The Numbers
In 2023, Meta submitted 29.3 million CSAM reports to NCMEC — accounting for 85% of all reports from the tech industry. In 2024, that dropped to 11.9 million (67% of total), not because exploitation decreased, but because Meta turned on end-to-end encryption on Messenger in December 2023, instantly blinding itself to content it previously detected.
Meta's CSAM Report Trajectory
The 2024 drop reflects encryption, not reduced exploitation
The Encryption Dilemma
In December 2023, Meta enabled end-to-end encryption (E2E) on Messenger by default. Privacy advocates celebrated. Child safety advocates were horrified. The result was immediate: Facebook CSAM reports to NCMEC dropped by 52%.
E2E encryption means Meta can no longer see the content of messages — including CSAM being shared in DMs. The exploitation didn't stop; Meta simply can't detect it anymore. Experts estimate millions of CSAM images that would have been flagged in 2024 went undetected.
The core tension:End-to-end encryption protects everyone's privacy, including dissidents, journalists, and abuse survivors who need private communication. But it also protects child predators. The question is whether there are technical solutions that preserve privacy while still detecting exploitation — and whether platforms are investing enough to find them.
Instagram: The Recommendation Engine
Meta's own internal research, leaked in 2021 by whistleblower Frances Haugen, showed that Instagram's algorithm actively recommended accounts posting exploitative content of children. When researchers created accounts indicating interest in young users, the algorithm served them content featuring minors in suggestive contexts.
A 2023 investigation by The Wall Street Journal and Stanford researchers confirmed that Instagram's recommendation system was connecting buyers and sellers of child sexual abuse material. The algorithm was literally building a network for exploitation.
What Meta Has Done
These are real investments. But critics point out that Meta's CSAM problem is so massive because of the scale of its platforms and the design choices that prioritize engagement over safety. Teen account restrictions came only after lawsuits from 42+ state attorneys general.
42 States Suing
In October 2023, attorneys general from 42 states filed a coordinated lawsuit against Meta, alleging the company knowingly designed products that are addictive and harmful to children. The lawsuit specifically cites Meta's failure to prevent child exploitation and its algorithm's role in connecting predators with victims.
In April 2026, the Massachusetts Supreme Court ruled that the state's standalone case against Meta could proceed — a landmark decision that confirmed platforms can be held liable for design choices that facilitate exploitation.
The Uncomfortable Truth
Meta is caught in a paradox of its own making. Its platforms are so large and its reporting so extensive that it submits more CSAM reports than the rest of the industry combined. The company points to these reports as evidence of responsibility. Critics point to them as evidence of a platform so poorly designed that it has become the world's largest distribution network for child sexual abuse material.
Both things can be true simultaneously. Meta does more than most companies to detect CSAM — and the problem exists at the scale it does in large part because of Meta's design choices, algorithmic amplification, and delayed implementation of safety features.
NCMEC Report Numbers: Year-by-Year Breakdown
Meta's CyberTipline submissions to the National Center for Missing & Exploited Children tell a story of explosive growth — and then a sudden, artificial decline. Each year reveals new context about how Meta's platforms evolved and how the exploitation problem scaled alongside them. See the full industry picture on our CSAM Reports Dashboard.
2017
8.7 million reportsFacebook dominated the social landscape with 2 billion monthly users. NCMEC received 10.2 million total industry reports that year — Meta accounted for roughly 85%. Instagram was growing rapidly but had limited detection infrastructure at this stage.
2018
12.4 million reportsA 43% jump. The Cambridge Analytica scandal consumed headlines, but behind the scenes a different crisis was accelerating. Meta expanded its PhotoDNA hash-matching deployment, which paradoxically meant it detected more existing CSAM — revealing the true scope of the problem for the first time.
2019
15.9 million reportsMeta introduced AI-based classifiers that could detect previously unknown CSAM, not just material matching known hashes. This technological leap meant more reports, but also exposed how much material had been circulating undetected. Meanwhile, Mark Zuckerberg announced a 'privacy-focused vision' for Meta — foreshadowing the encryption debate to come.
2020
20.3 million reportsCOVID-19 lockdowns drove a massive surge in online activity — and online exploitation. Children spent more time on devices, often unsupervised, while predators exploited the chaos. Meta reported a 28% increase year-over-year. NCMEC's total industry reports hit 21.7 million; Meta was responsible for 94% of them.
2021
22.1 million reportsThe year of the Facebook Papers. Whistleblower Frances Haugen leaked thousands of internal documents showing Meta knew its platforms harmed children. Instagram's algorithm was actively recommending exploitative content. Yet reports 'only' grew 9% — some researchers suggested Meta was reaching the limits of its hash-matching approach.
2022
26.0 million reportsMeta deployed new AI detection models and expanded scanning to Instagram DMs (not yet encrypted). The 42-state AG coalition was forming behind the scenes. Internal Meta communications later revealed in court showed executives debating whether to delay encryption specifically because of the child safety impact.
2023
29.3 million reportsThe peak year — and the last before encryption. Meta accounted for 85% of the industry's 34.5 million total reports. In December, Messenger encryption went live. The last month of 2023 showed an immediate detection drop. This was the year 42 state AGs filed their landmark lawsuit.
2024
11.9 million reportsA 59% drop from the prior year. Facebook Messenger reports fell by over 50% almost overnight following the December 2023 encryption rollout. Instagram reports also declined as Meta shifted more communication to encrypted channels. The exploitation didn't decrease — it simply became invisible. Industry total was 17.8 million; Meta's share fell from 85% to 67%.
The pattern is clear:Every improvement in detection technology revealed more exploitation — suggesting the true scale was always larger than what was being caught. And the 2024 encryption drop proves that when detection stops, the abuse doesn't. It just goes dark.
Instagram Algorithm Studies: A Pattern of Known Harm
The story of Instagram's role in child exploitation isn't a story of ignorance. It's a story of a company that had the data, understood the problem, and chose growth over safety — repeatedly.
2019: Internal “Teen Mental Health” Research
In 2019, Meta's internal researchers began studying Instagram's effects on teenage users. The findings were devastating: 32% of teen girlssaid that when they felt bad about their bodies, Instagram made them feel worse. The research also found that Instagram's Explore page was surfacing increasingly sexualized content to teen accounts, and that the algorithm's engagement optimization was creating feedback loops that pushed vulnerable teens toward harmful content. These studies were not published. They were presented internally, debated, and shelved. Product changes that researchers recommended — like disabling the Explore page for teen accounts — were rejected because they would reduce engagement metrics.
2023: WSJ & Stanford Investigation
In June 2023, The Wall Street Journal partnered with researchers at Stanford University's Internet Observatory to conduct a systematic investigation of Instagram's recommendation algorithm. Their methodology was straightforward but revealing: they created fresh Instagram accounts, followed a small number of accounts featuring young users, and then observed what the algorithm recommended.
The results were alarming. Within days, Instagram's algorithm was recommending accounts that sold child sexual abuse material. The “Suggested for You” and Explore features were actively connecting buyers and sellers of CSAM. Accounts used coded language and emoji (like pizza and cheese emojis) to advertise illegal content, and Instagram's algorithm was treating these signals as engagement markers — recommending them to anyone who showed similar “interest.”
The investigation found that Instagram had created what researchers called a “vast pedophile network” — not intentionally, but as an emergent property of an algorithm designed to maximize engagement at all costs. The same recommendation engine that connects you with cooking content or fitness influencers was connecting predators with each other and with victims.
Meta's Response and Changes
After the WSJ/Stanford investigation went public, Meta announced a series of changes: they disabled the ability to search for certain terms, removed accounts flagged by researchers, and added interstitial warnings when users searched for content related to child exploitation. Meta also claimed to have disrupted the recommendation pathways identified in the investigation.
However, follow-up testing by other researchers found that while some of the specific pathways had been closed, the underlying algorithmic behavior remained. New coded language emerged within weeks, and the recommendation engine continued to cluster accounts with exploitative interests. The fix addressed symptoms, not the disease.
2024: Teen Account Restrictions
In September 2024, Meta introduced “Teen Accounts” on Instagram — accounts for users under 18 with built-in restrictions. These accounts default to private, restrict DMs from non-followers, limit sensitive content in Explore and Reels, and enable sleep-mode reminders. Users under 16 need parental permission to change these settings.
While this was the most significant safety change Meta had made for young users, critics noted it came only after the 42-state AG lawsuit, the WSJ/Stanford investigation, and years of public pressure. The restrictions also depend on users accurately reporting their age — and Meta has historically done little to verify ages beyond a self-reported birthdate.
The Facebook Papers: Frances Haugen's Revelations
In September 2021, former Facebook product manager Frances Haugen went public with tens of thousands of internal documents — collectively known as the “Facebook Papers.” While much of the media coverage focused on political misinformation and teen mental health, the documents also revealed critical details about Meta's knowledge of child exploitation on its platforms.
September 13, 2021: Haugen Goes Public
Haugen revealed her identity in a 60 Minutes interview, describing how Meta consistently chose profits over safety. She had copied thousands of internal research documents, presentations, and communications before leaving the company.
The Documents: What Meta Knew
Internal research showed Meta was aware that its platforms were being used to traffic children, that Instagram's algorithm amplified exploitative content, and that proposed safety measures were repeatedly deprioritized because they would reduce user engagement. One internal presentation noted that “ichild exploitation content receives high engagement rates,” which the algorithm interpreted as a signal to show it to more users.
October 5, 2021: Senate Testimony
Haugen testified before the Senate Commerce Subcommittee on Consumer Protection. Key testimony highlights: Meta dissolved its Civic Integrity team after the 2020 election; the company knew Instagram was harmful to teens but hid the research; algorithmic amplification was a deliberate choice, not an accident; and Meta had the tools to make its platforms safer but chose not to deploy them because of the impact on growth metrics.
Impact on Legislation
Haugen's revelations accelerated the Kids Online Safety Act (KOSA), which passed the Senate in July 2024 with overwhelming bipartisan support (91-3). KOSA requires platforms to enable the strongest privacy settings by default for minors, provide parents with tools to supervise their children's accounts, and give children the option to opt out of algorithmic recommendations. The bill was directly shaped by Haugen's testimony and the internal documents she provided.
What Changed — and What Didn't
After Haugen's testimony, Meta paused the development of “Instagram Kids,” a planned version of Instagram for children under 13. The company also began publishing quarterly “Community Standards Enforcement Reports” with more detail on child safety metrics. However, the fundamental business model — algorithmic engagement optimization — remained unchanged. Meta continued to fight proposed legislation, and many of the specific safety recommendations from its own researchers remained unimplemented years later.
State Attorney General Lawsuits: The Legal Reckoning
The legal walls are closing in on Meta from multiple directions. What started as individual state investigations has become a coordinated national effort to hold the company accountable for its role in child exploitation. For context on how states are approaching these cases, see our States Failing Kids investigation.
42-State Coalition (October 2023)
In October 2023, attorneys general from 42 states and the District of Columbia filed a bipartisan lawsuit against Meta in the U.S. District Court for the Northern District of California. The complaint alleges that Meta knowingly designed Instagram and Facebook with features that are addictive and harmful to children, including: infinite scroll and autoplay designed to maximize screen time; social comparison features (likes, follower counts) that damage teen mental health; algorithmic recommendations that expose children to predators and harmful content; insufficient age verification allowing children under 13 to create accounts; and notification systems designed to create compulsive usage patterns. The lawsuit seeks injunctive relief (requiring Meta to change its practices), civil penalties, and disgorgement of profits derived from minor users.
Massachusetts Standalone Case (Supreme Court Ruling, April 2026)
Massachusetts filed its own standalone case against Meta, separate from the 42-state coalition. The state's case focused specifically on design choices that facilitate child exploitation rather than broader addiction claims. In April 2026, the Massachusetts Supreme Judicial Court issued a landmark ruling: platforms can be held liable for design choices that facilitate exploitation, even under Section 230 of the Communications Decency Act. The court distinguished between Meta acting as a publisher (protected by Section 230) and Meta as a product designer whose choices create foreseeable harm (not protected). This ruling opened the door for similar cases nationwide and sent shockwaves through the tech industry.
New Mexico AG (December 2023)
New Mexico Attorney General Raúl Torrez filed a standalone lawsuit in December 2023 with a unique approach: investigators created decoy accounts posing as 13-year-old children on Instagram and Facebook. Within hours, the accounts received messages from adults seeking sexual content and conversations. The New Mexico complaint specifically alleges that Meta's platforms are a “marketplace” for child predators and that the company's recommendation algorithm actively facilitates exploitation by connecting predator accounts with accounts belonging to (or posing as) children. This case was notable for its investigative approach — the state essentially conducted an undercover operation on Meta's own platforms.
Utah, Ohio, and Individual State Suits
Utah passed the Utah Social Media Regulation Act in 2024, requiring platforms to verify ages and obtain parental consent for minor users. When Meta resisted compliance, the state AG filed suit. Ohio followed with its own case focused on Meta's violation of the state's consumer protection laws, alleging that Meta marketed its products as safe for teens while knowing they weren't. Multiple other states have signaled they may file individual suits targeting specific harms observed in their jurisdictions.
FTC Investigation
The Federal Trade Commission has been investigating Meta's compliance with a 2019 consent decree that required the company to maintain a comprehensive privacy program. That decree followed a $5 billion fine — the largest ever imposed by the FTC on a technology company. The FTC has alleged that Meta violated the terms of this consent decree by continuing to collect data from minors and failing to implement promised safety measures. If the FTC prevails, it could impose structural changes on Meta's business, potentially requiring the company to separate its platforms or fundamentally alter how they handle minor users.
How to Protect Your Child on Meta Platforms
While systemic change is needed, there are concrete steps parents can take right now to reduce their child's risk on Facebook and Instagram.
Set Accounts to Private
On Instagram: Settings → Privacy → Private Account. On Facebook: Settings → Privacy → 'Who can see your future posts?' → Friends. This prevents strangers from seeing your child's posts, photos, and stories.
Enable Meta's Parental Supervision Tools
Meta offers a Family Center where parents can link their account to their teen's Instagram account. This allows you to see who they follow, who follows them, set daily time limits, and receive notifications about their activity. Go to Settings → Supervision to set up.
Review Follower and Following Lists Regularly
Sit down with your child weekly and go through their followers and who they follow. Look for accounts they don't know in real life, adult accounts following a child's account, and accounts with no profile picture or suspicious usernames.
Disable DMs from Non-Followers
On Instagram: Settings → Privacy → Messages → turn off message requests from people they don't follow. This is one of the most important settings — predators frequently initiate contact through DMs.
Talk About Algorithm Manipulation
Help your child understand that the content they see isn't random — it's chosen by an algorithm designed to keep them scrolling. If they engage with certain types of content, the algorithm will show them more of it. This awareness helps them recognize when they're being pulled toward harmful content.
Report Suspicious Accounts
Teach your child how to report and block accounts that make them uncomfortable. On Instagram: tap the three dots on a profile → Report → select the reason. Reports to Meta trigger review and, for CSAM, a report to NCMEC. Also report directly to NCMEC at CyberTipline.org.
Related Investigations
The Meta Paradox is part of a broader pattern across the tech industry. Explore our other investigations to understand the full picture.
Apple's Blind Spot
How Apple abandoned its CSAM detection program under pressure — and what it means for iCloud.
Discord: The Predator Pipeline
How Discord's server structure and lack of moderation create pathways from gaming to exploitation.
States Failing Kids
A state-by-state look at which governments are fighting for child safety online — and which are doing nothing.
Platform Profile: Instagram
Safety ratings, settings guides, and risk assessment for Instagram.
Platform Profile: Facebook
Safety ratings, settings guides, and risk assessment for Facebook.
CSAM Reports Dashboard
Interactive data on NCMEC CyberTipline reports by platform, year, and type.