Meta's $18B settlement quietly grants it a pass on children's data rules
Meta's settlement with 29 state attorneys general includes a clause barring states from suing over children's data use tied to building an age-detection model. Lawyers warn the carve-out could be hard to enforce.
Meta has reached a settlement with attorneys general from 29 U.S. states that includes payments of up to $18 billion and new child safety commitments. Tucked into the agreement, however, is a less-discussed provision: the states agree not to sue Meta under existing child safety laws over how it retains and uses children's data, as long as that use is tied to training and testing an age-detection model.
Under the settlement, Meta must develop and begin testing, within a year of the agreement taking effect, a model capable of identifying users under age 13 on its platforms. The agreement doesn't require the model to be AI-based, though Meta's existing age-assurance tools already rely on AI.
A carve-out from COPPA
The U.S. Children's Online Privacy Protection Act (COPPA) generally limits how much personal data can be collected and retained from children. The settlement states that Meta shouldn't need to violate COPPA to build or run its age-assurance system, but it also includes a commitment from the state AGs never to bring COPPA claims, or claims under similar state laws, over this specific use of children's data. The agreement does explicitly bar Meta from using data on under-13 users for ad targeting, marketing, or algorithmic optimization.
Attorneys say this kind of arrangement isn't unusual in privacy settlements, since data-minimization guardrails are common compliance tools. However, they note that COPPA is chiefly enforced by the Federal Trade Commission rather than the states, and it's unclear whether the FTC — which isn't part of this settlement — has agreed to a similar compromise. Keeping a specific dataset technically and organizationally separate from the rest of a company's systems is also notoriously difficult in practice.
An independent auditor will monitor Meta's compliance with the settlement, offering some outside oversight. Still, the agreement doesn't specify how much behavioral data Meta may retain for training, how long it will be kept, or how the model might evolve over time. Legal experts caution that giving up the right to sue over this narrow use could complicate future efforts to challenge Meta's handling of children's data — though if Meta strays outside the agreed limits, the liability waiver would no longer apply.
