Millions of young people are turning their personal Instagram accounts into “business” profiles to learn more about how their posts are performing. The trend has an unintended privacy consequence.

In order to be classified as a business on Facebook’s Instagram, users agree to provide their phone number or e-mail to the public on the app. Their choice — made much easier by Instagram’s design and prompting — can endanger their privacy and that of their friends, according to David Stier, an independent data scientist who reported the issue to the company, and conducted a broad analysis on 200 000 accounts around the world with several different sampling techniques.

“I’ll talk to parents and say, ‘Did you know that if your 13-year-old turns their Instagram account into a business account, more than a billion people have access to their contact information?’” Stier said. “Every parent I talk to is like, ‘Are you kidding?’”

Many social media sites, including Instagram, set the minimum age at 13, a rule that many teens and even younger kids regularly flout to sign up.

In Instagram’s settings, there’s an option called “Get More Tools”. If users click the link, they’ll be asked if they’re a “creator” or a “business”. After they say what kind of user they are, they’ll be asked what contact information they want to display. Then they’re rewarded with a host of charts about how they’re performing on Instagram, including what days and times people view their posts, which ones were the most popular and how often and by what gender their profile is seen.

“Anyone can convert their Instagram account to a business profile,” Instagram said in a statement. “We allow this because we want anyone on Instagram to be able to start a business, if they wish to. During the setup process, we remind people that their contact information will be accessible to others, and allow them to update or hide that information.”

Not businesses

Stier verified people’s ages through information displayed in users’ bios or profiles. He said he has seen teens say they’re a “nonprofit”, or an “athlete”. But upon reviewing their profiles, he found that a significant portion of them were not businesses, but regular people, sometimes with mere hundreds of followers.

After he reported the issue to Facebook, Instagram made the contact information less obviously visible. But the company said they didn’t consider his findings a security vulnerability because users made their own choices about what information to display, according to an email exchange reviewed by Bloomberg.

Stier argued that despite that choice, Instagram could protect users’ privacy. It’s possible to e-mail and call people without displaying their actual personal details. Many businesses use contact forms, for example, or anonymised e-mails. Instagram could do the same for minors, he said.

When people sign up to get Instagram’s tools for businesses, the company doesn’t verify that they are who they say they are. Instagram has blurred the lines between personal and professional, because so many regular people use their profiles for economic purposes, to create a brand for their art or photography or lifestyle.

But the metrics also matter to non-professional users. For the most part, users seek Instagram followings for the social currency they provide, creating something of a digital popularity contest. Instagram executives acknowledge the problem, and have proposed partially solving it by removing “like” counts on posts. The change is in testing in seven countries.