Meta Agreed to Pay States Up to $18 Billion — and Got Legal Cover on Kids' Data
Meta has agreed to pay up to $18 billion to settle a lawsuit from 47 states, the District of Columbia, Puerto Rico, American Samoa, and the Northern Mariana Islands over social media harms to children. As part of the deal, those states agreed not to sue Meta under existing child safety laws for how it handles children's data. TechCrunch
The exact dollar amount depends on how you read the agreement's fine print. The settlement uses the phrase "up to $18 billion," and different news outlets landed on different numbers. Reuters cited $16.68 billion, the New York Times reported up to $17.1 billion, and CBC reported more than $16.7 billion in direct payments to states alongside the $18 billion ceiling. The case started as a lawsuit brought by 29 states. Georgia's attorney general called it the largest Big Tech settlement in history, and Fortune called it the biggest tech settlement to date. Reuters; NYT; CBC
The legal release in the settlement is broad. State attorneys general agreed "fully, finally, and forever" not to bring any past, present, or future claims under COPPA — the Children's Online Privacy Protection Act, a federal law that limits how companies collect data from children under 13 — or under similar state laws, related to Meta's use of children's data. TechCrunch COPPA is mainly enforced by the Federal Trade Commission (FTC), a federal agency, rather than by states. The FTC was not part of the settlement, which means the federal government can still take action against Meta no matter what the states agreed to.
The settlement also requires Meta to change how its products work. Meta cannot use data from users under age 13 to target ads, do marketing, or run the automated systems that decide what content people see. The company must also build and start testing a computer model that can detect which users on its platforms are under 13, within one year of the settlement's effective date. According to the settlement agreement exhibit posted by the DC Attorney General, Meta commits to developing, training, and conducting initial testing of an "age assurance model prototype" designed to predict whether users are under 13. DC OAG
Meta already uses AI-based age detection and age-estimation tools and places teens in accounts with built-in safety features, according to a company spokesperson. Reuters The settlement does not say whether the required age detection model would replace existing systems or work alongside them.
On the design side, Meta will impose daily usage limits and restrict nighttime usage by children on Facebook and Instagram, and strengthen measures to prevent social media harms. An independent auditor will monitor whether Meta follows through. Reuters
Reuters reported that the attorneys general highlighted remedies focused on greater parental controls, time limits, and improved efforts to detect minors. A whistleblower told Reuters the settlement falls short on teen mental-health protections. Reuters The agreement is subject to court approval. Colorado AG
The detail worth pausing on is the scope of the legal release. The states gave up their ability to bring COPPA and similar state-law claims over Meta's use of children's data. But the FTC, which is the main enforcer of COPPA, was not part of the agreement at all. That means Meta has bought peace with a large group of state attorneys general, while the federal government's enforcement power is untouched.
The age-detection requirement is also notable. Meta must build, train, and start testing a model within one year, with an independent auditor checking compliance. That is a legally binding product deadline set by a lawsuit, not by Meta's own planning. For a company that already uses AI-based age estimation, the technical work may not be huge, but the oversight around it is now enforced from the outside.
In my view, the most important part of this story is not the dollar amount, large as it is. It is the trade-off. States got product changes and a payout, but they gave up a whole category of future lawsuits over children's data practices in return. If the FTC does not step into that gap, the main way to hold Meta accountable for how it handles children's data will have shifted from lawsuits to auditor-monitored compliance with a settlement that a whistleblower already says does not go far enough. That is a bet that structured oversight works better than the threat of legal action — and it is a bet whose results will not be clear for some time.
