For its first two and a half years, Facebook would only let you in if you had a college, and later a work, email address — an @stanford.edu or an @yourcompany.com was the price of admission. On September 26, 2006, that gate came down. According to Facebook’s own newsroom announcement, anyone with a valid email address could now create an account, no institutional affiliation required. It was a six-word policy change with an outsized consequence: the platform’s entire identity as a private club was over.

What Actually Changed That Day

Before the September 2006 update, Facebook required a .edu, .com, .org, .gov, or .mil address tied to a specific school or employer to even register. The new policy replaced that with a single requirement: a working email address, plus verification through a mobile phone number. Facebook simultaneously rolled out more than 500 new regional networks so people without a school or company tie could still find a local community inside the platform. Mark Zuckerberg framed it in the company’s own release as a response to outside pressure, saying plainly, “we are expanding to respond to the requests of millions of people who want to be part of Facebook, but haven’t been able to until today.”

 

College Networks Didn’t Disappear

Facebook didn’t fully dissolve its original structure — it layered a public option on top of it. Users could still join and search within college or workplace networks, but only after proving that affiliation, according to the company’s own release. The distinction mattered to early users who valued the platform precisely because it had felt exclusive. To soften that shift, Facebook rolled out new privacy controls alongside the expansion: members could now block specific people or entire networks from finding their profile in search, stop unwanted messages, pokes, and friend requests from outside their circle, and limit who could see their profile picture. Those were the first real privacy settings Facebook ever shipped, introduced at the exact moment the site stopped being a closed system.

The mobile-verification step is easy to skim past now, but at the time it was doing real work. Requiring a phone number gave Facebook a way to slow down mass fake-account creation the moment it dropped the school-email requirement that had functioned, almost by accident, as an identity check for its first two and a half years. Pair that with the more than 500 new regional networks the company stood up the same day, and the September 2006 release reads less like a single feature update and more like Facebook quietly rebuilding, from scratch, the trust system it was about to give away.

An Age Limit the Press Release Didn’t Mention

Facebook’s own announcement focused on email and phone verification but never stated an explicit age floor. Independent reporting filled that gap. A timeline of Facebook’s first decade, syndicated by Phys.org, records the same month plainly: “September 2006: Facebook begins letting anyone over 13 join.” That thirteen-and-up threshold — now a fixture of nearly every major social platform’s terms of service — traces directly back to this single expansion, not to any later, more publicized policy fight.

The Same Month, a Bigger Controversy Landed

September 2006 turned out to be a genuinely loaded month for Facebook, and the open-registration announcement wasn’t even the part users got angriest about. That same September, the company also introduced News Feed, the feature that collected friends’ posts and activity into one continuous stream on the homepage. Per Phys.org’s timeline, News Feed “leads to complaints about privacy” almost immediately — users who were fine with strangers technically being able to join the platform were furious that their own friends could now see, all in one place, exactly what they’d been doing on it. The backlash was loud enough that it briefly overshadowed the open-door policy shipped the very same month.

The Trade Nobody Fully Clocked at the Time

Opening registration and shipping News Feed in the same month wasn’t a coincidence so much as a preview of the platform Facebook was about to become: bigger, more public, and far more visible to everyone in your life at once. The privacy controls the company bundled into that September release were an attempt to manage exactly that tension, and they were never quite enough to fully satisfy either side. Twenty years on, that’s still the trade every major social platform is negotiating — more people in the room, in exchange for less control over who’s watching.