Hidden within Meta’s $18 Billion Settlement: A Legal Loophole Regarding Children’s Data
Meta has reached a settlement with attorneys general from 29 states, involving a payment of up to $18 billion and the implementation of child safety measures. Notably, the agreement includes a provision prohibiting the states from suing Meta under existing child safety regulations regarding the use of children’s data.
This permission is granted specifically for the training and testing of Meta’s age-assurance system, and while there are safety precautions included, it raises questions given the context of the case focused on child safety—a matter that could prove challenging to enforce.
The settlement outlines that Meta is required to create, train, and start evaluating a model to identify users on its platforms who are younger than 13, all of which must be completed within a year of the agreement’s effective date. Although the settlement doesn’t explicitly state that the model must use artificial intelligence, Meta’s current methods for age detection leverage AI technology.
According to U.S. child safety legislation, specifically the Children’s Online Privacy Protection Act (COPPA), websites and applications are generally mandated to limit the collection and storage of children’s personal information. The settlement indicates that Meta shouldn’t have to breach COPPA to train or utilize its age-assurance framework. Nonetheless, the state attorneys general have agreed to waive any potential COPPA-related claims concerning Meta’s use of children’s data, effectively barring any future legal action.
It is made clear in the agreement that Meta cannot utilize data from users under 13 for purposes such as advertising, marketing, or algorithmic enhancements.
Legal expert Philip N. Yannella from Blank Rome emphasizes that seeking legal protection and the states’ willingness to grant that is not unreasonable. He points out that these types of data minimization guidelines are standard for privacy compliance; however, he raises a concern that COPPA is primarily enforced at the federal level by the FTC and that it’s uncertain if the FTC has concurred with this arrangement.
Maintaining data isolated from the broader system can be challenging for companies, and in this case, Meta is tasked with segregating its understanding of children’s behavioral signals solely for the purpose of identifying and managing under-13 users. An independent auditor will oversee Meta’s adherence to the terms of the settlement to ensure accountability.
Enforcing this limitation may be intricate. Over time, data could potentially be integrated into other Meta systems, leading to uncertainties about its application. The agreement does not clarify which data will be kept for training the age-assurance model, the nature of this data, or the duration of its retention. Future adaptations of these models as Meta complies with the settlement terms remain uncertain.
Preventing state attorneys general from filing any COPPA-related claims regarding children’s data could complicate the legal paths available to states if concerns about Meta’s data use arise.
However, as legal partner Joshua Wurtzel points out, states are still able to pursue claims if Meta misuses the data outside of stipulated guidelines. Such legal matters might turn complicated, as they would depend on interpretations of Meta’s compliance with the settlement.
Peter Jackson, a Data & IP attorney, concurs, stating that this carve-out could deter future legal enforcement actions.
He adds that the negotiations leading to the settlement’s child safety measures may have been rushed and poorly structured.
The scenario also brings to light broader questions within the AI industry, particularly as AI systems increasingly require extensive access to user data to function effectively. Meta may similarly need detailed insights into children’s social media usage to accurately pinpoint young users’ accounts.
