Problem Statement: A Read-Amplification Machine With a Privacy Contract
Frames the feed as a read-heavy fan-out system whose correctness is defined by privacy, not just latency.
Problem statement
Design the Facebook News Feed: a personalized, ranked stream of stories (text, photos, videos, links, live events) generated by the people and pages a user connects to. The system must accept post creation with media, distribute each post to the right audience using privacy controls (public, friends, friends-except, custom lists, only-me), assemble a fresh ranked feed in sub-second time for billions of daily readers, and propagate engagement (likes, comments, shares) into counters, ranking features, and notifications.
The defining property of this system is its asymmetry. One write (a post) can become hundreds of read-side artifacts (feed entries), while one read (a feed fetch) must touch hundreds of candidate stories, hydrate them, filter them by privacy, and rank them with machine learning before the first byte returns. Facebook publicly describes ranking more than a thousand candidate stories per user per day for more than two billion people, in real time [[59]]. The TAO paper describes a social graph store processing a billion reads per second with millions of writes [[10]]. This is not a CRUD app; it is a read-amplification machine wrapped in a privacy contract.
Why the problem is distinctive
A messaging system retries a delivery. A feed system must decide, on every read, whether a viewer is allowed to see a story at all, using the author's privacy setting at publish time, block relationships, restricted lists, and page-level rules. Fan-out caching makes reads fast but creates a correctness hazard: a cached feed entry can leak a post to a viewer who lost access (unfriended, blocked, list changed). A strong design therefore separates the fast path (cached candidate IDs) from the correctness path (read-time ACL enforcement), and treats stale fan-out as normal, not exceptional.
The second distinctive property is the celebrity problem. A page with tens of millions of followers cannot push a feed entry to every follower on write without creating a write storm; a normal user with two hundred friends should not force read-time merging of hundreds of authors. The industry answer, used by Twitter and others, is a hybrid: push for ordinary authors, pull for high-fan-out authors, merge at read time [[26]].
Public operating baseline versus design assumptions
Public figures anchor the scale. Facebook reports 2.11 billion daily active users [[2]]. Meta's family of apps reached 3.58 billion daily active people in December 2025 [[1]]. Facebook users generate roughly 4.5 billion likes and 350 million photo uploads per day by long-standing public statistics [[52]]. TAO reported a billion reads per second at a 96.4% cache hit rate in 2013 and over ten billion reads per second by 2021 [[15]]. News Feed ranking consumes trillions of story rankings per day by Facebook's own description [[67]].
For capacity planning this answer additionally assumes: seven feed sessions per DAU per day, one billion original posts per day, an average of 250 friends per user, a 500-story candidate mailbox per user, and a three-times peak multiplier. Unless cited, every number is a stated assumption, budget, or target.
The four planes of the design
- Write plane: post intake, media pipeline, ACL attachment, and fan-out into mailboxes.
- Read plane: candidate gathering (push mailbox plus pull authors), hydration, privacy filtering, ranking, and pagination.
- Graph plane: friendship edges, follow edges, blocks, lists, and ACL storage with TAO-style caching.
- Learning plane: engagement events, feature store, model training, and ranking model serving.
Keeping these planes separate lets the read path degrade (fewer candidates, simpler ranking) without ever weakening the privacy contract.
Key Highlights
- •News Feed is read-amplification: one post write becomes hundreds of feed artifacts; one feed read scores hundreds of candidates.
- •Facebook ranks 1,000+ candidate stories per user per day for 2B+ people in real time; TAO serves billions of graph reads per second.
- •Cached fan-out is fast but can leak; privacy must be enforced at read time over cached candidates.
- •Hybrid fan-out (push for normal authors, pull for celebrities) is the industry-standard write/read balance.
- •The design has four planes: write, read, graph, and learning; degradation must never weaken the privacy contract.
Section Rescue Kit
Buzzwords to use:
Safe statements:
- "I will separate latency (cached candidates) from correctness (read-time visibility) before choosing stores."
- "Let me quantify read versus write amplification first, because it decides push, pull, or hybrid."