Instagram asks you to confirm you are human: why on a clean profile

A human check arrives for the sum of small things read before your first click, not for any single action.

A residential address covers one of those small things. The browser clock, the language stack, the depth of the history and the rhythm of the first minutes stay in plain sight.

A human check is a state rather than a sentence: the account stays yours and the login waits for your answer.

Treating it as bad luck is a mistake. A repeat check on the same profile says the cause is still there, and it is cheaper to find it before the next login.

A browser with no page ever opened and no cookie at all is rare among living people. Instagram sees that emptiness in the first second.

So a new profile gets ordinary browsing before you type a login. Cookie robot in the profile menu builds that history: 30 public addresses of six kinds, and not one of them asks anyone to sign in.

The public addresses come in six kinds, the What to browse boxes in the robot window: search, news, shopping, reference, video and forums, everyday. A living person visits sites of several kinds in a day, and a history drawn from one kind alone would look poorer than an empty one.

On every site the profile does the same thing at a different pace: it opens the page, reads, scrolls down twice with a pause between the scrolls and lingers before leaving. You pick the reading time in the window, from 10 to 90 seconds per site, and in practice it drifts between six and fourteen tenths of that figure so that no two sites get the same rhythm.

The order of the sites is shuffled afresh before the run starts. The same history on two profiles would stand out more than no history at all.

The address says one country and the browser clock says another, and a platform catches that mismatch earlier than any fingerprint.

The exit country is asked of four independent providers over a secure connection. Your profile takes its timezone and its language order from that country, and 114 countries here carry a timezone and a language stack of their own.

1. 1

   The country is asked of four sources in turn

   Providers are tried in turn until one of them answers clearly.

2. 2

   The clock moves to that country

   A profile timezone follows the country its address comes from.

3. 3

   Languages follow the clock

   The language stack comes from the same country instead of staying English.

A proxy drops quietly: the page still opens, an address is still on screen, and it turns out to be your own.

The profile start page shows the exit address and says outright whether the proxy is working. It does not print your real address: that one only takes part in the comparison. When your own address is unknown there is no verdict at all, because an invented «all good» is worse than a blank line.

The page a profile opens first is served by the program itself from a local address, not from a server on the internet. Nobody outside learns that a profile was launched.

The only request it sends out is the address check, and that one travels through the profile's own proxy. So the address on this page is exactly the one a platform will see.

The page address carries a random key for a single launch. Another program on the same machine cannot walk through the profiles by number and read their data.

A list of third party counters does not help where a platform follows you with its own requests from its own address.

Social platforms have 21 such paths, and 11 of them belong to Meta. Two entries among those eleven tie a Facebook account to an Instagram one. When exactly they are sent is not visible from outside, and we did not measure it.

On top of those paths Meta has six domain rules in the social counter list. The host lock holds the paths, while domain rules apply everywhere: a rule carrying a slash will cut such an address on somebody else’s site too.

Profiles that signed in within one minute at an even spacing read as one script behind all of them. A bulk launch therefore waits 3 to 14 seconds before every opening after the first.

A fresh account is also helped by a daily ceiling: on the Social media scenario the Safe pace bar on the profile card gives 200 pages a day, day one opens a fifth of it, and the full ceiling arrives on day seven.

The daily ceiling for social work is 200 pages, but a new account gets only a fifth of it on day one. The share grows day by day and reaches the full ceiling on day seven.

The ceiling is a hint rather than a lock: the program counts the day's opened pages and highlights the approach to the threshold, and the decision stays with you. It will not stop you at the line.

None of the steps below promises that the check will stay away. Each removes one reason, and together they change the picture the platform sees at login.

Order matters here: the profile collects its history before the login rather than after, and you check the address before you type a name.

1. 1

   Check the exit address

   Compare it with your own on the profile start page.

2. 2

   Match the clock and the languages

   Timezone and language order have to agree with the address country.

3. 3

   Give the profile a history

   Ordinary browsing across public sites, with no login anywhere.

4. 4

   Do not sign in all at once

   Keep day one inside a fifth of the daily ceiling.