Meta's $18 Billion State Settlement Includes a Broad Legal Release on Children's Data
Meta has settled with 47 states, the District of Columbia, Puerto Rico, American Samoa, and the Northern Mariana Islands for up to $18 billion — and as part of the deal, those states agreed not to sue Meta under existing child safety laws over how it retains and uses children's data. TechCrunch
Reported dollar figures vary by outlet, but the variation reflects the settlement's cap-based language rather than contradictory facts. Reuters cited $16.68 billion, the New York Times reported up to $17.1 billion, and CBC reported more than $16.7 billion in direct payments to states alongside the $18 billion ceiling. The case began as a lawsuit brought by 29 states over social media harms to children. Georgia's attorney general called it the largest Big Tech settlement in history, and Fortune characterized it as the biggest tech settlement to date. Reuters; NYT; CBC
The legal release is sweeping. The state attorneys general agreed "fully, finally, and forever" not to bring any past, present, or future claims under COPPA — the Children's Online Privacy Protection Act, a federal law that restricts how companies collect data from children under 13 — or under similar state laws, related to Meta's use of children's data. TechCrunch COPPA is primarily enforced by the Federal Trade Commission, not the states. The FTC is not a party to the settlement, which means the federal government retains its enforcement authority regardless of what the states agreed to.
The settlement also imposes concrete product obligations. Meta cannot use data from users under age 13 for ad targeting, marketing, or algorithmic optimization — the behind-the-scenes process that decides what content and ads a user sees. The company must develop, train, and begin testing a machine learning model to detect which users on its platforms are under 13 within one year of the document's effective date. Per the settlement agreement exhibit posted by the DC Attorney General, Meta commits to developing, training, and conducting initial testing of an "age assurance model prototype" designed to predict whether users are under 13. DC OAG
Meta already uses AI-based age detection and age-estimation tools and places teens in accounts with built-in safety features, according to a company spokesperson. Reuters The settlement does not specify whether the required age assurance model would replace existing systems or operate alongside them.
On the product-design side, Meta will impose daily usage limits and restrict nighttime usage by children who use Facebook and Instagram, and enhance measures to prevent social media harms. An independent auditor will monitor Meta's compliance with the settlement. Reuters
Reuters reported that the remedies cited by the attorneys general focus on greater parental controls, time limits, and boosting efforts to detect minors. A whistleblower told Reuters the settlement falls short on teen mental-health protections. Reuters The agreement is subject to court approval. Colorado AG
The structural detail worth pausing on is the scope of the legal release. The states surrendered their ability to bring COPPA and similar state-law claims over Meta's use of children's data, but the FTC — COPPA's primary enforcer — sat outside the agreement entirely. That leaves a regulatory landscape where Meta has purchased peace with a large bloc of state attorneys general while federal enforcement authority remains intact and unencumbered. Whether the FTC exercises that authority is a separate question, but the settlement does not constrain it.
The age-assurance obligation is also notable as a legally mandated machine learning development milestone. Meta must build, train, and begin testing a model within a year of the effective date, with an independent auditor verifying compliance. That is a binding product-development deadline imposed by litigation rather than internal roadmapping. For a company that already deploys AI-based age estimation, the incremental technical lift may be modest, but the compliance architecture around it is now externally enforced.
The settlement's financial figures span a range because the agreement uses the formulation "up to $18 billion," with different outlets reporting different anchor numbers based on their reading of the payment structure.
In this author's view, the most consequential element here is not the dollar figure, however large. It is the trade-off: states secured product-design concessions and a financial payout, but in exchange they closed off a category of future litigation over children's data practices. If the FTC does not step into the gap, the primary enforcement lever over Meta's handling of children's data will have shifted from active litigation to auditor-monitored compliance with a settlement whose remedies a whistleblower has already called insufficient. That is a bet that structured oversight outperforms the threat of lawsuits, and it is a bet whose outcome will not be visible for some time.
