Meta & Children's Online SafetyEmail: age gating buckets & time out
Raw text
Case 4:22-md-03047-YGR Document 3012-17 Filed 05/02/26 Page 1 of 3 Exhibit 125 Case 4:22-md-03047-YGR Document 3012-17 Filed 05/02/26 Page 2 of 3 Message From: Antigone Davis [/O=THEFACEBOOK/OU=EXTERNAL Sent: To: Subject: (FYDIBOHF25SPDLT)/CN=RECIPIENTS/CN= 10/15/2019 12:37:34 PM @fb.com] Re: age gating buckets & time out Attachments: image001.png You should reply to Shane You can say we spoke if want. My thoughts are: We should wait for gold standard. We should have no default age. I get the concept of not encouraging upward age lying but putting an age under 13 suggests the service might be for under 13s, bad user experience. We should block until hard close. We should ask age not birthday and in the background use December 31 and year of birth based on age given for any age related experiences. If we just ask age, I don't see why we need to have buckets even people who don't know their exact birthday, know their age or have an age they give when asked. Caveat: I have little understanding as to why we are asking birthday. If there are good reasons to do that, please let me know. From: @fb.com> Date: Monday, October 14, 2019 at 9:22 PM To: Antigone Davis < @fb.com> Subject: Fw: age gating buckets & time out Antigone, I'm sure you've had to go 'round this debate a million times over. My two cents: I don't think any cool-down period is defensible and now that I've had some good visibility into the Core Dimensions work on reaching a "Gold Standard" I'd rather go with Option 3: Push age launch to January in order to test and align on "gold standard" before launching. They seem to be making good progress with their new Adult Classifier (an improvement upon Single Factor Approach currently used by FB Dating). Here's the link to their project plan here. Re: using age range, I'm not sure how this is an improvement but agree that we can't go with option #1 where there's only one bucket below 13. So long as we have a cool-down period, we're signaling that we are OK with letting u13s on our platform. On the other end of our age management workflow, I just learned that our age change and underage_account disable work (both of which I'm now plugged into) are very under-developed/broken: 1. There's no single owner for underage disables and work has just kicked off to launch an effort to cross- app checkpoint/disable. 2. When a user tries to update their age to be <13, we do not checkpoint them as underage and they are able to continue using FB even after they confirm that they are a specific age (see the screenshot I took CONFIDENTIAL ΜΕΤΑ3047MDL-014-00179719 Case 4:22-md-03047-YGR Document 3012-17 Filed 05/02/26 Page 3 of 3 below, "I confirm my age is 9"). All I have to do is close the error dialog box and keep changing my birthdate until I get the right one. (We're getting CO to fix this right now) BASIC INFORMATION Birthday February 2010 5 Note: you can only change your birthday a limited number of times. I confirm my age is 9. Save Changes Cancel 30000000000 From: Shane Witnov <shane.witnov@oculus.com> Sent: Monday, October 14, 2019 8:10 PM To: Antigone Davis < Cc: @instagram.com> @fb.com> @fb.com>; Subject: age gating buckets & time out Hi Antigone, @fb.com>; Karina Newton 2 issues that have recently come up discussions with Growth about age management that I'd really appreciate your quick help/take on. We owe a response back to Growth on Wednesday. (Sorry for short notice). 1. How long is reasonable to block a device after it failed our age gate? As you know you get 2 chances to enter a valid age and after that we block for 2 hours or until you force quit the app. In the past you expressed concern that you didn't think 2 hours was credible. I think we have the chance to increase that number as we roll out globally and standardize with IG. What do you think is the minimum credible number of hours? And if you had any thoughs on a way to validate this or have a more rigorous basis for this other than our best guest, I'd welcome that. If we wanted to read into legislative intent we could try to tie it to the average length that a web browser was left open in 1998 when COPPA as this is supposed to match session cookies, which expire when a browser is closed. For that I think 2 hours isn't unreasonable, but that likely isn't the best standard. 2. Age Range for age entry. The growth team is trying to find easier ways for people with low (internet) literacy. One proposal is to ask people to enter an age range. See option 2 on slide 9 of the attached deck. Claire is reviewing this with a few privacy advocates tomorrow. Is there anyone in the safety community that it'd be easy to ask what they think of this? The proposal would be to offer this option after they fail to successfully enter a valid age the first time. Thanks, Shane CONFIDENTIAL ΜΕΤΑ3047MDL-014-00179720