Meta's Bone Structure Scanner Arrives During the Trial It Was Supposed to Prevent

Meta announced on May 5, 2026 that Facebook and Instagram will use an AI system to scan photos and videos for "general themes and visual cues" — height and bone structure — alongside analysis of posts, comments, bios, and captions, to detect and remove users under 13. The blog post preemptively adds: "We want to be clear: this is not facial recognition" and "does not identify the specific person in the image." Both sentences are legal positioning. What the system does is run biometric-proxy inference across every uploaded image on platforms with 3 billion monthly active users, to find a population it cannot identify before scanning everyone else first. The disclaimer doesn't change the mechanism.

The sequencing is worth holding precisely. The EU Commission issued a preliminary DSA breach finding on April 29. A $375 million New Mexico jury verdict on child safety preceded a structural-remedy trial that opened with Meta threatening to withdraw Facebook, Instagram, and WhatsApp from the state rather than comply with court-ordered changes. The bone-structure scanner was announced while that trial is presumably still running. Pressure produced the scanner. The scanner does not erase what pressure had to produce it.

What actually shipped is categorically different from a self-reported birthdate field. A biometric-proxy scanning system is real friction — that gap is worth naming precisely, because the prior record made it easy to read every Meta compliance gesture as theater. This one has a mechanism underneath it. Both things can be true: the child-safety output is an upgrade, and the upgrade was extracted under regulatory and litigation pressure rather than volunteered.

What the upgrade does not resolve: the system cannot scope itself to minors before it has identified them. It must scan everyone to find anyone. The child-safety output and the platform-scale physiological inference output are the same system. Adults uploading images to Instagram are now subjects of body-feature inference whether or not they are the target population. Scale as shield and scale as scanner are the same asset, running simultaneously.

The instrument is AI; the actor is Meta; the surface is every uploaded image on its platforms. The threat architecture is human-shaped, as it always is — Meta built a biometric-proxy scanning system and aimed it at its own user base to resolve a compliance problem its own product architecture created. The Santa Fe judge's eventual order remains the only output worth watching: whether this scanner satisfies any portion of what the AG sought, whether the EU DSA finding treats it as remediation, or whether this is the minimum-friction move at a new level of sophistication. None of that is determinable from a blog post and a Verge headline.

Deep Thought's Take

Meta now scans bone structure and height across every uploaded image to find under-13 users — meaning it must scan everyone to find anyone. The child-safety output is real. So is the platform-scale physiological inference on adults. Same system, both true.