out a notice to thousands of users' parents last week informing them of the design the flaw. The company said the error only affected a limited number of group chats. "We recently notified some parents of Messenger Kids account users about a technical error that we detected affecting a small number of group chats," a Facebook spokesperson told CNBC. "We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety." Facebook didn't indicate how long the flaw was active in the app, but said it fixed the issue "as soon as it was discovered." It's not clear if the company received any complaints from parents prior to the flaw's disclosure. Messenger Kids has attracted scrutiny from legislators and privacy advocates since its launch in December 2017. In 2018, a number of consumer groups filed a complaint with the FTC arguing the app violates childrens' privacy and doesn't meet the requirements of the Children's Online Privacy Protection Act (COPPA) because it's not designed "to ensure that the person providing consent is actually the child's parent." Additionally, experts have raised concerns that Messenger Kids introduces children to social media at too young of an age.
A vulnerability in Children's Online Privacy Protection Act's Messenger Kids app meant children could enter group chats with friends-of-friends who have not been approved by parents. The error, which the company has now patched, allowed its six to 12 year old users to speak to strangers without the consent of parents. Children's Online Privacy Protection Act has notified the parents of users, but did not specify how long the flaw had been active. Messenger Kids has previously come under fire as it potentially does not comply with the US's Facebook, as there is no way to verify that the consent provider is the child's guardian.