Meta gains legal immunity for children's data in $18 billion state settlement

Meta has reached an $18 billion settlement with 29 U.S. states to resolve allegations that its social media platforms caused harm to children. The agreement includes a controversial provision that grants the company a legal carve-out to retain and use data from children under 13 for a specific purpose: training and testing age-detection models.

Under the terms of the deal, Meta will pay up to $18 billion and must develop and test a model to detect users under 13 within one year of the settlement's effective date. In a significant legal concession, state attorneys general have agreed "fully, finally, and forever" not to bring past, present, or future claims under the Children's Online Privacy Protection Act (COPPA) or similar state laws regarding the use of this data for age-assurance technology. To prevent abuse, the agreement explicitly prohibits Meta from using this under-13 data for marketing, ad targeting, or algorithmic optimization, and an independent auditor will monitor the company's compliance.

The Age-Verification Dilemma

This settlement follows a wave of lawsuits from nearly 30 states alleging that Meta's platforms were designed in ways that harmed young users. A central part of the resolution is the implementation of technology to identify and remove users under 13. However, creating effective age-verification tools typically requires access to the very type of sensitive data that COPPA and various state privacy laws are designed to protect. By granting this "pass," the states have allowed Meta to use restricted data to build the tools meant to enforce the age limit.

A Risky Legal Precedent

The deal creates a significant precedent where a corporation is granted immunity from privacy laws to develop the mechanisms used to comply with those same laws. While the settlement includes guardrails, legal experts and critics suggest that isolating this specific data from Meta's broader advertising and optimization systems is technically challenging. Furthermore, the broad release of claims may disincentivize future state-level enforcement if the data is misused.

Joshua Wurtzel, a partner at Schlam Stone & Dolan LLP, noted that the protections are conditional, stating that if Meta uses the data outside the agreed-upon lines, the covenant not to sue would no longer apply.

Unresolved Federal Oversight

Despite the agreement with the states, the company's total legal exposure remains unclear. Philip N. Yannella, a partner at Blank Rome, pointed out that COPPA is a federal law primarily enforced by the Federal Trade Commission (FTC) rather than the states. It remains unconfirmed whether the FTC has agreed to a similar compromise, meaning Meta could still face federal challenges over its handling of children's data even as it settles with state authorities.