Meta settles US child safety case for $16.68
Meta has agreed to a $16.68 billion settlement with multiple US states over child safety concerns related to Facebook and Instagram, including alleged
Meta has agreed to pay up to $16.68 billion to settle claims brought by multiple US states concerning alleged harms linked to Facebook and Instagram. The states alleged that Meta designed Instagram and other platforms to attract and retain children, despite known risks. They also alleged that Meta misled users about safety and violated laws governing children’s data. Meta denies the allegations and liability. The settlement also includes a separate $459.3 million Cambridge Analytica-related privacy claims.
The agreement imposes a range of obligations on Meta, starting with an age assurance framework that must be adopted within one year from the effective date. Meta must assess users in the settling states as Teen Users or U13 Users, with new users receiving default protections until assessment. Every age-assurance method must undergo annual testing by an accredited third party, covering accuracy, demographics, privacy, security, circumvention, and technical reliability. Meta must also incorporate reliable age signals shared by Apple and Google.
Accuracy thresholds are set at 10% false positives for ages 16-17 and 3% for ages 13-15 within one year for commercial methods, and 14% and 7% for proprietary methods in year one, falling to 10% and 5% in year two. Within six months, Meta must strengthen U13 detection through soft matching, age indicators, simplified reporting, and reviews of deleted accounts’ friend networks. It must develop and initially test a U13 Age Model within one year, use the model across all Meta SMP accounts within two years, and set annual enforcement targets.
Meta must limit completed user-selected age-assurance attempts to three daily, four monthly, and six over two years. It must investigate circumvention and improve detection of new bypass methods. Age-assurance data must be minimized and secured, with U13 data not supporting advertising, marketing, or algorithmic optimization. Retainable data must be deleted within 90 days when no longer required. Users wrongly identified as minors need a clear appeals process. Unassessed users receive default protections for 14 days, then generally receive teen protections. Meta must review the framework at least annually.
The agreement creates two phases. Phase I lasts five years from the compliance date. Phase II applies if industry-wide adoption occurs within 10 years. During Phase I, teens receive a default midnight to 6 AM access block, with push notifications stopping from 10 PM to 7 AM. Messaging and settings remain available during the block, but users cannot use them to access otherwise restricted features. Parents must approve less restrictive settings. Phase II extends the access block to 10 PM-7 AM.
Daily limits also apply: Phase I allows two cumulative hours across Meta SMPs, while Phase II caps usage at 60 minutes per Meta SMP, capped at 120 minutes collectively. Messaging and long-form content do not count towards the limit. Linked and soft-matched accounts share the applicable limit.
During School Hours, push notifications must be disabled. Parents can alter School Hours and restrict everything except messaging. Within four months, Meta must add pauses at 60 and 90 minutes and show a notice after every 15 minutes of continuous use. The company must provide efficacy data to the auditor, conduct research, and consult experts. It must continue improving soft matching and apply limits across identified secondary accounts.
Within four months, teens must receive a reasonably accessible option to make a Non-Personalised Feed their default home feed. Meta must prompt newly identified teens within 10 days and repeat the prompt every 90 days. Parents can enable the feed and other Optional Protective Settings.
Meta must also hide like and reaction counts from teens by default, require parental approval for changes, and disable Cosmetic Procedure Filters for teens.
Meta must maintain measures limiting Age Inappropriate Content and bullying-related content, limit repeated exposure to Sensitive Aggregate Content, and default teens into Age Appropriate Experiences. Parents can impose stricter settings. During the agreement term, those protections must remain at least as effective. Meta must regularly assess exposure, conduct user research, and consult experts. It must adjust policies or implementation where existing measures fail to address harmful content or experiences.
Meta cannot make false, misleading, or deceptive claims about teen safety features. Enforcement requires State Committee approval and 30 days’ notice.
Teen users must have in-app reporting tools covering illegal or unwanted content. For specified harmful reports in English or Spanish, Meta must provide decisions within six hours in at least 90% of cases. It must provide appeal outcomes where applicable.
Meta must maintain protections against Potentially Suspicious Accounts, including limiting discoverability, defaulting Instagram teens to private accounts, and providing reporting and blocking tools. It must regularly assess harmful experiences, conduct research, and consult experts. It must revise policies where existing measures fail to address harm.
When teens message Potentially Suspicious Accounts, Meta must provide clear warnings. Parents must receive warnings about accounts potentially involved in financial blackmail or inappropriate interactions with children. Relevant resources must also be provided.
Parents must receive information about teen usage, messaging, long-form content, and social connections. They must also receive alerts about repeated searches involving suicide, self-harm, and eating disorders. They must receive daily notifications when teens first communicate directly with each adult user. Meta must prompt settings reviews and periodically suggest check-ups. It must also continue encouraging parental-supervision enrolment.
Parents must be notified about linked or soft-matched secondary accounts. Approved restrictions must apply across those accounts. For changes to default time settings, parents must choose today, one week, 30 days, or until changed. Meta must also strengthen controls verifying supervising adults as parents or guardians.
Meta and the State Committee must select an independent auditor within 60 days of the effective date. The auditor will assess implementation of the injunctive provisions, including Meta’s data, methodologies, and metrics. The parties must agree a work plan within 90 days of appointment. Meta must provide relevant non-privileged information, systems, records, and personnel.
The auditor will issue periodic reports and can make non-binding recommendations. Where final reports identify material weaknesses, Meta must prepare corrective plans within 30 days and begin implementing approved plans within 90 days. The auditor’s term ends 120 days after its fifth final report. Meta must retain audited records for five years and pay reasonable audit costs.
Questions for Meta: MediaNama reached out to the company with the following questions. The article will be updated when we receive a response:
- Will Meta roll out the safety and age-assurance measures required under this settlement globally, or will they apply only in the states involved?
- Does Meta intend to apply the settlement’s protections to users in India even though the agreement is limited to the settling US states? Which of the settlement’s measures does Meta plan to extend to Indian users?
- If Meta is implementing these changes on Instagram and Facebook in India, what is the expected timeline for the rollout?
Decoding Meta’s Teen Engagement Strategy Through Internal Documents Revealed In Landmark US Trial
Meta expands parental controls, giving families a window into teens’ Instagram algorithms Read Reasoned by Nikhil Pahwa: How AI is changing our world
