A new investigation from Malwarebytes paints a troubling picture of how social media and gaming platforms protect children. The cybersecurity company’s research shows that even accounts set up for kids under 13 can still access content tied to fraud, drug sales, and other harmful material. The question many lawmakers are asking—how do we actually keep kids safe online—has now been backed up with hard evidence.
Global Lawmakers Are Getting Involved
Governments worldwide are waking up to the threat of underage exposure to online dangers. Australia has already acted to limit minors’ access to social platforms, while the UK, France, and Canada are drafting their own restrictions. In the U.S., Senator Ted Cruz recently revived a bill that would tighten rules for kids’ social media usage and chaired a hearing on children’s screen time and safety. The goal is clear: keep young users safe online. But as this report shows, that’s easier said than done.
The Malwarebytes Study: What Happened
In December, Malwarebytes enlisted a specialized research team to test how mainstream platforms—ranging from Discord and YouTube to TikTok and Roblox—handle minors under 13. The study followed typical user behavior instead of using technical tricks or security exploits. The researchers wanted to see what a real child could experience through regular browsing or search.
They tested child, teen, adult, and guest accounts to measure how easy it was to bypass age restrictions and whether a young user could stumble upon illicit content. The results weren’t comforting. When kids use their designated accounts, most platforms behave appropriately. But curiosity tends to push boundaries, and the moment kids sidestep their intended account type, things go south almost instantly.
When Kid Accounts Aren’t Enough
Roblox’s Loopholes
On Roblox, a platform often praised for its child-friendly community, researchers set up an account for a child under 13 expecting firm restrictions. Instead, they could still locate “Communities” tied to fraud-related activity. Names and keywords linked to stolen data, such as “Fullz” (a common term for complete personal data sets sold online) and “new clothes” (referring to stolen payment cards), appeared in public searches. While these groups didn’t openly trade illegal goods, their language and behavior mirrored criminal circles. It’s a reminder that curiosity combined with clever searching can overcome even basic filters.
YouTube’s Public Access Problem
The YouTube Kids app is a safer environment, heavily filtered for age-appropriate videos. The trouble begins when a child ventures onto the main YouTube site. Despite official policies requiring users to be 13 or older, anyone can browse as a “guest” without logging in. Malwarebytes researchers confirmed that minors could easily watch adult or explicit content—with no technical trickery required. That included fraud tutorials, suggestive material, and, disturbingly, recorded scenes of real violence. The report concluded that YouTube’s protective system is essentially optional, not enforced. In other words, the kid version only works if parents or children choose to stay inside it.
Discord, TikTok, and Twitch: Open Doors for Explicit Content
Tests on Discord revealed that once an age gate was bypassed, explicit adult material became easy to access through standard search. The same pattern surfaced on TikTok and Twitch. TikTok’s adult accounts exposed videos explaining credit card scams and identity theft methods, while Twitch served ads for escort services and paywalled adult streams. All this without the user needing to dig deep—it’s simply a matter of entering the right words in a search bar.
Platforms That Passed the Test
Not every platform failed. Minecraft, Snapchat, Spotify, and Fortnite managed to keep content appropriate even when child protections were probed. Fortnite’s version for users under 13 offers a “cabined” experience where chat and purchases are disabled until a parent verifies identity through email, credit card, or Social Security information. Kids can still play, talk to friends, and enjoy the game—safely.
Why Kids Easily Bypass Age Gates
At the root of the issue is how age verification works. Most services rely on self-reported ages and simple email-based registration. Children quickly learn how to create accounts elsewhere to avoid giving away their real birthday. That’s partly because technology has trained them to. They need logins for everything—homework, streaming, and social apps—so lying about their age feels normal. The research team calls this gap a “double blind” weakness. Tighter checks could help, but requiring ID or biometrics introduces serious privacy concerns. It’s a trade-off with no clear winner right now.
What Parents Can Still Do
Parental involvement is still the best protection. Malwarebytes’ Mark Beare put it plainly: “Parents are dealing with a fast-moving digital space where real-world consequences hit quickly—spoofed accounts, deepfakes, lost money. Safeguards exist, but they’re not enough on their own.”
Account Setup Tips
- Use kid or teen accounts rather than adult ones whenever possible.
- Set profiles, friends lists, and follower settings to private.
- Leave out full names, birthdays, or identifying data unless necessary.
- Disable facial recognition features on children’s accounts.
- Check if your teen has backup or “spam” accounts with weaker security settings.
Encourage Healthy Social Habits
- Talk explicitly about who your child talks to online.
- Explain that strangers in chats or comments aren’t guaranteed to be truthful.
- Urge kids to leave groups or servers that make them uneasy.
- Reinforce that walking away doesn’t mean they’ve done something wrong.
Keep the Communication Channel Open
- Make “online talks” part of regular family conversation, not rare warnings.
- Let your child know they can come to you if something happens—no punishment attached.
- Bring in teachers, relatives, or trusted adults who can reinforce the same safety messages.
The Bigger Picture: Policy Meets Parenting
Lawmakers may change the rules, but enforcement will always lag behind human curiosity. As governments worldwide debate digital-age parenting laws, the Malwarebytes findings make one thing unmistakable—tech restrictions help, but personal awareness matters more.
Children will keep testing limits. That’s how they learn. The key is keeping up with them, having conversations before they stumble into trouble, and treating digital safety as part of everyday parenting. No platform is flawless, no filter airtight, and no app immune to workarounds. But parents who stay alert and engaged stand the best chance of keeping those small hands safe on the keyboard.