Social Media Scraping and Your Kids: How Strangers Collect Your Child's Public Data

The post your daughter made showing her soccer team jersey with her school name visible. The photo your son’s friend tagged him in at a local park you can see in the background. The comments where your child mentioned their teacher’s name and what grade they’re in. None of this seems dangerous in isolation. But automated scraping tools don’t look at one post — they process millions. They cross-reference photos, locations, school names, friend networks, and activity patterns into profiles more detailed than anything your child would volunteer to a stranger directly. This is not a theoretical concern. Scraping is cheap, legal in many circumstances, and actively used by people who mean children harm. Here’s what’s actually being collected and what actually stops it.

Key Takeaways

• Data scraping uses automated bots to harvest publicly visible social media content at massive scale — thousands of profiles per hour.
• Children’s profiles are particularly valuable to scrapers because they often contain locations, school names, friend networks, and routine patterns.
• Scraped data feeds grooming operations, targeted scams, synthetic identity fraud, and harassment campaigns.
• Platform privacy settings — specifically “public” vs. “friends only” — are the most effective control against scraping, but they require active configuration.
• The Computer Fraud and Abuse Act (CFAA) partially limits scraping, but much public-content scraping operates in a legal gray zone under ongoing litigation.

What Data Scraping Actually Is

A scraper is a program that automatically loads social media pages and extracts structured data from them — the same way a person would read and copy information, except operating thousands of times faster. A mid-range scraping operation can process 50,000 social media profiles per hour. Enterprise-grade operations handle millions.

What gets extracted from a typical public children’s or teen profile:

• Name and username
• Profile photo and tagged photos — including faces that can be run through facial recognition systems
• Location data — home city in bio, tagged locations in posts, geotag metadata embedded in photos
• School name — frequently mentioned directly in bio, in posts, or visible on clothing in photos
• Friend and follower network — mapping who knows whom
• Activity patterns — when the child posts, which times they’re active, seasonal changes in posting that reveal school schedules and vacation periods
• Interests and affinities — music, sports, games, celebrities mentioned in posts
• Family structure — parents’ names from tags, siblings from mentions, family home visible in background photos

Combined, this data creates what security researchers call a “dossier” — a profile detailed enough to enable personalized manipulation.

A 2023 study from Stanford Internet Observatory found that publicly accessible children’s content on Instagram and TikTok was regularly indexed by third-party data aggregators, many of which had no stated child-safety policies.

How Scraped Data Is Used Against Children

Grooming. A person seeking to manipulate a child online starts by establishing false rapport — “I know you play guitar, I love that too.” That knowledge came from somewhere. Scraped profiles provide the personal details that make initial contact feel organic and trustworthy. NCMEC’s 2022 CyberTipline report documented 32 million reports of child exploitation material, with social media being the primary contact channel.

Targeted phishing. A child’s scraped profile shows they play Fortnite. A phishing message arrives: “Your Fortnite account has been flagged — click here to verify.” The specificity comes from the scraped interest data. This type of targeting is more effective than generic phishing because it passes a child’s basic plausibility check. Our piece on recognizing phishing and fake websites covers the recognition skills children need, but prevention starts with reducing what scrapers can see.

Synthetic identity fraud. As covered in detail in our piece on child credit score theft, children’s publicly posted information can fill in the non-SSN fields of a synthetic identity: full name, approximate age, city, family structure.

Harassment and doxing. Compiled profiles make harassment campaigns easier to execute and harder for victims to escape. When a child’s school name, neighborhood, daily schedule, and friend network are available as a downloadable dataset, targeted harassment becomes trivially easy to coordinate.

Commercial data brokerage. Legal data brokers (companies like Spokeo, Whitepages, and BeenVerified) aggregate public social media data with public records to build profiles they sell to advertisers, employers, and anyone willing to pay. These brokers are not specifically targeting children, but they don’t specifically exclude them either. A 14-year-old with a public Instagram profile and a public TikTok may already have a data broker file.

Which Platforms Are Most Vulnerable

Platform vulnerability depends on two factors: how much content is public by default and how aggressively the platform blocks scraping bots.

TikTok: Public by default for all accounts, including those registered as teens. All videos, profile photos, usernames, bios, and comment sections are visible without an account. TikTok has faced repeated enforcement actions for insufficient protection of children’s data (including a $5 million FTC settlement in 2019 and a €345 million GDPR fine in 2023 from the Irish DPC).

Instagram: Public by default for accounts not specifying otherwise. Business accounts and creator accounts are always public. The platform removed the “Following” activity feed in 2019, limiting some social graph visibility, but public posts remain fully scrapeable.

YouTube: All videos are public unless the uploader restricts them. Comment sections are scrapeable. Video metadata including upload time, view count, and comment content is publicly accessible through the API.

X (formerly Twitter): Public by default; the API has historically been accessible to scrapers. Post-Musk API changes in 2023 raised costs for programmatic access but did not eliminate scraping.

Snapchat: Stories can be public; Snap Map has shown children’s locations in real time when not properly configured. The default “Ghost Mode” setting protects location, but many children configure Snap Map to be visible to “My Friends,” which in practice may include hundreds of contacts.

Discord: Servers with public invite links are scrapeable by anyone who joins. Server members, roles, and activity patterns are visible to all server members.

Platform	Default Privacy	Location Risk	Photo Scraping Risk
TikTok	Public	Medium (tagged content)	High
Instagram	Public	High (location tags)	High
YouTube	Public	Low	Medium
X / Twitter	Public	Medium	Medium
Snapchat	Friends + Ghost Mode	High (Snap Map)	Low
Discord	Server-dependent	Low	Low
Roblox	Limited by default for under-13	Low	Low

The Legal Landscape: CFAA, CCPA, and Federal Proposals

Computer Fraud and Abuse Act (CFAA): The primary US anti-scraping law prohibits unauthorized access to computer systems. The 2022 Supreme Court case Van Buren v. United States (952 F.3d 1055) narrowed CFAA’s application to scraping, and the 2021 Ninth Circuit ruling in hiQ Labs v. LinkedIn held that scraping publicly accessible data is not unauthorized access under CFAA. This leaves large-scale scraping of public content in a legal gray zone at the federal level.

California Consumer Privacy Act (CCPA): Grants California residents the right to know what data companies hold about them and to request deletion. Effective for data brokers. However, it applies to businesses collecting data directly — scrapers operating outside California, or scraping public content and passing it to offshore operations, face limited exposure.

Children’s Online Privacy Protection Act (COPPA): Applies to platforms that collect data from known under-13 users. It does not effectively regulate third-party scrapers who collect publicly posted data without a direct relationship with the platform.

Proposed federal legislation: The American Data Privacy and Protection Act (ADPPA), which has advanced through committee, would create data minimization requirements that could limit broker use of scraped children’s data. KOSA’s provisions on algorithmic amplification would indirectly reduce the volume of children’s content served to unknown users. Neither has yet passed as of mid-2026.

Specific Settings That Prevent Scraping

These are the controls that actually limit scraper access to your child’s content:

TikTok:

• Settings → Privacy → Account privacy: set to “Private.” This requires approval for new followers and removes your child’s videos from public view.
• Settings → Privacy → Suggest your account to others: disable all options.
• Settings → Privacy → Duet / Stitch / Download: set all to “Off” — even in private accounts, these settings limit reposting.

Instagram:

• Settings → Privacy → Account Privacy: set to “Private.”
• Settings → Privacy → Story: set replies and sharing to “People You Follow” or “Off.”
• Remove location tags from past posts: click each post → Edit → Remove location. This is time-consuming but important.
• Settings → Privacy → Photos and Videos: check what cross-platform sharing is enabled.

Snapchat:

• Settings → Privacy Controls → See My Location: ensure Ghost Mode is enabled. This is the critical setting — children frequently share location with “My Friends,” and friend lists on Snapchat often include hundreds of people.
• Settings → Privacy Controls → Contact Me: set to “My Friends.”
• Settings → Privacy Controls → View My Story: set to “My Friends.”

YouTube:

• For children who upload videos: set all videos to “Private” or “Unlisted” rather than “Public” unless they have a specific reason for public posting.
• Studio → Settings → Channel → Advanced: review whether your child’s channel appears in search results.

General best practice: Remove school name from all bios. Remove home city specificity (city is fine; neighborhood is not). Remove age from bios. Audit tagged posts for location-revealing backgrounds.

What to Watch For Over the Next 3 Months

• The FTC is expected to finalize updated COPPA rules that may extend protections to content shared on platforms “directed to children” regardless of whether the child’s account identity is known — potentially covering public TikTok content involving children.
• TikTok’s restructured US operations as of 2026 will face new data auditing requirements from the CFIUS review process — watch for changes to default privacy settings for teen accounts.
• Several states including Illinois (BIPA), Texas (CUBI), and Washington (MHMDA) are expanding biometric data protections that may apply to facial recognition use of scraped photos. If you’re in one of these states, you may have additional legal options against platforms that enable facial recognition use of your child’s images.

Frequently Asked Questions

If my child’s account is set to private, can scrapers still get their data?

A private account on most platforms is not accessible to automated scrapers because the content requires authentication as an approved follower. However, what your approved followers see — and what’s in their public activity — can still be visible. The protection is substantially better than public, but not absolute. Advise your child not to accept follower requests from people they don’t know personally.

Can I request data broker profiles be removed for my child?

Yes, but it requires manual opt-out from each broker individually. Services like DeleteMe and Privacy Bee automate this process for a subscription fee. The major brokers (Spokeo, Whitepages, BeenVerified, Intelius) all have opt-out pages. Given how frequently new data is scraped, this needs to be done periodically, not just once.

My child’s friend posted a tagged photo of my child publicly. What can I do?

Ask the friend (or the friend’s parent) to remove the tag or delete the post. You cannot force removal unless you live in a jurisdiction with biometric rights laws. On most platforms, you can remove your own tag from a post you’re tagged in — this disconnects the tag from your account but doesn’t remove the photo itself. Framing with your child: tagging someone in public posts should require the other person’s permission first.

Does this apply to my young child’s posts too, or mainly to teens?

It applies to any public post, regardless of who made it. Many parents post publicly about their young children — the issue isn’t just what children post themselves, but what parents and family members post about them. A widely discussed 2022 report from the EU’s Data Protection Commission coined the term “sharenting” to describe this — publicly posted photos of children by parents are subject to the same scraping risks as teen self-posts.

---

About the author Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.

---

Sources

1. National Center for Missing and Exploited Children. (2023). 2022 CyberTipline Report. missingkids.org
2. Stanford Internet Observatory. (2023). Children’s Content and Third-Party Data Aggregation. cyber.fsi.stanford.edu
3. hiQ Labs, Inc. v. LinkedIn Corp., 938 F.3d 985 (9th Cir. 2019).
4. Irish Data Protection Commission. (2023). TikTok GDPR Enforcement Decision. dataprotection.ie
5. Federal Trade Commission. (2024). Data Brokers: A Call for Transparency and Accountability. ftc.gov
6. European Data Protection Board. (2022). Guidelines on Children’s Online Safety and Sharenting. edpb.europa.eu