What we found
Instagram: FMeta's own research proved it harms teen girls. They buried it and started building Instagram for kids. 1,867 lawsuits. Families of dead children are suing.
No meaningful age verification -- children enter false birth date. Meta told courts kids 'shouldn't be on the platform' as defence. Judge ruled (Oct 2024) design defects not protected by Section 230. School districts in 19 states suing for educational impact. California/New York passed laws because voluntary measures failed.
Facebook: F$10 billion in fines. Myanmar genocide. 87 million profiles harvested. Manipulated 700,000 people's emotions as an experiment. The FTC has fined them three times and they're still violating.
Facebook builds 'shadow profiles' on non-users through: (1) Contact list uploads — when any Facebook user syncs contacts, non-users' names, numbers, and emails are harvested. (2) Facebook Pixel embedded on 30%+ of the top websites globally, tracking every visitor via cookies and browser fingerprinting. (3) Facebook SDK integrated into 32% of the top 500 Android apps, reporting app installs, usage, and device data. (4) Like/Share buttons across the web creating tracking beacons. (5) Data purchased from brokers. A Belgian court ordered Facebook to stop tracking non-users, threatening EUR 250,000 per day in fines. Facebook's own 'Off-Facebook Activity' tool revealed the scope but only disconnects data — doesn't delete it.
Snapchat: FSnap told parents their platform was safe enough for 12-year-olds.
Internal documents revealed 10,000 sextortion reports per month by late 2022. Internal surveys showed 70% of abuse victims didn't bother reporting because they knew Snap wouldn't act — of the 30% who did, none were addressed. One-third of teen girls reported unwanted sexual contact. New Mexico AG Raul Torrez called Snapchat a pipeline for predators.
Pinterest: FPinterest markets itself as a cozy digital scrapbook for recipes and home decor.
Pinterest embeds its Pinterest Tag tracking pixel on third-party websites monitoring browsing across the internet. In February 2025, Ken Zhu sued Pinterest for tracking his activity across at least 35 websites without consent, collecting email, IP address, and browsing data to build detailed marketing profiles.
TikTok: D'Everything is seen in China.' Keylogger in the browser. Reads your clipboard. Drives teens to suicide content in 20 minutes. Banned by the Supreme Court.
Privacy policy: 'faceprints and voiceprints' with 'where required by law' loophole. Most US states have no biometric law. $92M BIPA settlement for children's facial data. Carnegie Mellon: 'you cannot change your face.' Only in US policy, not EU.
Reddit: DSold 19 years of your posts to Google for AI training. $203 million. The FTC is investigating. You weren't asked.
In February 2026, the UK Information Commissioner's Office fined Reddit £14.47 million ($19.5M) for failing to protect children under 13. The ICO found Reddit had no age verification, no data protection impact assessment for children, and collected and used children's data without consent. Reddit intends to appeal. A platform with millions of child users that never implemented age verification or assessed how its data practices affected children — fined by the UK's privacy regulator for failures so basic they suggest Reddit never tried.
Threads: DThreads' own App Store privacy label — which Meta itself filled out — discloses collection of health data, financial information, precise location, contacts,...
Threads' App Store label discloses collection of health data, financial info, precise location, contacts, browsing/search history, purchases, and sensitive info. Top10VPN found Threads collects 45% more data points than X. Meta's deputy privacy officer said the label isn't fully representative — but Meta itself filled it out.
Facebook SDK / Meta Pixel: DHospitals installed Facebook's tracking pixel on their websites.
The Markup's "Pixel Hunt" investigation found Meta Pixel and Facebook SDK sending sensitive health data from hospital websites to Facebook — including appointment bookings, medical conditions searched, and doctor names. Tax filing sites sent income data. Crisis hotlines sent call logs. In each case, website operators had installed Facebook's tracking code without understanding what data it collected.