Meta AI Generates Detailed Profiles of Children from Years‑Long Family Posts
What Happened — Meta’s AI assistant on Facebook suggested personal questions about a minor, then automatically surfaced names, birth dates, deleted photos and location hints drawn from the family’s historic posts, effectively building a detailed profile of the children without consent. Meta acknowledged the flaw, said the feature “missed the mark,” and disabled the prompting logic.
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in privacy‑by‑design controls: personal data of minors was aggregated and exposed by an automated feature.
- Highlights the need for continuous monitoring of AI‑driven data handling to prove compliance with privacy regulations and to retain defensible audit evidence.
- Directly tests the effectiveness of consent, data minimization, and DSAR readiness controls that Verisq’s CookiePLUS privacy capability helps you demonstrate.
Who Is Affected
- Social‑media platforms that expose user‑generated content via AI assistants.
- Parents and families whose children’s personal information is processed.
Recommended Actions
- Review AI feature configurations for unintended data aggregation; enforce strict data‑minimization rules.
- Update privacy notices and obtain explicit consent when AI tools access or infer personal data about minors.
- Capture evidence of consent management and DSAR handling in a continuous control‑assurance system. Source: Malwarebytes Labs
Technical Notes
- Attack vector: AI feature misconfiguration that auto‑generated personal queries and retrieved historic posts, including deleted content.
- Data types exposed: names, birth dates, photos, location history of minors. Source: Malwarebytes Labs