Meta’s child-safety deal exposes a privacy problem

Meta’s settlement with US states marks a major shift in the debate over children’s online safety. For years, social media companies largely offered optional controls and left families to decide whether to use them. Meta will now place firm restrictions on teenage Facebook and Instagram accounts by default.

The company agreed to pay as much as $16.7 billion to 47 states, Washington, DC, and three US territories. A separate Texas settlement takes the total potential cost to nearly $18 billion. Meta denied wrongdoing in settling claims that it designed its platforms to encourage compulsive use among children and misled users about their safety.

Under the agreement, users under 18 will face a combined two-hour daily limit across Meta’s apps. Access will be blocked between midnight and 6am, while features including visible “like” counts will be restricted. Parents can loosen some controls. Most measures will operate in the US for 10 years.

These are significant changes. Their effectiveness, though, depends on Meta answering a difficult question: how does a social media platform reliably identify a child without collecting more information from everyone?

Every user may face an age check

Meta has one year to determine which users are between 13 and 17. It must also strengthen efforts to remove children under 13, who are not permitted to hold accounts.

That requires the company to assess adults as well as children. A system cannot separate teenagers from adults unless it checks, estimates or verifies the ages of the wider user base.

Possible methods include government identification, facial analysis through selfies and estimates based on account activity. An unverified adult could be placed under teenage restrictions until the account holder proves their age.

Each method creates a different problem. Passports and driving licences provide strong evidence, but require users to hand sensitive documents to a platform or an outside contractor. Facial analysis avoids identity papers, but introduces questions about biometric information. Estimating age from activity means analysing more of what a person views, searches for and shares.

A previous breach involving an outside age-verification provider potentially exposed government identification belonging to 70,000 Discord users. It demonstrated that collecting identification to improve online safety can create another valuable target for criminals.

The Meta settlement limits data collection to what age estimation requires and allows adults wrongly classified as children to appeal. Those protections reduce some risk. They do not remove the central tension between accurate verification and personal privacy.

Safety is becoming a design requirement

The agreement’s wider importance lies in its treatment of platform settings. It moves child protection away from optional tools and towards restrictions built directly into the product.

This matters because a feature has little effect when users must find and activate it themselves. Instagram’s earlier “take a break” prompt attracted low usage among teenagers. Even after it became a default feature, users could dismiss the reminder and continue scrolling.

A two-hour limit and a night-time block are harder to ignore. They establish that platforms can be required to change how their products operate, not merely publish advice or offer parents another settings menu.

The settlement does not redesign every disputed feature. Video autoplay and chronological feeds remain optional choices. Critics also say the agreement does not switch off recommendation systems by default, even though these systems decide which videos, images and accounts teenagers see.

Time limits regulate the length of exposure. They do not fully address the nature of the material delivered during those two hours. This distinction could shape the next stage of social media regulation.

Parents receive control — and responsibility

Meta will allow parents to adjust some restrictions. That recognises that a 13-year-old and a 17-year-old may require different limits.

Yet parental consent only works if Meta can confirm that the supervising adult is genuinely the child’s parent or guardian. The settlement does not require birth certificates or identification from parents. An older sibling or another person could potentially pose as a guardian.

Giving parents override powers also transfers part of the responsibility from Meta to families. If a parent removes a limit and a teenager experiences harm, future disputes may focus on the parent’s decision rather than the original platform design.

Parents need useful controls, but controls cannot replace a safe product. Families do not know how recommendation systems rank content, measure engagement or decide what appears next. They cannot manage risks that remain invisible to them.

A model other countries may follow

The settlement applies in the US, but its influence is already spreading. The European Commission has preliminarily found that the design of Facebook and Instagram breached the EU’s Digital Services Act, citing features such as endless scrolling, personalised feeds and automatic video playback. It has asked Meta to propose ways to reduce risks to children.

Europe is examining a more privacy-focused verification system in which an independent party checks a person’s age and gives the platform only a yes-or-no answer. The social network would not receive the user’s identity or exact age.

That model could offer a better balance than allowing each platform to collect and retain verification data. It will still need to prove that it works at scale and cannot easily be bypassed.

Meta’s settlement establishes that child-safety restrictions are technically possible. It does not settle how age should be verified, which features cause harm or how much control parents should hold.

Its lasting impact will depend less on the size of the payment than on whether regulators can make platforms safer without requiring every user to surrender more of their identity.