How to test a social network

01Direct answer

02What counts as a social network

A social network here is an iOS, Android and web product where users keep profiles, follow each other, post to a ranked feed and message each other, and where users under 18 can join. It covers sign-up and age capture, privacy defaults, the recommendation feed, reporting and blocking, sessions and the advertising data path. One-to-one messaging apps without a public feed and dating apps built around matching are out of scope.

Adjacent product types not covered here

• messaging app: A messaging app carries private conversations between known contacts with no ranked feed, so group invites that put a child account in a chat with an unapproved adult and reconnect storms lead instead of what an algorithm suggests to a teen.
• dating app: A dating app matches adults and sells paid features, so romance scams and disputed subscriptions replace child privacy defaults and the recommendation feed.
• mobile game: A mobile game sells in-game purchases to players who may be children, so purchases without parental consent replace self-harm content served by a feed.

03Risk map

04Mandatory tests (8)

1. 1

   Step 1: release smoke tests

   Why:store-rejection

   Done when: On the release build, a new user signs up, posts, follows someone, reports a post and blocks a user.

   Tool class: mobile automation. Who usually runs it: QA engineer.

2. 2

   Step 2: exploratory testing

   Why:user-harm

   Done when: A session log from a test teen account shows that after engaging with self-harm and diet content the feed and search do not keep suggesting it, signed off by the trust and safety lead.

   Tool class: test management. Who usually runs it: QA engineer.

3. 3

   Step 3: penetration testing

   Why:data-breachfraud-abuse

   Done when: A tester cannot obtain or reuse another user's session token through profile previews, shared links or the API, and a password reset signs every old session out.

   Tool class: proxy. Who usually runs it: external lab.

4. 4

   Step 4: regression suite

   Why:regulatory-penalty

   Done when: After each release, privacy defaults for new teen and adult accounts match the approved settings list.

   Tool class: mobile automation. Who usually runs it: QA engineer.

5. 5

   Step 5: compliance checks

   Why:regulatory-penalty

   Done when: A signed review shows that an account registered with a minor's birth date starts private and cannot be messaged by strangers, and a sign-up with an under-13 birth date is blocked or sent to parental consent, with a screenshot for each market's rule.

   Tool class: test management. Who usually runs it: product manager.

6. 6

   Step 6: analytics and event tracking tests

   Why:regulatory-penalty

   Done when: A network capture shows phone numbers and emails collected for sign-in security never sent to advertising or analytics endpoints.

   Tool class: proxy. Who usually runs it: product manager.

7. 7

   Step 7: security scanning

   Why:data-breach

   Done when: The scan of the apps and public API shows no open high-severity finding, and profile endpoints return no private field to a non-follower.

   Tool class: DAST scanner. Who usually runs it: security specialist.

8. 8

   Step 8: end-to-end functional tests

   Why:store-rejection

   Done when: A reported post reaches the moderation queue, and a blocked user can no longer see or message the blocker, on iOS, Android and web.

   Tool class: mobile automation. Who usually runs it: QA engineer.

05Recommended and optional tests

• device and browser compatibilityrecommended

  Becomes mandatory when the support list covers older OS versions still in store distribution.

• accessibility testingrecommended

  Becomes mandatory when the platform falls under a public accessibility law in a market it serves.

• performance and load testingrecommended

  Becomes mandatory when a launch or live event is expected to bring a sign-up spike.

• offline and poor-network testingrecommended

  Becomes mandatory when duplicate or lost posts are reported by users.

• unit testsoptional

  May help: age and visibility rules have fixed inputs and outputs.

• usability testingoptional

  May help: safety tools nobody finds do not protect anyone.

• localization testingoptional

  May help: safety labels lose meaning in poor translation.

06Not needed and why

• integration tests

  Not needed: no third-party app gets user data through an API. Becomes recommended when an API for third-party apps ships.

• data integrity and migration testing

  Not needed: no figures or records are computed for users to act on. Becomes recommended when creator payouts are calculated from views.

07Order of work

08Tools

Listed alphabetically inside each test type, filtered to the tests above and to the platforms of social network (ios, android, web). Not recommendations.

09What to send to the person who will test

Send the checklist and the brief below. The printable checklist for social network has the same 8 items with checkboxes.

Download the checklistMarkdownCSVBrief (Markdown)

Acceptance criteria wording

A release of the social network is accepted when a new user can sign up, post, follow, report a post and block a user on iOS, Android and web, and every reported post reaches the moderation queue. A new account registered with a minor's birth date starts private and cannot be messaged by strangers, and teen and adult privacy defaults match the approved settings list. No session token can be obtained through profile previews, and phone numbers collected for sign-in security never reach advertising endpoints.

Brief

# Test brief: social network

Product type: social network. Profiles, feeds, follows and messaging at scale.
Risk map and evidence: https://howtotestaproduct.com/how-to-test/social-network/
Printable checklist: https://howtotestaproduct.com/checklists/social-network/

Run these 8 mandatory tests in this order. A test is done only when its done condition is true on the build you will release.

1. release smoke tests (risks: store-rejection). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: On the release build, a new user signs up, posts, follows someone, reports a post and blocks a user.
2. exploratory testing (risks: user-harm). Tool class: test management. Usually run by: QA engineer.
   Done when: A session log from a test teen account shows that after engaging with self-harm and diet content the feed and search do not keep suggesting it, signed off by the trust and safety lead.
3. penetration testing (risks: data-breach, fraud-abuse). Tool class: proxy. Usually run by: external lab.
   Done when: A tester cannot obtain or reuse another user's session token through profile previews, shared links or the API, and a password reset signs every old session out.
4. regression suite (risks: regulatory-penalty). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: After each release, privacy defaults for new teen and adult accounts match the approved settings list.
5. compliance checks (risks: regulatory-penalty). Tool class: test management. Usually run by: product manager.
   Done when: A signed review shows that an account registered with a minor's birth date starts private and cannot be messaged by strangers, and a sign-up with an under-13 birth date is blocked or sent to parental consent, with a screenshot for each market's rule.
6. analytics and event tracking tests (risks: regulatory-penalty). Tool class: proxy. Usually run by: product manager.
   Done when: A network capture shows phone numbers and emails collected for sign-in security never sent to advertising or analytics endpoints.
7. security scanning (risks: data-breach). Tool class: DAST scanner. Usually run by: security specialist.
   Done when: The scan of the apps and public API shows no open high-severity finding, and profile endpoints return no private field to a non-follower.
8. end-to-end functional tests (risks: store-rejection). Tool class: mobile automation. Usually run by: QA engineer.
   Done when: A reported post reaches the moderation queue, and a blocked user can no longer see or message the blocker, on iOS, Android and web.

Acceptance criteria wording:
A release of the social network is accepted when a new user can sign up, post, follow, report a post and block a user on iOS, Android and web, and every reported post reaches the moderation queue. A new account registered with a minor's birth date starts private and cannot be messaged by strangers, and teen and adult privacy defaults match the approved settings list. No session token can be obtained through profile previews, and phone numbers collected for sign-in security never reach advertising endpoints.

Report back for each test: pass or fail against its done condition, the build or version tested, and the proof (screenshot, log line or report file).

Licence: CC BY 4.0.

For founders: what to forward and what to ask back. For product managers: turning this page into tickets.

10Questions about testing a social network

11Evidence

1. ev-0320court-or-fineprimary

   Molly Russell: Prevention of future deaths report (Ref 2022-0315), HM Coroner, North London (Courts and Tribunals Judiciary)

   There was no age verification when signing up to the on-line platform.

   The coroner's report after a teenager's death lists no separation of child and adult content, no age verification and algorithm-driven content as matters of concern for social platforms. The report found that the platform's algorithms selected and provided images, video and text about self-harm and suicide to the teenager without her requesting them.

   published 2022-10-13 · verified 2026-10-07

2. ev-0321regulatorprimary

   Online Safety Act 2023, UK Government (legislation.gov.uk)

   The Act places duties of care on user-to-user services, including illegal content and children's risk assessments, overseen by the UK communications regulator.

   published undated · verified 2026-10-07

3. ev-0037standardprimary

   NIST SP 800-63B: Digital Identity Guidelines, Authentication and Authenticator Management, National Institute of Standards and Technology

   SP 800-63B sets requirements for authenticators, multi-factor authentication, session management and throttling of guessing attempts.

   published undated · verified 2026-10-07

4. ev-0317post-mortemprimary

   Security Update, Meta (Facebook Newsroom)

   This allowed them to steal Facebook access tokens which they could then use to take over people’s accounts.

   The company's own incident report says a flaw in the "View As" profile preview let attackers steal session tokens and take over accounts, a failure specific to social profile features.

   published 2018-09-28 · verified 2026-10-07

5. ev-0024regulatorprimary

   Children's Online Privacy Protection Rule (COPPA), U.S. Federal Trade Commission

   COPPA requires verifiable parental consent before collecting personal information from children under 13 on sites and apps directed to children or with actual knowledge.

   published undated · verified 2026-10-07

6. ev-0251regulatorprimary

   FTC Charges Twitter with Deceptively Using Account Security Data to Sell Targeted Ads, Federal Trade Commission

   Twitter asked users to give their phone numbers and email addresses to protect their accounts.

   Regulator action: phone numbers and emails collected for two-factor authentication and account recovery were used for ad targeting, breaching an earlier order. Transfers to identity providers, which collect the same MFA and recovery data for their customers' users.

   published 2022-05-25 · verified 2026-10-07

7. ev-0319regulatorprimary

   Irish Data Protection Commission announces [amount] fine of TikTok, Data Protection Commission (Ireland)

   The Irish regulator found infringements in how a social video platform processed children's data, including public-by-default settings, the family pairing feature and age verification at registration.

   published 2023-09-15 · verified 2026-10-07

8. ev-0001store-guidelineprimary

   App Review Guidelines, Apple

   Apple reviews every iOS, iPadOS and macOS App Store submission against these guidelines, including crashes and bugs at review, privacy disclosures, in-app purchase rules and extra rules for medical, financial and kids apps, and apps with user-generated content must let users report offensive content and block abusive users (guideline 1.2), and apps offering loot boxes or similar mechanisms must disclose the odds of each item type before purchase (guideline 3.1.1).

   published undated · verified 2026-10-07

12Disclaimer

This page lists tests and risks for a product category, not for your product. Risks are attached only with the evidence shown in the Evidence section. Tools are listed alphabetically and are not recommendations. Nothing here is legal, regulatory or security advice; where a regulator or a store sets a requirement, their page is linked and takes precedence.