Meta’s $18 Billion Multi-State Settlement Includes Limited Exemption for Training Age-Detection Systems

A recent settlement between Meta and attorneys general across 29 states involves payments of up to $18 billion, new child safety requirements, and a targeted legal provision concerning the handling of minors’ data. Under the agreement, participating states have granted Meta an exemption from lawsuits under existing child safety laws regarding the retention and use of children’s data, strictly for the purpose of building and refining age-assurance systems.

What Happened

Attorneys general from 29 states reached an agreement with Meta requiring the company to pay up to $18 billion and introduce enhanced child safety protections. Alongside these terms, the settlement establishes that the states agree “fully, finally, and forever” not to pursue past, present, or future claims under the Children’s Online Privacy Protection Act (COPPA) or comparable state laws regarding Meta’s use of children’s data for age assurance.

As part of the mandate, Meta must develop, train, and begin testing an age-assurance model designed to detect platform users who are under 13 years old. The settlement sets a timeline requiring this process to start within one year of the agreement’s effective date. While the text does not mandate artificial intelligence, Meta’s existing age-detection systems operate on AI technology.

Key Highlights

• Financial Terms: Meta is paying out up to $18 billion as part of the multi-state agreement.
• Strict Use Boundaries: The settlement expressly forbids Meta from using information from users under 13 for advertising targeting, marketing initiatives, or algorithmic optimization.
• One-Year Deadline: Meta must build, train, and test an age-detection model to identify under-13 users within 12 months of the document taking effect.
• Independent Oversight: An independent auditor will monitor Meta’s adherence to the data limits and technical guardrails.
• Limited Immunity: The covenant not to sue applies only within the bounds of training and testing age-assurance tools; violations outside those boundaries remain subject to legal action.

Why This Matters

Under U.S. federal law, COPPA typically mandates that online services limit the collection and storage of personal information belonging to children. The agreement maintains that Meta should not need to breach COPPA to train these models, yet provides a carve-out against state-level enforcement to facilitate age-assurance mechanisms.

Legal experts observe both common practice and regulatory complications in this structure. Philip N. Yannella, partner and co-chair of Blank Rome’s Privacy, Security & Data Protection practice, noted that such data minimization guardrails are common in privacy compliance, such as verifying deletion requests. However, Yannella pointed out that COPPA is primarily enforced at the federal level by the Federal Trade Commission (FTC), which is not a party to this state settlement.

Technical and legal challenges also surround data isolation. Isolating behavioral signals and data exclusively for age detection within complex tech infrastructures can be difficult. Peter Jackson, a Data & IP attorney at Greenberg Glusker LLP, indicated that the carve-out could disincentivize future enforcement actions, remarking that the measures show signs of “a heavy, and perhaps hasty, negotiation.” Conversely, Joshua Wurtzel, a partner at Schlam Stone & Dolan LLP, highlighted that legal claims remain viable if Meta steps beyond the agreed terms, as the covenant not to sue would no longer apply.

What to Watch Next

Meta is required to launch the development, training, and testing of its age-assurance tool within one year of the settlement’s effective date. Throughout this deployment, an independent auditor will evaluate Meta’s technical isolation of children’s data to ensure it is not repurposed for marketing, ad targeting, or algorithmic optimization. Observers will also look to see whether the Federal Trade Commission takes any separate stance or regulatory action under federal COPPA authority.

Frequently Asked Questions

What are the primary restrictions placed on children’s data under the agreement?

Meta is prohibited from deploying data gathered from users under the age of 13 for any advertising targeting, marketing purposes, or algorithmic platform optimization.

Does the agreement protect Meta from all federal COPPA enforcement?

No. The settlement was reached with 29 state attorneys general. COPPA is a federal statute primarily enforced by the Federal Trade Commission (FTC), which is not a party to this agreement.

Can states still sue Meta if the data is misused?

Yes. As noted by legal counsel, if Meta uses children’s data outside the specific boundaries established for age detection, the release and covenant not to sue do not apply.

Source: Information reported by TechCrunch.