Why a Major Child-Safety Settlement Matters to Your SME
You may not run a social media platform, but your business probably collects personal information every day. Customers submit names and phone numbers through WhatsApp, staff log in to cloud systems, visitors complete online forms, and your marketing tools build profiles from customer behaviour.
That creates a practical responsibility: you need to know enough about the people using your systems without collecting more sensitive information than necessary. The recent settlement involving Meta brings this issue into focus. The case is about children’s safety on Instagram and Facebook, but the underlying lesson applies to any Malaysian SME using digital tools: verification can improve safety, yet the verification process itself can create privacy and security risks.
Age checks are especially difficult because different methods produce different errors. A behavioural system may incorrectly classify an adult as a minor. An identity document or facial scan may be more precise, but it exposes highly sensitive information if handled poorly.
TL;DR
Do not treat identity or age verification as a simple feature you can switch on. Decide what you genuinely need to verify, collect the least sensitive information possible, and make sure every supplier handling that information is accountable.
For most SMEs, a clear access policy, a short data-retention period, strong permissions and transparent customer communication are more practical than building a complicated verification system.
What This Means
According to TechCrunch, Meta agreed to an $18 billion settlement with 29 U.S. states and 52 attorneys general over allegations concerning children’s safety. The agreement is expected to guide changes over 10 years.
The settlement reportedly includes design measures such as a default two-hour daily screen-time limit, reminders every 15 minutes, overnight blocking from midnight to 6 a.m., muted notifications during 8 a.m. to 3 p.m., and reduced visibility of like counts for teens.
These controls only work if the platform can reliably identify which users are minors. That is where the difficult question begins. Age assurance may involve a government ID, a selfie or biometric scan, or behavioural analysis. Each option has weaknesses. Behavioural analysis can make incorrect decisions. Identity and biometric checks can expose information that cannot easily be replaced after a breach.
One approach discussed in the article is to verify someone’s age and then create a token indicating an age category while discarding the original personal information. That is safer than storing identity documents indefinitely, but transmitting sensitive information still carries risk. For an SME, this is an important distinction: not storing data does not mean the collection process has no risk.
“You need to identify that that’s a child versus an adult, and the way that we do that right now is not really effective.” — Dr. Alexis Ingber, quoted by TechCrunch
How This Applies to Malaysian SMEs
First, consider customer onboarding. A tuition centre, sports academy, medical practice, childcare provider or event organiser may need to know whether a customer is an adult, a parent or a minor. You may not need a full identity document in every case. A parent declaration, a verified guardian account and restricted staff access may be sufficient for the operational purpose. If you collect an identification document, define exactly why, who can view it and when it will be deleted.
Second, review your WhatsApp and social media workflows. Many Malaysian businesses use WhatsApp to collect enquiries, bookings and customer details. Staff may forward screenshots containing names, phone numbers, addresses or children’s information into personal chats. This creates a record that is difficult to control. Set a rule that customer information stays in an approved business account or central system, with access limited to the staff who need it.
Third, be careful with marketing segmentation. A retailer may want to identify student customers, parents or young adults to send relevant promotions. However, guessing age from browsing habits or purchase behaviour can be inaccurate and intrusive. Use broad, voluntarily provided categories instead of making sensitive assumptions. A simple preference form that asks whether a customer wants family-related updates is easier to explain than an invisible scoring system.
Fourth, check software vendors before connecting them to your customer database. Booking platforms, CRM systems, form builders and automation tools may process information on your behalf. Ask whether the vendor stores uploaded documents, where the data is processed, how long it is retained, who can access it and how a deletion request works. If a supplier cannot give you a clear answer, do not connect sensitive data until the uncertainty is resolved.
Finally, separate access control from identity collection. If your objective is to stop underage users from accessing a particular feature, you may be able to use account permissions, parental approval, staff review or a restricted workflow. Do not automatically choose facial recognition or ID uploads simply because they appear more advanced. The safest information is often the information you never collect.
A Practical Verification Decision Guide
| Business situation | Information you may need | Lower-risk control to consider |
|---|---|---|
| Booking a general service | Name and contact details | Use account permissions and confirmation messages |
| Child-focused programme | Guardian relationship and emergency contact | Use guardian consent and separate staff access |
| Restricted product or service | Age category or eligibility confirmation | Verify only the required category and avoid retaining documents |
| Employee system access | Staff identity and role | Use individual logins, multi-factor authentication and role-based access |
| Marketing communication | Communication preferences | Ask customers directly and provide an easy opt-out |
The table is a planning guide, not legal advice. Your obligations may vary depending on your industry, customer group, systems and the type of data you process. If you handle children’s information, health information or identity documents, get advice appropriate to your situation.
Practical Takeaways for Your Business
- Write down the purpose. Before collecting age or identity information, state what business decision requires it.
- Collect the minimum. If you only need an age category, do not automatically keep a full identity document.
- Set deletion rules. Decide when information is removed and make the process someone’s responsibility.
- Limit staff access. Sales staff may need contact details, while they may not need identity documents or sensitive notes.
- Use separate accounts. Do not let staff manage customer data through personal email, personal drives or private messaging accounts.
- Check supplier settings. Review retention, export, deletion and administrator controls before adopting an automation tool.
- Record exceptions. If a staff member overrides an access decision, keep a short audit record explaining why.
- Tell customers clearly. Explain what you collect, why you collect it and how they can contact you about their information.
- Test for mistaken classifications. Give customers a practical way to correct an incorrect age or access decision.
- Train your team. A secure system can still fail if employees share screenshots or passwords casually.
The Bigger Picture
The Meta settlement signals that platform design is becoming part of the public debate about safety, responsibility and user wellbeing. The key issue is not limited to one large technology company. Any business that designs a digital customer journey is making choices about what people can access, when they receive notifications, how much information they must provide and how difficult it is to correct an error.
For Malaysian SMEs, this does not mean copying the systems used by global platforms. It means building sensible controls into ordinary operations. A childcare centre can separate guardian and child records. A retailer can avoid storing unnecessary identity documents. A professional services firm can control access by job role. A training provider can use consent records and clear account ownership.
Automation can help you apply these rules consistently, but automation should not hide the decision from you. Create a simple approval flow for sensitive information, send alerts when unusual access occurs and maintain a record of consent and deletion actions. These steps make your business easier to manage and give customers more confidence.
The long-term lesson is straightforward: privacy and safety should be designed together. Verifying a user may reduce one risk while creating another. Your job as a business owner is to balance both by asking what is necessary, what can go wrong and what happens after the information has served its purpose.
Start with one customer-facing process this week. Map every field you collect, identify who can see it, remove anything you do not need and confirm that your software suppliers follow the same standard. Small, documented improvements can make your digital operations safer without making them difficult for your team or customers.
Ready to Streamline Your Operations?
Your business should run itself. AutoRunBiz deploys AI agents to automate your daily operations — WhatsApp orders, invoicing, customer follow-ups, and accounting. Book a free 15-min ops audit to see where automation fits your business →