The teen protections others still refuse to ship.
Instagram gets dragged in front of Congress every quarter for exactly the things Trinity does by default on day one. This page lists every teen-safety rule that's enforced in our backend today — not on a roadmap, not a Settings toggle, not “coming soon.” If a rule is here, it’s live.
What’s live right now.
Private by default for every minor
Anyone under 18 who signs up gets a private account. Their posts, plays, videos, and stories are hidden from the public. Only approved followers see anything. If a stranger tries to view their profile, the Message button doesn't even render. This can't be disabled by a settings toggle — it's enforced on the backend.
Adults can't DM minors they don't follow
Direct messages from adults to minors are blocked at the network layer unless the minor has already followed and approved that adult. Sending returns an error; the request never reaches the recipient. This closes the primary vector Instagram and Snapchat get sued over every year.
Night blackout — midnight to 6am
Between midnight and 6am in their local time, minors can't post, comment, send messages, start a voice room, or go live. Push notifications go silent too. Reading the feed, watching videos, and checking messages still works — we're not locking anyone out, we're refusing to be the reason they're publishing content at 3am. Enforced server-side at the endpoint, not just the button. School-hours push mute (8am–3pm weekdays) is separate and stacks on top.
988 crisis banner
Real-time keyword scanning on posts and direct messages. If a user shows signs of distress — self-harm language, suicidal ideation, crisis phrasing — a non-blocking banner surfaces the 988 Suicide & Crisis Lifeline right in the compose view. The scanner is intentionally over-permissive on the false-positive side; we'd rather show the banner too often than miss a moment that mattered.
COPPA-compliant age gate
Under-13 signups are rejected at the door — no email verification, no account created, no soft "maybe later" flow. Age is stored as an actual birthday date, not a self-declared integer, so users can't age themselves up by tapping a settings toggle. We periodically re-verify borderline accounts.
CSAM: manual reporting today, hash matching next
Every image and video is scanned by AWS Rekognition on ingest — that catches adult explicit content and blocks it from ever going live. For suspected child sexual abuse material, we run a manual review process: flagged content routes to a named human within our escalation path, and we submit reports directly to NCMEC's CyberTipline within the 24-hour window required by federal law (18 USC 2258A). Automated hash matching against the known-CSAM database (PhotoDNA) ships in the next release. Zero tolerance is a system, not a slogan — we don't pretend we have automation we don't yet.
13–15 is locked private — no override
A 13-year-old and a 17-year-old shouldn't get the same permissions. On the 13–15 bracket, the private-account toggle doesn't just default to private — it's locked. The Settings screen doesn't even render a switch; it renders a static "Required for teens" card. Server-side, the endpoint that flips the private flag refuses to accept `private = false` from a 13–15 account (returns 403 young_teen_private_locked). At 16, the toggle unlocks; the private-by-default and no-adult-DM rules keep enforcing regardless. The private-account gate isn't a toggle we hope kids leave on. It's an actual gate.
Follow requests show the requester's age
When a minor gets a follow request, the request row shows the requester's age directly — not just a username. Parents and teens can decide with actual information whether to approve a follow, rather than clicking a stranger's profile and hoping to spot red flags.