A Settlement, Not a Statute
On August 26, 2026, Meta agreed to pay up to $18 billion over ten years to resolve claims brought by a coalition of 51 state and territory attorneys general — led by California's Rob Bonta and New York's Letitia James — that Instagram and Facebook were engineered to addict children. The core of the case dates to a lawsuit 29 states filed jointly in 2023; New York's office says its share of the deal starts at a guaranteed $819 million and can reach $1.15 billion. The agreement is, per Bonta's office, subject to court approval, and Bonta called it a deal that will make Meta "make massive transformations... within months." James was blunter: "Children in New York and nationwide are suffering while companies like Meta reap immense profits by intentionally addicting them."
What Meta Actually Has to Build
The design mandates are specific and mostly default-based, not content rules. Accounts identified as belonging to users under 18 get a default two-hour daily cap (dropping to one hour if TikTok, YouTube or Snap adopt matching limits), a midnight-to-6-a.m. platform lockout (expanding to 10 p.m.–7 a.m. if rivals match), notifications muted during 8 a.m.–3 p.m. school hours, hidden like and reaction counts, a ban on cosmetic-surgery filters, and an opt-in non-algorithmic feed. Separately, Meta must roll out "enhanced age-assurance" across its user base generally, not just for minors. An independent auditor gets standing access for a minimum of five years, extending to ten if competitors sign on, alongside an injunction barring further misleading statements about safety features.
The Case for the Deal
Credit the strongest version of the regulators' argument: this settlement isn't a moral panic dressed up as law. It followed years of discovery, including unsealed internal Meta research the states say showed the company understood which engagement features drove compulsive use among minors and shipped them anyway. State consumer-protection authority exists precisely to police a documented pattern of deceptive design, and defaults — screen-time caps, muted notifications, hidden vanity metrics — are a comparatively narrow lever. None of it touches what users can say or see; it touches how aggressively a product is engineered to keep a 14-year-old scrolling at 1 a.m.
That distinction matters against the alternative Congress has been unable to pass. The House Energy and Commerce Committee spent much of 2026 trying to consolidate the Kids Online Safety Act and the KIDS Act into one package, and repeatedly stalled — Republican leaders cited First Amendment concerns over KOSA's "duty of care" standard, which critics including the ACLU and EFF warned would push platforms toward pre-emptively removing lawful content (LGBTQ+ resources among the recurring examples) rather than risk liability for what a minor might encounter. A default two-hour cap regulates a dial Meta already controls; a duty-of-care standard regulates speech itself. On that axis, the settlement is the more proportionate instrument — and it exists only because the legislature couldn't agree on anything at all.
The Part That Should Worry This Audience
"The settlement also embeds age assurance into every product, mandating the collection of even more personal information from users of all ages; this enshrines Meta's harmful surveillance into law."
That's EFF's David Greene, in a statement published the same day the deal was announced. His objection is the one that holds up: extending age-assurance requirements to adults, not just the minors the case was actually about, adds a verification layer with no clean opt-out to Facebook and Instagram's entire user base. And the technology it rests on doesn't reliably work. Reporting from TechCrunch quotes researcher Alexis Ingber saying current age-verification methods have "by and large... failed" — behavioral-inference tools misclassify adults and minors in both directions, ID and biometric checks require handing sensitive documents to third-party vendors, and users resist the process outright, as Discord's own 2026 age-verification rollout showed. Locking a five-to-ten-year mandate to technology that experts say isn't ready is a real cost, not a hypothetical one — new data flows, new breach surface, for a verification layer whose accuracy nobody in this reporting can vouch for.
Litigation as Legislation
There's a structural issue too. The TikTok/YouTube/Snap contingency — Meta's obligations tighten and its payout ceiling rises only if rivals adopt matching restrictions — turns this settlement into an industry-wide design standard, set without a rulemaking docket, without floor debate, and without the rivals it binds having negotiated their own terms. A federal agency proceeding, or a statute, would need notice-and-comment or a vote. A multistate consent decree needs only a judge's sign-off on fairness between the parties in the room. That's efficient. It is not the same thing as legitimate, durable policymaking — and every other industry watching this outcome now knows a coalition of state AGs can set nationwide product-design rules faster than Congress can pass a bill.
Bottom Line
The underlying harm claims deserve the accountability they're getting, and default-based interventions beat content-liability regimes on First Amendment grounds. But the age-assurance mandate for adults, built on verification tech that doesn't yet work, is the piece that needed a legislative or rulemaking backstop — not a five-year lock-in negotiated by 51 offices and one company.