Meta has agreed to a proposed settlement worth up to approximately $18 billion over allegations that Facebook and Instagram were designed to encourage compulsive use among children and teenagers.
Still awaiting court approval, the agreement with a bipartisan coalition of state attorneys general would resolve a lawsuit filed in 2023.
The lawsuit accused Meta of misleading families about potential risks to young users and illegally collecting data belonging to children under 13.
For me, one of the more interesting parts of the settlement is that it goes beyond just financial penalties. Meta will also have to change how teenagers can use Facebook and Instagram.
Meta agrees to new restrictions for teens
Under the agreement, users under 18 will have a default two-hour daily usage limit that can only be disabled with parental permission.
Meta will also restrict teen access between midnight and 6 a.m. by default. Most notifications will be muted overnight and during school hours, although parents can modify those settings.
Other changes address how content is presented to teenagers. Like and reaction counts will be hidden, while cosmetic surgery filters will be blocked. Teenagers will also have access to a non-personalized feed.
John Strand, owner of Black Hills Information Security, views the restrictions as a form of harm reduction rather than a complete solution.
“Are the proposed controls limiting how much young people can use social media going to be 100 percent effective? Of course not. But that’s really not the point,” Strand said in an email to eSecurityPlanet.
“The point is harm reduction,” he added. “Can we reduce the amount of harm being done to children by technologies that have been deliberately designed to keep them engaged for as long as possible? I think we can. And I think we should.”
Most of the protections are expected to remain in place for 10 years, and an independent auditor will oversee Meta’s compliance.
Age verification creates its own privacy concerns
The settlement also requires Meta to deploy additional age-verification technology to identify users under 18 and remove children under 13.
This is where I think the agreement raises an important privacy and cybersecurity question.
Platforms need a reliable way to determine whether someone meets an age requirement, but collecting more sensitive identity information to do that can create another target for attackers.
Raj Ananthanpillai, CEO at Trua, cautioned against requiring users to repeatedly provide identity documents or biometric information.
“Requiring people to repeatedly upload driver’s licenses, passports, facial scans, or other personal information simply creates more vulnerable databases filled with sensitive data,” Ananthanpillai told eSecurityPlanet. “That may help answer the age question, but it also increases privacy and security risk for everyone.”
Instead, he recommends an approach that verifies a person’s age without repeatedly exposing the information used to establish it.
“A platform should be able to confirm that someone meets an age requirement without learning their birth date or collecting a copy of their identity documents,” Ananthanpillai said.
Settlement could extend beyond Meta
Meta said the agreement includes approximately $18 billion in payments over 10 years, with participating states set to receive roughly $12.7 billion.
Another $5.3 billion is contingent on YouTube and TikTok adopting similar protections and making matching payments. If both companies participate, the default daily usage limit for teenagers would drop from two hours to one.
Meta said the structure is intended to encourage consistent protections across the social media platforms teenagers use.
California is expected to receive between $1.5 billion and $2.1 billion. State officials said a portion of that money is earmarked for addressing harms to young Californians associated with social media use.
Meta also expects to record approximately $10 billion in legal expenses related to the agreement during the third quarter of 2026.
The settlement could ultimately have implications beyond Facebook and Instagram.
As lawmakers push for stronger protections for minors, social media platforms will need to ensure age verification does not create additional privacy and security risks.