Parents Beware 60% of Child Safety Features Failed Testing

Platforms repeatedly encourage parents to activate safety settings and trust teenage account protections. These are reasonable steps, but what happens when the protections themselves do not work as advertised? In July 2026, independent researchers tested 86 advertised child safety features across four major platforms. They found that 51 failed. The findings challenge a basic assumption: a safety feature does not automatically protect a child.

Lexie Matsumoto, Arturo Béjar, Abdulraheem Arar, Damon McCoy and Dr Laura Edelson conducted the research. They titled the report Broken, Buried, or Missing: Anatomies of Failure (and Success) of Social Media Child Safety Features. The team examined Instagram, Snapchat, TikTok and YouTube. They checked whether the protections worked and whether young people could find and use them. For parents, schools and regulators, this research introduces an important question: who checks the safety features before families are encouraged to rely on them?

What the researchers actually tested

The researchers tested 86 features designed to limit harmful content, unwanted contact, bullying and compulsive use. They used test accounts and realistic scenarios instead of relying on platform descriptions. A feature failed if it malfunctioned, allowed easy circumvention or proved difficult to find or use. Only 35 features met both the functionality and accessibility criteria.

Crucially, this was not a comprehensive evaluation of parent managed supervision systems. The team did not test features that required a separate parent or supervisor account. The findings concern the specific advertised features under examination. Some overlap with broader parental safety advice. Therefore, about of the tested child safety features failed. This does not mean that 59% of all parental controls failed.

Figure 1. Of 86 tested features, 51 failed and 35 passed. Source: Matsumoto et al., 2026.

Which platforms had the highest failure rates?

The research report’s Table 1 presents failures for each platform. On Snapchat, 8 of 11 tested features failed, a rate of 73%. On Instagram, 19 of 29 failed, approximately 66%. YouTube recorded 12 failures among 22 tested features, approximately 55%, while TikTok recorded 12 failures among 24, or 50%. These figures do not establish an overall platform safety ranking. Researchers examined different numbers and types of features on each service.

Figure 2. Percentage of the features evaluated on each platform that failed. These are feature failure rates, not rates of child victimisation.

The variation matters, but the common finding matters more. No platform examined was free from failures. Families may follow official guidance and set privacy controls. Even so, they may encounter gaps between platform promises and actual behaviour. Independent researchers must test how these protections work. Neither advertising claims nor settings menus prove their effectiveness.

Broken, buried or missing – How protection failed

The researchers documented four distinct failure categories. Twenty two features simply did not function as promised. Twelve both malfunctioned and proved difficult to access. Researchers could not trigger nine advertised features and classified them as missing. Another eight proved too difficult to find or configure.

Figure 3. Breakdown of the 51 failed features: 22 broken, 12 broken and buried, 9 missing, and 8 buried.

These distinctions should matter to regulators. A hidden control that children cannot realistically find may offer little practical protection, even when technically operational. Likewise, a prominent setting may inspire false confidence if users can bypass it during normal use. Regulators should assess what a feature actually does for children, not just its product description.

Harmful recommendations and the limits of filtering

Some of the report’s most concerning examples involved content discovery. After the team searched for eating disorder and self harm content, TikTok suggested harmful terms to a teenage test account. Instagram’s search autocomplete suggested altered spellings that users associate with bypassing content filters. Researchers also found that ordinary users could quickly bypass some protections.

These examples illustrate why simply blocking a small collection of keywords is insufficient. Recommendation systems can introduce children to new phrases, topics and communities. Users can also alter language to evade basic filters. Platforms claim that their systems redirect young users away from harmful content. Independent testers should check those claims and examine what the systems recommend next.

All ten tested safeguards against harmful conduct failed the evaluation criteria. These included measures addressing bullying and harmful interactions. Fewer than a third of the tested screen time and break reminder safeguards passed. These findings do not prove that every child experiences harm, but they show that some advertised protections failed when researchers tested their function.

What happened when adults tried to contact children?

The study identified an especially important weakness in Snapchat’s protection against unwanted adult contact. During testing, adult accounts found and messaged teenage accounts despite advertised restrictions. The authors state that they responsibly disclosed critical vulnerabilities to the companies before publication.

For parents, this reinforces an essential lesson about contact settings. Blocking strangers and restricting messages can reduce exposure. However, these measures cannot establish the intentions of people a child already knows online. Children may also move from monitored spaces to private messaging or another platform. Parents should therefore understand both the technical settings and the behaviour of those who contact their children.

CODA provides practical guidance through its Social Media Safety Settings directory, including the Instagram safety guide, Snapchat safety guide and TikTok safety guide. These resources can help families reduce risk, while recognising that no settings menu can guarantee safety.

What is Ireland doing about ineffective safeguards?

Coimisiún na Meán developed Ireland’s Online Safety Code. It imposes binding duties on designated video sharing services under Irish jurisdiction. Its requirements include protections involving harmful content, age assurance and, in relevant circumstances, parental control systems. This shifts the discussion beyond voluntary platform promises by creating legal obligations for covered services.

A particularly relevant development came on 8 September 2026, when Coimisiún na Meán announced its first formal investigation under the Code. The investigation concerns X and potential weaknesses in its age assurance measures and parental controls. The regulator raised concerns about ineffective or hard to find parental controls. It also questioned how clearly X described and presented those controls. The investigation has not established a breach. However, its questions resemble those raised by Edelson’s team. X was not one of the four platforms tested in that study.

At European level, the Digital Services Act requires online platforms accessible to minors to provide a high level of privacy, safety and security. The European Commission’s July 2025 guidelines on protecting minors address risks including unwanted contact, harmful content, cyberbullying and potentially addictive design. The guidelines do not themselves create binding legal duties. However, they help explain how platforms can meet their DSA obligations.

Why independent safety testing must become normal

Parents rightly expect companies to substantiate claims about child safety products. Social media companies should face the same expectation for software protections. Independent testing can reveal whether features still work after product updates. It can also uncover changes in user behaviour. It can also identify protections that work well and should become established standards.

However, the research has boundaries. The researchers tested specific safeguards under defined conditions. They did not measure overall child harm or reductions in that harm. Some findings may change as companies update their services. Those limitations should encourage ongoing testing, not excuse a lack of evidence about the effectiveness of products used by children.

What parents should do now

Parents should continue using the strongest available safety settings and check that a child uses their genuine date of birth. Review who can contact your child and who can see their profile. Check reporting options and whether screen time limits truly block access. Revisit settings after updates. Check them with your child rather than relying on old screenshots.

Equally important are regular conversations about what children encounter online. Ask who contacts them and whether anyone requests secrecy or a move to another service. Discuss upsetting recommendations and content they struggle to stop watching. Children need reassurance that adults will support them when they seek help. This matters especially when they fear embarrassment or device restrictions. The CODA Resources for Parents provide a practical starting point for these conversations.

Safety must be demonstrated, not advertised

This report does not tell parents to abandon safety controls. Instead, it should lead us to demand more meaningful evidence from the companies providing them. Platforms have the resources to detect, assess and reduce many risks. Families should not carry that responsibility alone. Parents play a vital role. However, they cannot audit algorithms or independently verify every safeguard.

The central lesson is simple. A safety feature must work, remain accessible and offer meaningful protection. Regulators should insist on independently verifiable results, while platforms should correct failures and communicate limitations clearly. Until then, parents should combine safety settings with education and ongoing involvement in their children’s online lives.

References

• Matsumoto, L., Béjar, A., Arar, A., McCoy, D., and Edelson, L. (2026). Broken, Buried, or Missing: Anatomies of Failure (and Success) of Social Media Child Safety Features. Cybersafety Research Center.
• Children and Screens: Dr Laura Edelson discusses the effectiveness of social media child safety and content moderation features.
• Coimisiún na Meán: Online Safety Code.
• Coimisiún na Meán: Investigation commenced into X under Online Safety Code, 8 September 2026.
• European Commission: Guidelines on protection of minors, 14 July 2025.

Further Reading

Read CODA’s Social Media Safety Settings and Resources for Parents, together with our dedicated Instagram, Snapchat and TikTok safety guides. For additional context on independent platform assessments, see Online Gaming Child Safety Gaps 2026.

About Children of the Digital Age

Children of the Digital Age provides online safety education and training for schools, parents and organisations. Our guides support practical conversations about online behaviour and the choices people make. However, education and app settings do not replace safeguarding or professional support.

Send a message

Contact Children of the Digital Age to enquire about online safety education, parent sessions or training for your school or organisation.