Meta's up to $18B child-safety settlement includes a pass on kids' data use

Meta’s settlement agreement with attorneys general from 29 states pairs its payout of up to $18 billion and new child-safety measures with an unusual provision: the states have agreed not to sue Meta under existing child-safety laws over its retention and use of children’s data. That permission applies specifically to training and testing Meta’s age-assurance model, and comes with guardrails — but it’s a notable policy choice in a case centered on child safety, and one that could be difficult to properly enforce.

Under the settlement, Meta must develop, train, and begin testing a model to detect users under age 13 within a year of the agreement’s effective date. The agreement doesn’t require the model to be AI-based, though Meta’s current age-detection tools already run on AI. Under COPPA (the Children’s Online Privacy Protection Act), websites and apps must generally limit how they collect and retain children’s personal information; Meta’s settlement says the company shouldn’t need to violate COPPA to build or run its age-assurance models, but it also has the state AGs agreeing “fully, finally, and forever” not to bring any past, present, or future COPPA claims — or claims under similar state laws — tied to Meta’s use of children’s data. The agreement does bar Meta from using data from under-13 users for ad targeting, marketing, or algorithmic optimization.

One legal source who spoke to TechCrunch, and who couldn’t comment publicly due to a conflict, said Meta’s request for this protection isn’t unreasonable — but noted that COPPA is a federal law enforced primarily by the FTC, not the states, so it’s unclear whether the FTC, which isn’t a party to this settlement, has separately agreed to the same compromise. Keeping children’s behavioral data technically and organizationally isolated from a company’s other systems is also difficult in practice, and the agreement doesn’t specify what data Meta will retain, how much behavioral detail it covers, or how long it will be kept — though an independent auditor will monitor Meta’s compliance.

The carve-out doesn’t eliminate legal risk entirely. “If Meta uses the data outside those lines, the release and covenant not to sue don’t apply,” said Joshua Wurtzel, a partner at Schlam Stone & Dolan LLP, though he noted such disputes would still hinge on whether Meta’s use fell within the settlement’s terms. Peter Jackson, a data and IP attorney at Greenberg Glusker LLP, said the carve-out could discourage future enforcement actions, calling the settlement’s age-assurance measures the product of “a heavy, and perhaps hasty, negotiation.”

Why it matters

A settlement meant to punish a company over child-safety failures also hands that company legal cover to keep processing children’s data for a new AI model — a trade-off that could become a template as more companies build AI-based age-verification systems under regulatory pressure.