Meta Exempts Itself From Child Data Laws in $18B Settlement

Meta has secured a curious legal arrangement in its $18 billion settlement with 29 state attorneys general. While the agreement requires the company to pay billions and implement new safety measures, it also grants Meta a significant exemption: state officials have agreed not to pursue existing child safety laws against the company regarding how it collects and uses data from young users.

The exemption is narrow in scope—limited to Meta’s training and testing of an age-detection system—but it raises questions about enforcement and whether regulators have struck the right balance between protecting children and enabling protective technology.

The Settlement’s Core Child Safety Requirement

Meta must develop, train, and begin testing a model designed to identify which users on its platforms are under 13 years old. The timeline is tight: the company has one year from when the agreement becomes effective. The current age-detection tools Meta uses rely on artificial intelligence technology, though the settlement doesn’t explicitly mandate an AI-based approach.

This requirement exists because Meta has previously failed to protect children on its platforms adequately. The $18 billion payout reflects the severity of those failures, and the settlement includes additional safeguards to prevent future harm.

How COPPA Normally Works and What the Exemption Changes

Read also: Claude Opus 4.6 Readily Generates Explicit Content Through Jailbreak · Malware Campaign Targets Security Researchers Using Fake Conference Ruse · OpenAI’s New Privacy Safety Tool Challenges Anthropic’s Data Policy

The Children’s Online Privacy Protection Act, known as COPPA, normally prevents websites and apps from collecting and retaining large amounts of personal data from users under 13. It’s a federal law designed to protect minors from data exploitation and to constrain companies’ business models built on children’s behavioral data.

Meta’s settlement agreement creates an exception to COPPA specifically for developing its age-assurance model. The states have agreed not to pursue any past, present, or future claims under COPPA—or similar state laws—related to Meta’s use of children’s data in connection with age detection. That’s a significant concession. By signing on, the state attorneys general surrendered legal tools they might otherwise have used in future disputes over this same issue.

This exemption acknowledges a genuine technical problem. To detect which users are actually under 13, Meta likely needs to examine patterns in how young people use the platform: what accounts look like, what behavior signals appear in underage accounts, what data suggests someone’s true age. That analysis might technically violate COPPA’s data-minimization requirements, even if the purpose is protective rather than exploitative.

Philip N. Yannella, a privacy law partner at Blank Rome, said data-minimization guardrails for compliance purposes are “pretty typical” in privacy law. But he raised an important caveat: COPPA is enforced primarily by the Federal Trade Commission, not by states. The FTC is not a party to Meta’s settlement, so it remains unclear whether the agency has separately agreed to the same exemption. That ambiguity could matter if questions arise later about data retention or use.

Guardrails on What Meta Can Do With the Data

Prohibited Uses

The settlement is explicit about what Meta cannot do with children’s data. The company is barred from using information from users under 13 for advertising, marketing, or algorithmic optimization. Those are the highest-risk uses in terms of exploitation and manipulation. Preventing Meta from building targeted ads for children or personalizing feed content based on underage users addresses the core concern that originally prompted the enforcement action.

Unanswered Questions

What remains less clear is everything else. The agreement doesn’t specify what data Meta will retain for training the model, how much behavioral information that includes, or how long the company will store it. It doesn’t address how Meta will handle insights or patterns derived from that data, or whether those derived signals could theoretically feed into other company systems over time.

An independent auditor will monitor Meta’s compliance, which provides some external oversight. That’s significant—it means the company cannot simply self-report its adherence to the terms. Still, auditing for data isolation is notoriously difficult. Companies often struggle to keep information technically and organizationally separate from the rest of their infrastructure, even when that separation is the explicit goal.

The Enforcement Problem

When States Can Still Sue

If Meta uses the data beyond the settlement’s stated boundaries, states can still pursue legal action. Joshua Wurtzel, a partner at Schlam Stone & Dolan LLP, emphasized this point: the exemption only applies to uses within the settlement’s terms. If Meta steps outside those lines, the states’ agreement not to sue no longer holds.

Why Enforcement Is Complicated

But that enforcement mechanism has a weakness. Legal disputes over whether Meta’s use of the data fell within the settlement’s terms could become complicated and drawn out. The company and states would need to litigate over the boundaries—over what “age detection” means in practice, over whether data crossed into other systems, over whether insights derived from the data count as prohibited uses. Those are the kind of factual questions that generate expensive, years-long litigation.

Peter Jackson, a data attorney at Greenberg Glusker LLP, suggested the carve-out could have a chilling effect on future enforcement. “The Settlement Agreement’s age-assurance measures bear all the hallmarks of a heavy, and perhaps hasty, negotiation,” he said. By exempting Meta from COPPA claims today, states may have limited their legal tools for tomorrow, even if questions arise about how the data was actually used.

A Broader Pattern in AI Development

This situation reflects a tension appearing across the AI industry. Many new AI systems—especially those designed to help consumers with various tasks—require substantial access to personal data to function well. The systems need deep behavioral insight to work effectively.

Meta’s situation with age detection follows the same pattern. The company genuinely may need extensive data about how young people use social media in order to identify which accounts belong to them. There’s no obvious way to build an accurate age classifier without examining the patterns of actual young users.

The question facing regulators is how to allow such beneficial systems to develop while preventing data misuse. Meta’s settlement attempts to answer it through the combination of a narrow exemption, explicit restrictions on downstream uses, and independent auditing. Whether that combination will prove sufficient in practice remains to be seen.