Meta Scans Body Features to Flag Minors Online

Meta Deploys Body-Scanning AI to Detect Minors on Instagram and Facebook

Meta is now using AI-powered image analysis to identify minors on Instagram and Facebook by scanning photos for physical characteristics such as bone structure and body size. The company explicitly states this technology is not facial recognition — a critical distinction that raises both praise for child safety innovation and fresh concerns about biometric surveillance at unprecedented scale.

The move marks one of the most aggressive steps any major social media platform has taken to enforce age restrictions through automated visual analysis. With over 3 billion monthly active users across Meta's platforms, the system will process an enormous volume of images daily, making it one of the largest deployments of body-analysis AI in the consumer technology space.

Key Facts at a Glance

• Meta's new AI system analyzes photos for bone structure and body size to estimate whether a user is a minor
• The company emphasizes this is not facial recognition, which Meta discontinued on Facebook in 2021
• The technology applies across both Instagram and Facebook
• The system is designed to flag accounts that may belong to users under 18
• Flagged accounts could be moved into restricted Teen Accounts with enhanced protections
• The approach relies on visual age estimation rather than identity verification

How the Technology Works Without Facial Recognition

Meta's system represents a fundamentally different approach from traditional facial recognition technology. Rather than mapping unique facial features to identify specific individuals, the AI analyzes broader physical indicators that correlate with age — specifically skeletal proportions and overall body dimensions visible in uploaded photos.

Bone structure analysis can reveal developmental markers. Adolescents and children have measurably different proportions in areas like shoulder width relative to head size, limb length ratios, and overall frame dimensions compared to adults. These anthropometric differences are well-documented in medical literature and now form the basis of Meta's automated screening.

The technical distinction matters enormously from a legal perspective. Facial recognition has faced bans or heavy restrictions in multiple jurisdictions, including Illinois' Biometric Information Privacy Act (BIPA), which has generated billions of dollars in class-action settlements. By avoiding face-mapping entirely, Meta sidesteps the most contentious regulatory tripwires — though legal experts suggest body-scanning may eventually face similar scrutiny.

Why Meta Is Making This Move Now

The timing of this deployment aligns with mounting regulatory pressure worldwide. In the United States, the Kids Online Safety Act (KOSA) has gained bipartisan momentum in Congress, while states like California, Utah, and Texas have already passed laws requiring platforms to verify users' ages or restrict minors' access to certain content.

Meta has faced particularly intense criticism over its handling of young users. Internal documents leaked by whistleblower Frances Haugen in 2021 revealed that the company's own research showed Instagram could be harmful to teenagers' mental health. Since then, Meta has introduced several protective measures:

• Launching Teen Accounts on Instagram with default privacy settings in September 2024
• Restricting direct messaging between adults and minors
• Hiding potentially sensitive content from users under 18
• Limiting notifications during nighttime hours for teen accounts
• Requiring parental approval for teens to change restrictive settings

The body-scanning AI adds an enforcement layer to these protections. Previously, Meta relied primarily on self-reported birthdates — a system widely acknowledged as trivially easy to circumvent. A 2023 Thorn survey found that nearly 45% of minors who used age-restricted platforms simply lied about their age during sign-up.

Privacy Concerns and the Biometric Debate

Civil liberties organizations have responded with cautious concern. While child safety is a widely shared priority, the deployment of body-analysis AI at Meta's scale introduces questions that extend far beyond protecting minors.

The Electronic Frontier Foundation (EFF) and similar advocacy groups have long warned that surveillance tools built for one purpose tend to expand over time. A system designed today to estimate age from body proportions could theoretically be adapted tomorrow to infer other characteristics — gender, ethnicity, disability status, or even emotional state.

Meta's insistence that this is not facial recognition, while technically accurate, does not fully resolve the privacy calculus. Body-scanning still constitutes a form of biometric analysis — the automated processing of physical characteristics to make inferences about individuals. Under the European Union's General Data Protection Regulation (GDPR) and the newer AI Act, such processing faces strict requirements around transparency, consent, and purpose limitation.

Key privacy questions that remain unanswered include:

• How long does Meta retain the body-analysis data generated by these scans?
• Can users opt out of the scanning process entirely?
• What happens when the system misclassifies an adult as a minor, or vice versa?
• Will the analysis data be used for any secondary purposes, such as advertising?
• How does this interact with existing data protection rights under GDPR?
• What accuracy rate does the system achieve across different demographics?

Accuracy Challenges and Demographic Bias Risks

Age estimation from physical characteristics is inherently imprecise. Developmental biology varies significantly across individuals, ethnic groups, and geographic regions. A 16-year-old may have the bone structure of a typical 20-year-old, while a petite adult could be flagged as underage.

This variability introduces serious bias risks. Research published in journals like Nature Machine Intelligence has repeatedly demonstrated that AI systems trained primarily on data from one demographic group perform poorly when applied to others. If Meta's training data skews toward certain populations, the system could disproportionately misclassify users from underrepresented groups.

Compared to other age verification methods — such as Yoti's facial age estimation technology, which claims 98.9% accuracy for distinguishing users over and under 25 — body-based analysis is less proven at scale. Yoti's system, used by platforms including the UK's Ofcom-regulated services, focuses on facial features but has published independent audits of its accuracy across skin tones and demographics. Meta has not yet released comparable transparency reports for its body-scanning approach.

Industry Context: A Growing Wave of Age Verification Tech

Meta is not operating in isolation. The entire tech industry is grappling with how to verify users' ages without creating new privacy risks. Google requires age verification for certain YouTube content in the EU, while Apple has built parental controls directly into iOS through Screen Time and Family Sharing.

The age verification market itself is booming. Research from MarketsandMarkets projects the global identity verification market will reach $21.8 billion by 2028, up from $10.9 billion in 2023. Age verification represents a growing slice of this market as regulations tighten.

Alternative approaches under development include:

• Digital ID verification through government-issued documents
• Behavioral analysis that examines typing patterns and app usage
• Telecom-based verification using mobile carrier data
• Blockchain-based age tokens that verify age without revealing identity
• Parental attestation systems where guardians confirm a child's age

Each method carries its own trade-offs between accuracy, privacy, and user friction. Meta's choice to pursue passive body analysis reflects a preference for minimal user friction — the scanning happens automatically without requiring users to upload documents or complete verification steps.

What This Means for Users, Parents, and Developers

For everyday users, the immediate impact is largely invisible. The AI operates in the background, analyzing uploaded images without requiring any additional action. Adults who are incorrectly flagged may need to verify their age through additional steps, though Meta has not detailed what that appeals process looks like.

Parents may welcome the added layer of protection, particularly those who have struggled to prevent children from accessing age-restricted content. However, the system's effectiveness ultimately depends on its accuracy — a metric Meta has not publicly disclosed.

Developers and competitors should take note of the precedent this sets. If body-scanning AI proves effective and survives regulatory scrutiny, it could become an industry standard for age verification. Third-party developers building on Meta's platforms may need to account for age-flagging in their applications and content delivery systems.

Looking Ahead: Regulation Will Shape This Technology's Future

The long-term trajectory of Meta's body-scanning AI depends heavily on how regulators respond. The EU's AI Act, which began phased implementation in 2024, classifies biometric categorization systems as high-risk when used to infer characteristics like age. Meta will need to demonstrate compliance through technical documentation, human oversight mechanisms, and regular accuracy audits.

In the United States, the regulatory landscape remains fragmented. Federal legislation like KOSA could provide a unified framework, but until it passes, companies like Meta face a patchwork of state-level requirements. The Federal Trade Commission (FTC) has signaled increased scrutiny of children's privacy practices, having issued a proposed order against Meta in 2023 that would prohibit the company from monetizing children's data.

What seems certain is that passive, AI-driven age verification will become more common across the technology industry. Meta's deployment — regardless of its technical merits or flaws — establishes a new baseline for what platforms are expected to do to protect minors. Whether that baseline ultimately serves children's interests or creates new forms of surveillance will depend on the transparency, accuracy, and governance structures that surround it.

The stakes are enormous. Getting child safety right without building a body-surveillance infrastructure that outlasts its original purpose is the defining challenge Meta has set for itself — and one the entire industry is watching closely.