More than half of the child safety tools that Instagram, Snapchat, TikTok and YouTube advertise to parents do not work as promised, according to a new independent audit that tested 86 features across the four platforms between December 2025 and June 2026.
The report, titled “Broken, Buried, or Missing,” was produced by the Cybersafety Research Center – a joint initiative of New York University and Northeastern University – with support from the child-safety non-profit Heat Initiative. Researchers found that only 35 of the 86 features tested, or roughly 41%, functioned as claimed and could realistically be found and used by a child.
The remaining 51 features failed in one of three ways:
- They were ‘broken’ and did not deliver the protection promised even though visible to users;
- They were ‘buried’ behind layers of settings that a typical teenager would be unlikely to navigate;
- Or, they were ‘missing’ altogether, meaning researchers could not trigger the feature despite following the conditions the companies themselves described in press releases.
Researchers built test accounts registered to users aged 13 to 17, alongside adult accounts aged 25 and above, to simulate three scenarios:
- a child using a platform normally,
- a teenager attempting to work around a restriction,
- and an adult attempting to bypass protections meant to shield minors from unwanted contact.
All testing was conducted through each app’s standard interface, without technical exploits.
The companies broadly disputed the findings. Meta, TikTok, Snap and YouTube each said their tools function as intended, and some argued the testing did not reflect how children typically use their platforms.
THE HEADLINE FINDING
Every platform tested promises that children cannot search for content related to self-harm or eating disorders, and that any such searches will be blocked and redirected to crisis resources. Researchers found this promise did not hold on any of the four products.
On a TikTok account registered to a minor, the platform’s search function began actively recommending harmful terms after a single search for self-harm content, including phrases referencing self-cutting and disordered eating, according to the report.
On Instagram, autocomplete suggestions offered deliberate misspellings that pro-eating-disorder communities use to evade blocklists as a tester began typing ‘eating disorder’.
Snapchat’s filtering proved similarly brittle: One misspelling returned blocked results, while the correctly spelt term returned none, according to the researchers.
In each case, researchers said the bypass took under three minutes to find.
INSTAGRAM
Instagram had the most features tested of any platform – 29 in total – and also the highest failure rate among the two largest platforms, at 66%. Only 10 of its 29 advertised features were both functional and accessible to a typical teen user.
Five features could not be triggered at all, including a promised prompt warning users before they post bullying or offensive comments.
Researchers said they posted explicit insults and slurs from one teen test account to another, and were never shown Instagram’s advertised ‘pause to rethink’ prompt; Instagram told researchers the tool is not designed to appear between accounts that follow each other.
Among features that did function, researchers flagged Instagram’s adult-to-minor messaging restrictions as illustrative of a broader problem.
Meta’s public materials state that teen accounts can only receive messages from users they follow, or have previously connected with, and that people over 19 are restricted from messaging teens who do not follow them.
Researchers found that once a teenager messaged an adult stranger first, that adult could then respond without restriction – even though the adult had not been ‘followed back’. Meta told the researchers this reflects a young person’s evident intent to connect, and said the feature is working as designed.
Instagram’s default settings performed well by contrast: New minor accounts are automatically set to private, a design researchers highlighted as an example of protection that works because it requires no action from the child.
SNAPCHAT
Snapchat had both the fewest advertised child-safety features of the four platforms, at 11, and the worst overall failure rate, at 73%. Just three features – blocking, blocking all accounts, and location-sharing restrictions – were rated fully successful.
The most serious lapse researchers documented involved adult-to-minor contact. Snapchat promises that adults cannot find or message underage accounts.
In testing, researchers said an adult test profile was able to directly search for, locate and message a child account with no restriction; the child account received and could accept the request, then viewed the adult’s prior message history with no warning displayed.
A separate ‘Find My Friends’ opt-out setting, meant to stop a user from being recommended to others, also failed in practice. Researchers said an account that had opted out was still surfaced as a suggested friend to another user within 24 hours, despite the two accounts having no prior connection.
A Snapchat spokesperson said the company continually works to strengthen its protections, and noted that some of the report’s findings relied on deliberate attempts to bypass safeguards not representative of typical use.
TIKTOK
TikTok posted the best results among the four platforms, with 12 of 24 tested features succeeding – a 50% failure rate, the lowest in the audit. Its strongest showing was ‘TikTok for Younger Users’, an automatic, restructured experience for accounts registered to under-13s that removes search, messaging and algorithmic recommendations entirely in favour of manually curated, view-only content. Researchers pointed to this as a rare example of a platform removing risk by design rather than attempting to filter it after the fact.
Despite that success, TikTok’s search safeguards failed in the same manner as Instagram’s. After a teen account searched for disordered-eating and self-harm content, the platform’s search tool began actively suggesting related harmful terms, including phrases referencing self-cutting, according to the report.
TikTok said its teen accounts include more than 50 safety settings turned on by default, and that its internal review found the features working as intended.
Researchers also documented a separate and unrelated finding involving TikTok’s comment sections beneath videos of minors performing ordinary activities, such as gymnastics, where sexually suggestive comments and images were found to be common – an issue the report categorised as a ‘circulation’ risk rather than a tested safety feature failure.
YOUTUBE
YouTube was the only platform where every one of its 22 advertised features could be triggered and evaluated; none were rated ‘missing’. Even so, only 10 of the 22 succeeded, a 55% failure rate. YouTube’s distinctive weakness, researchers said, was accessibility.
Several working features, including a time-activity dashboard and shorts-viewing limits, were not surfaced or defaulted on for users, leaving a four-feature gap between what worked technically and what a teenager was likely to encounter – the widest such gap recorded in the audit.
YouTube’s search-restriction tool was rated a partial success: it did not surface harmful content directly, but researchers found a child could click through a warning screen to continue viewing search results after typing a sensitive query.
A YouTube spokesperson pointed to internal data suggesting parents who use its supervised-account tools report confidence in the platform’s safeguards, and said the company will continue strengthening protections.
A CONSISTENT GAP ACROSS THE INDUSTRY
Two categories of harm fared worst across all four platforms combined, the report found. Not a single tool addressing ‘conduct’ – features meant to govern how users treat each other, such as bullying detection – both worked and was accessible on any platform tested.
Tools addressing compulsive or excessive use, including screen-time limits, succeeded in fewer than one in three cases; on Instagram, TikTok and YouTube, the same design flaw recurred, with break-time prompts on all three platforms allowing the user to dismiss or ‘snooze’ the limit, and continue using the app.
The report’s authors said they disclosed the vulnerabilities to the companies before publication and stressed their intent is not to rank platforms by safety but to establish that independent, adversarial testing of child-safety claims – similar to established practices in cybersecurity and vehicle crash-testing – should become a standard industry expectation rather than a one-off exercise following public criticism.
Also Read | Australia enforces world’s first under-16 social media ban