Big Tech and the Online Child Sexual Exploitation Crisis (QFR Responses)

QuestionIs COPPA's "actual knowledge" standard a high legal bar for Meta to meet?

ResponseMeta does not directly answer whether "actual knowledge" is a high bar; it restates its COPPA-compliance posture and age-checkpoint mechanics instead.

QuestionDoes Meta believe a policy of "willful ignorance" about child users' ages meets its responsibility to protect underage users?

ResponseMeta explicitly rejects the "willfully ignorant" characterization, citing its $20B+ safety/security investment since 2016, then re-walks through its age-checkpoint detection pipeline and parental-supervision-tool/legislative-framework boilerplate already given in Questions 18 and 24(a)/(d-e).

QuestionWould Meta support raising COPPA's knowledge standard to impose greater responsibility on companies to prevent underage use?

ResponseNo — Meta opposes raising COPPA's knowledge standard directly, preferring app-store-based parental approval/age verification instead.

QuestionFollowing WSJ reporting that Meta blocked thousands of child-sexualizing hashtags and CSAM-associated search terms only after being queried by reporters, Cruz asks for the full lists, post/account counts, and user-report data behind those actions.

ResponseMeta declines to provide the requested lists/counts, citing risk of tipping off bad actors, but describes its detection methodology (coded-language tracking, cross-term relationship analysis, unified blocklists across Facebook/Instagram) and its 2023 internal task force on the effectiveness of this work.

QuestionHow many Instagram profiles of believed-under-18 users were accessed via the flagged hashtags/search terms?

ResponseMeta says it does not track this figure, and instead describes default-private teen accounts and measures limiting "potentially suspicious" adult accounts from finding/interacting with teen profiles.

QuestionWSJ reported Meta's own algorithms flagged certain search terms as possibly linked to CSAM yet still let users click through to results; Cruz asks for the term list, search/click-through counts, and Meta's original rationale for offering the click-through option.

ResponseMeta declines to list the specific terms or provide the requested search/click-through counts, but confirms the "see results anyway" click-through was intentional (meant for non-violating uses of otherwise-flagged terms) and that it was removed "last year" in favor of a hard blocking screen.

QuestionDescribe child-safety-team staffing/resources over the past 5 years, broken down by function, and compare to other content teams like misinformation.

ResponseMeta gives aggregate company-wide safety/security spending and headcount figures ($20B+ since 2016, 40,000+ people by 2022) rather than the requested child-safety-specific breakdown by function or comparison to other content teams.

QuestionGrassley asks how long Meta voluntarily retains CyberTipline-related data beyond the statutory 90-day minimum, what specific data types (IPs, screennames, geolocation, etc.) it retains, and why it doesn't retain longer to aid law enforcement investigations.

ResponseMeta says it exceeds legal reporting requirements, complies with the 90-day statutory preservation minimum but not more, disputes the premise that nothing prevents longer retention (citing CSAM possession liability risk), and calls for Congress to amend the statute to enable longer preservation; it does not directly itemize which specific data fields (IP, geolocation, etc.) it retains as asked in 1(c).

QuestionGrassley asks for Meta's average response time to law enforcement legal process specifically for CSAM-related information.

ResponseMeta does not give a specific average response time; it says response time "depends on a variety of factors," that it prioritizes emergencies including child abuse, and describes its dedicated law-enforcement/NCMEC liaison teams and around-the-clock emergency response capability.

QuestionGrassley asks how many child-safety-focused employees Meta laid off 2018–2023, whether those roles were backfilled with H-1B visa holders, how layoffs affected Meta's ability to protect children, and whether Meta plans to grow child-safety staffing.

ResponseMeta does not answer 4(d) directly; it redirects to its answer for 4(c), which states that Meta implemented a company-wide restructuring "focused on flattening" the organization, says these changes "did not change the commitment we have to our ongoing integrity efforts," and that Meta continues to have "about 40,000 people focused on overall safety and security efforts" — without breaking out child-safety-specific layoff or backfill numbers.

QuestionCiting a Tech Transparency Project report that Meta's own AI ad tool generated and approved harmful images (vaping, "pill party") in ads targeted at 13-17 year olds, Grassley asks how often Meta quality-checks its child-safety ad policies, which teams do this work, staffing levels, and enforcement response.

ResponseMeta does not give the specific frequency/staffing/enforcement-speed figures requested; it describes its overall ~40,000-person safety and security workforce, acknowledges its generative AI tool can produce "inaccurate or inappropriate outputs," and says it uses blocklists (e.g., blocking "young + vape") to try to prevent this.

QuestionGrassley asks Meta to detail its revenue/ad spend, how much of that goes to safety and specifically child-safety functions, staffing levels and budgets for child-safety components over 2021-2023, the roles of those teams, and any third parties Meta uses to address CSAM.

ResponseMeta gives topline revenue/net income figures but declines to break out advertising spend on safety specifically; it states it has invested $20B+ in safety/security since 2016 (~$5-6B/year 2021-2023) but cannot isolate a child-safety-specific budget or headcount because "this work is embedded throughout the company," instead describing its child-safety teams' functions, CSAM enforcement statistics, and industry partnerships (Technology Coalition, Project Protect, Lantern, Take It Down, StopNCII, Thorn/NoFiltr).

QuestionGrassley asks for a breakdown, by year (2021-2023) and by reporter age, of how many of Meta's NCMEC CyberTipline reports were self-generated by victims versus total reports.

ResponseMeta says it does not keep the specific self-generated-vs-total, age-broken-out statistics requested, and instead describes its reporting tools, teen safety notices, and Take It Down/StopNCII.org resources.

QuestionGrassley asks whether Meta's shift to default end-to-end encryption will cut child-safety costs, what CSAM-detection technology Meta is exploring for encrypted messages, whether users can opt out of default encryption, and whether parents can choose to keep their child's messages unencrypted.

ResponseMeta denies encryption is cost-motivated, says it won't build "client-side scanning" for encrypted messages but instead relies on unencrypted-side signals and features like default nudity protection for teens; it will not let users opt out of default encryption at all, but notes Messenger Kids (for under-13s) remains unencrypted specifically so parents can supervise it.

QuestionGrassley asks how comprehensive Meta's NCMEC CyberTipline reports are, what data-collection challenges Meta faces, and what Meta is doing to make reports more useful to law enforcement.

ResponseMeta says its reports are robust, that it reported over 26 million of the industry's 32 million total NCMEC reports in 2022, and attributes its high volume to proactive automated detection — but does not directly address the specific "actionable information" completeness gap NCMEC raised.

QuestionCiting a Daily Mail report on a UK police investigation into the virtual gang rape of a girl under 16 in Meta's Horizon Worlds VR platform, Grassley asks what proactive steps Meta is taking to prevent sexual assault and unwanted sexual advances against children in VR.

ResponseMeta does not address the specific Horizon Worlds assault incident described; it lists existing VR safety defaults for teens (personal boundary distance, blurred chat, garbled voice mode, private profiles, block/mute/report tools, parental supervision controls) as its answer to preventing unwanted sexual contact.

QuestionDoes Zuckerberg let his own children use social media, and under what conditions?

ResponseHis children (all under nine) use Messenger Kids under his supervision; Meta says parental controls are essential for any under-13 service.

QuestionShould minors under 18 be allowed to use social media at all?

ResponseYes; Meta points to $20B+ in safety/security spend since 2016 and describes parental supervision tools (Family Center, approve/deny prompts for teens under 16 loosening default privacy/safety settings).

QuestionWhat has Meta invested in anti-CSAM technology specifically?

ResponseMeta describes CSAM hash-matching (PhotoDNA, its own open-sourced tools), ML detection of novel CSAM, coded-language/hashtag/search-term enforcement, and industry programs it helped found (Lantern, Take It Down, StopNCII).

QuestionHow does Meta verify and enforce the minimum age (13) requirement on Facebook/Instagram?

ResponseMeta walks through its full underage-detection pipeline: user reports, automated triage, manual reviewer criteria (bio/photos), age-checkpoint blocking screens, permanent removal for confirmed under-13s, and its third-party age-verification partnership with Yoti.

QuestionHow does Meta work with law enforcement when a child's safety is at risk?

ResponseMeta expedites law-enforcement requests tied to child safety/emergencies and has a dedicated team liaising with NCMEC, Interpol, FBI, and HSI; it will proactively report to law enforcement/NCMEC if a child appears in imminent danger.

QuestionDoes Meta believe AI/CGI-generated CSAM has any expressive value?

ResponseNo — Meta says its CSAM ban applies equally to AI-generated material, backed by detection technology, specialist teams, and mandatory NCMEC reporting.

QuestionDoes Meta believe AI/CGI CSAM is First Amendment-protected speech?

ResponseNo; Meta reiterates its strict anti-CSAM/sextortion policies and mandatory NCMEC reporting, cross-referencing its prior answer.

QuestionWhat does Meta do to keep ads shown to minors age-appropriate?

ResponseMeta says it now targets teen ads only by age and geography (having removed gender/interest/activity targeting), bans certain ad categories (alcohol, financial, weight-loss, sexual health) for under-18s, and offers teen-specific Ad Topic Controls.