One million reports. That’s how many times Instagram users flagged accounts belonging to children under 13 between early 2019 and mid-2023, according to a multistate lawsuit. Meta builds allegedly kept the majority of those accounts running — and kept collecting data. COPPA, the Children’s Online Privacy Protection Act, prohibits any company from harvesting personal information from kids under 13 without verified parental consent. The question now consuming Senate hearings, courtrooms, and the FTC is whether Meta treated that law as optional.
What the Research Actually Showed
Former safety researchers told Congress that Meta’s legal team actively steered them away from documenting harms to children.
Two ex-Meta researchers, Jason Sattizahn and Cayce Savage, testified before the Senate that the company suppressed evidence of child safety risks on its VR platforms. Sattizahn told lawmakers Meta “opted to overlook the issues they created and suppress evidence of users’ adverse experiences,” according to BBC reporting. Savage described company lawyers instructing researchers not to put Meta “at risk” with their findings.
Watchdog group Fairplay‘s nine-month investigation found children under 13 present in 24 of 26 visits to Meta’s Horizon Worlds platform — accessing it through adult accounts, like a teenager using a parent’s streaming login, except the stakes involve data collection on minors. The Tech Oversight Project, citing Washington Post reporting, alleges Meta’s lawyers told researchers to avoid words like “illegal,” route sensitive studies under attorney-client privilege, and halt data collection showing children under 10 in the metaverse.
The alleged retaliation pattern, drawn from Congressional testimony and reporting, includes:
- Sattizahn raising COPPA concerns in October 2023 and being fired roughly six months later despite six years of service and positive reviews, per Sen. Grassley’s subcommittee
- Savage raising compliance concerns; lawyers allegedly redirected her away from documenting legal exposure
- WhatsApp security head Attaullah Baig suing Meta after being fired two months after warning Zuckerberg about security vulnerabilities
- Former executive Sarah Wynn-Williams alleging her severance agreement violated SEC whistleblower protection rules and threatened $50,000 fines per disparaging comment
- The Tech Oversight Project also naming Joshua DeFriez and William Sevedge as additional fired employees, though those details remain unconfirmed beyond the advocacy group’s statement
Sacha Haworth, the Tech Oversight Project’s executive director, called this a “double-whammy” — Meta allegedly violating kids’ privacy, then firing the employees who said so.
Meta Pushes Back – and Congress Pushes Harder
The company calls the whistleblower claims “nonsense,” but a $375 million jury verdict and bipartisan Senate pressure suggest the walls are closing in.
Meta labeled the allegations “nonsense” built on “selectively leaked internal documents” crafted to support a false narrative, according to Privacy Daily. The company points to nearly 180 approved Reality Labs youth safety studies since early 2022 as evidence of its commitment to child safety research.
Congress isn’t buying it. Sen. Chuck Grassley has demanded answers from Zuckerberg on restrictive NDAs. Sen. Josh Hawley opened a separate investigation into allegations Meta lied to Congress and abused the legal system to silence critics. A New Mexico jury already delivered a $375 million verdict against Meta — not under COPPA, but for violating the state’s Unfair Practices Act by misleading users about child safety.
New Mexico AG Raúl Torrez stated that Meta executives “were aware that their products were harmful to children, ignored warnings from their own staff, and misled the public.”
If Frances Haugen’s 2021 disclosures were the opening act, this is the sequel nobody wanted to see. The outcomes of these cases could determine whether tech companies can weaponize NDAs against safety researchers — and whether COPPA carries any real enforcement weight inside virtual reality. For every parent handing a child a VR headset, that answer matters more than Meta’s press releases suggest.
