Instagram

Is Instagram safe?

For an adult who keeps their account private and ignores investment ads, Instagram is a reasonable risk. For privacy, it is one of the weakest apps we score, and for teenagers its record has now been tested in court. Meta lost two child-safety jury trials in March 2026, and in May it ended Instagram's optional encrypted messaging. We score it 40/100, just below TikTok.

What Meta knows

Instagram's App Store privacy label is long even by social media standards. Meta lists contact info, identifiers and "other data" as used to track you across apps and websites owned by other companies. Linked to your identity are 14 categories: health and fitness, purchases, financial info, location, contact info, contacts, user content, search history, browsing history, identifiers, usage data, sensitive info, diagnostics and other data.

That data feeds Meta's advertising system, which also covers Facebook and WhatsApp. You can tune ad topics, but you cannot opt out of tracking inside Instagram without leaving the app, except in the EU and UK, where Meta offers a paid ad-free subscription or less personalised ads.

Encrypted messages: gone

From 2023, Instagram users could choose end-to-end encryptedEnd-to-end encryptionEncryption in which only the sender and the recipient can read a message. The company running the service cannot see its content.More in the glossary chats. On 8 May 2026 Meta switched the option off. The company said "very few people" were opting in and directed users who want encryption to WhatsApp. Law enforcement and child protection groups had long argued that encryption on Instagram made grooming harder to detect.

The effect is simple. Your Instagram DMs can now be read by Meta, and can be handed over under a legal order. Treat them like email to a company, not like a private conversation.

Instagram and teenagers in court

The child-safety case against Instagram has moved from hearings and leaked documents to jury verdicts. According to Meta's quarterly filing for the period to 30 June 2026:

Date	Case	Outcome
24 March 2026	New Mexico Attorney General v. Meta	Jury verdict against Meta, $375 million civil penalty
25 March 2026	First Los Angeles personal injury bellwether (K.G.M.)	$6 million damages against Meta and YouTube, 70% allocated to Meta
May 2026	New Mexico public nuisance phase	Bench trial; state sought $953 million in abatement
August 2026	29 state attorneys general, federal court	Trial scheduled to begin 12 August

Meta is appealing the Los Angeles verdict and denies the claims. Earlier, in September 2022, Ireland's Data Protection Commission fined Instagram €405 million because children using business accounts had their email addresses and phone numbers shown publicly, and personal accounts of children were public by default.

Instagram's answer is Teen Accounts, introduced in September 2024. Under-18s are private by default, can only be messaged by people they follow, see less sensitive content and get overnight sleep mode. Under-16s need a parent's approval to change those settings. They are meaningful protections, but they depend on teenagers giving their real age.

That is exactly what the European Commission questioned. On 29 April 2026 it preliminarily found Instagram and Facebook in breach of the Digital Services Act because children under 13 can simply enter a false birth date, reporting an underage account takes up to seven clicks, and reported children often keep using the app. On 10 July 2026 it added preliminary findings that Meta had not properly assessed or reduced the risks of addictive design such as infinite scroll, autoplay and engagement-driven recommendations, and that teen time limits are easy to dismiss. Meta can reply before any decision; a final finding could bring a fine of up to 6% of worldwide turnover.

Scams and sextortion

The two patterns we see most often:

• Sextortion. A fake account, often posing as a teenage girl, gets a boy to share an intimate image and then demands money. Meta said in July 2024 that it had removed about 63,000 accounts in Nigeria linked to this kind of scam.
• Investment and shopping ads. Fake celebrity endorsements, crypto "mentors" and too-good-to-be-true shops. Many push victims to continue the conversation on WhatsApp or Telegram.

How to make Instagram safer

1. Set your account to private in Settings and activity > Account privacy.
2. Under Messages and story replies, limit who can message you and send requests from people you do not follow to a hidden folder.
3. Turn on Hidden Words to filter offensive comments and message requests.
4. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary in Accounts Center > Password and security, using an authenticator app rather than SMS.
5. Parents: link accounts through Family Center to see who your teen follows and set time limits.
6. Never move a conversation with a stranger to another app, and never pay a sextortion demand.

How we scored it

Regulatory record (15) and privacy (24) are among the lowest of any app we cover, reflecting the €405 million GDPRGDPRThe EU's General Data Protection Regulation, which sets rules on how organisations collect and use personal data and allows large fines.More in the glossary fine, the New Mexico verdict and extensive tracking. Security (55) dropped after encrypted DMs were removed. Scams and harmful content scores 38. Snapchat, the other big teen app, also tracks users for ads but has a lighter fine record.