What Happened
Meta settled with a coalition of state attorneys general for up to $18 billion over 10 years after claims that Facebook and Instagram harmed children. The case centered on allegations under the Children's Online Privacy Protection Act (COPPA) and consumer product safety laws. Meta agreed to implement specific product changes, including a default two-hour daily time limit for teens, notification blackouts between midnight and 6 a.m., and muted notifications during school hours, but admitted no wrongdoing.
The settlement followed a week of testimony in federal court in Oakland, California. The attorneys general initially sought roughly $200 billion. By settling, Meta avoided a jury verdict that could have determined whether creating an engaging platform while concealing known harms constitutes a defective product under consumer protection law.
Timeline
The timeline highlights how compliance became a priority only after enforcement action began:
- ~20 years ago: Facebook expands beyond colleges to all users, relying on COPPA's de facto 13-year minimum age.
- Years of operation: Internal documents later show employees raised concerns about product harm; those concerns disappeared without meaningful response.
- Recent years: Meta launches advertising campaign promoting teen safety features as litigation pressure mounts.
- Earlier this year: Meta loses two separate cases related to child safety.
- Settlement week: After one week of testimony, Meta settles rather than risk a jury verdict establishing product liability precedent.
Which Controls Failed or Were Missing
1. Privacy by Design
Meta initially focused on engagement-maximizing features, then tried to add safety controls later. The settlement's required changes, like time limits and notification blocks, should have been part of the initial product development.
2. Risk Assessment and Documentation
Internal documents showed employees recognized risks but didn't escalate them effectively. This isn't just a documentation failure; it's a risk management failure. Your team identified risks but didn't respond in a traceable way.
3. Age Verification and Data Collection Controls
COPPA requires verifiable parental consent before collecting personal information from children under 13. The settlement strengthens age detection mechanisms, indicating Meta's original controls were insufficient. Ensure your age gates work before data collection.
4. Independent Oversight
Meta relied on internal compliance teams without external accountability. The settlement now requires an independent research foundation and a third-party auditor for five years. This structure should be part of your compliance program voluntarily.
What the Relevant Standards Require
COPPA Baseline Requirements
COPPA requires:
- Notice to parents about what information you collect from children
- Verifiable parental consent before collection
- Parental access to their child's information
- Parental ability to revoke consent and delete information
- Reasonable security for collected data
- Data retention and deletion policies
These are statutory minimums for services directed at children or when collecting data from children under 13.
ISO/IEC 27001 and Privacy by Design
Control A.5.32 requires identifying and meeting privacy requirements for personal data. Control A.5.33 mandates protecting records according to legal and regulatory requirements. Privacy by design means embedding data protection from the start.
NIST Cybersecurity Framework 2.0
The Govern function (GV.RM-03) requires understanding and managing legal, regulatory, and contractual requirements regarding cybersecurity, including privacy. This involves identifying applicable requirements, assigning compliance ownership, tracking changes, and verifying compliance.
General Data Protection Regulation (for EU users)
Article 25 requires Data Protection by Design and by Default. Article 35 requires Data Protection Impact Assessments for high-risk processing, including profiling and processing children's data. GDPR requirements
Lessons and Action Items for Your Team
Embed compliance in product development. Involve legal, compliance, and risk perspectives from day one. Include compliance officers in planning, privacy counsel reviewing design documents, and risk managers with veto power over risky features.
Document risk conversations and responses. Record identified risks, who evaluated them, decisions made, and the rationale. If revenue considerations influenced decisions, document the business justification and implemented mitigations.
Build independent accountability. Don't wait for a settlement to require third-party audits. Consider voluntary participation in an FTC-approved safe harbor program or engage independent privacy assessors now.
Review your age verification mechanisms. Ensure your age gates prevent children from accessing inappropriate features and aren't easily bypassed.
Establish clear escalation paths for product safety concerns. Create a process where employees can flag potential harms, triggering a documented review by legal, compliance, and risk teams.
Conduct a COPPA gap analysis. Verify if COPPA applies to you, and map your practices against its requirements. Document compliance or reasons for non-applicability.
Prepare for the AI parallel. If deploying AI systems, apply the same safeguards. These systems maximize engagement, appeal to young users, and collect data. Don't wait for a compliance review to start building safeguards.
The lesson from Meta's settlement isn't just about the money; it's about timing. The best time to build these controls was 20 years ago. The second-best time is today, before regulators conduct your compliance review.
