Meta has committed to bolstering the ways it determines whether people on its platforms are the ages they claim to be, under terms of an $18 billion settlement announced on Aug 26 with multiple U.S. states. The agreement is part of efforts to reduce children's use of social media and follows legal claims that the company designed its services in ways that encouraged youth engagement.
The settlement requires several company-wide changes affecting users under 18. Among the measures are daily limits on use, disabling push notifications at night for younger users, and expanded procedures intended to better identify accounts belonging to children. The deal emphasizes additional scrutiny of accounts of users younger than 13, directing Meta to take special steps such as examining the friend networks tied to those accounts to detect and remove underage users. The settlement also mandates easier reporting for suspected child accounts and permits an independent auditor to evaluate Meta's implementation of the age-checking measures.
While the agreement calls for stronger age checks, it explicitly stops short of requiring intrusive verification methods. Meta is not being ordered by the settlement to collect photo identifications or to ask users to submit video selfies for the purpose of proving age. The settlement does allow Meta a limited, time-bound use of certain data generated by children it identifies, so the company can train an artificial intelligence model to detect users under 13. That approach would mirror current techniques Meta uses to flag accounts it suspects belong to teenagers.
Historically, Meta's policies have barred children under 13 from creating accounts on Facebook or Instagram and permitted teens to access platforms with some content limits. The company has acknowledged that younger users sometimes provide false ages when creating accounts. Rather than requiring documentary proof, Meta has used contextual clues - for example, public birthday posts or celebrations tied to school achievements - to identify accounts likely operated by children.
In testimony in February, the company's chief executive argued that effective age verification would be better handled at the device level by makers of mobile hardware. That viewpoint reflects the design of a Texas state law which requires individuals under 18 to obtain parental consent before downloading age-restricted apps onto their devices.
Legal and practical constraints figure prominently in discussions about stricter age assurance. Meta and other platforms have pointed to the Children’s Online Privacy Protection Act, or COPPA, a 1998 federal law that imposes liability on companies collecting personal data from children under 13 without parental consent. The company has described COPPA as a barrier to certain verification steps because the statute restricts the collection of the types of personal information - such as government IDs, biometric data, or detailed records of online activity - that would more reliably confirm a user's age.
Advocates for stronger protections for minors online have contested that explanation, arguing that companies sometimes invoke COPPA to avoid taking full responsibility for preventing children from accessing their sites. Courts have grappled with these tensions. A recent judgment in New Mexico, in which a judge issued a $942 million order on Aug 6, found that COPPA limited the remedies the judge could impose. The New Mexico judge concluded he could not require Meta to demand personal data submissions from children or to subject them to passive online tracking, and he warned that imposing rigorous age-verification duties might disadvantage Meta relative to competitors. The judge therefore ordered adjustments intended to strengthen age assurances within the boundaries of COPPA.
The multi-state settlement adopts a similar posture, seeking to enhance protections and detection methods while remaining within legal constraints created by federal privacy law. The Federal Trade Commission, which enforces COPPA for the federal government, issued a policy statement in February saying it would not act against a company that collected personal information solely to determine a user's age using age-verification technology. Legal experts cautioned, however, that the FTC's statement is only a partial safeguard because U.S. states retain their own authority to enforce COPPA violations even if the FTC elects not to pursue an action.
As part of the settlement process, several states that had pursued online-privacy claims against Meta agreed to drop those lawsuits in exchange for the company's commitments. The resulting agreement is structured to require more proactive age-verification and youth protections, while drawing lines around the collection of certain types of personal data in order to avoid running afoul of COPPA enforcement or creating competitive imbalances.
Operationally, the settlement directs Meta to expand its existing, non-documentary methods of identifying young accounts - including the use of contextual signals and network analysis for the youngest users - and to permit an audit function that will examine the company’s compliance. It also authorizes a temporary, narrowly scoped application of children-generated data to help build automated detection for under-13 accounts, replicating elements of techniques already used for suspected teenage accounts. The company will also be required to make reporting suspected child accounts easier for the public.
The agreement represents an attempt to reconcile the policy objectives of protecting children online with the statutory and practical limits companies say exist when collecting personal data from minors. It leaves in place notable constraints on how far platforms may go in seeking rigid identity verification and places emphasis instead on improved detection, usage controls, reporting pathways, and independent review.
Summary
Meta's $18 billion settlement with multiple U.S. states requires enhanced measures to verify the ages of users under 18, especially those under 13, while stopping short of mandating collection of formal identity documents. The settlement balances increased detection and usage limits with legal restrictions stemming from COPPA and separate state enforcement authority.
Key points
- Meta must implement broader protections for under-18 users including daily usage limits, disabling night-time push notifications, and improved age-detection methods - impacting the technology and digital advertising sectors.
- The settlement mandates extra scrutiny for accounts of users under 13, requiring measures such as friend-network analysis to identify and remove such accounts, and permits temporary use of identified children’s data to train age-detection AI.
- Federal and state legal frameworks, including COPPA and state enforcement authority, constrain the kinds of personal data Meta can collect for age verification, affecting regulatory compliance and privacy practices across digital platforms.
Risks and uncertainties
- Compliance limits under COPPA may prevent Meta from adopting document-based or biometric age verification, creating uncertainty about the effectiveness of non-documentary detection methods - relevant to the technology and privacy sectors.
- The FTC’s policy statement offers only partial protection because states retain independent authority to enforce COPPA, leaving room for disparate state actions and legal risk for platforms operating nationally.
- Judicial findings, such as the New Mexico decision, highlight the risk that courts may restrict remedies that require collecting children’s personal data, potentially limiting the scope of enforceable verification measures.