Federica Fedorczyk

On 26 August 2026, Meta agreed to a landmark settlement worth up to $17.1 billion, less than ten days after the trial began. The settlement resolves claims brought by 47 U.S. states, the District of Columbia and U.S. territories concerning the effects of Facebook and Instagram on children and teenagers. The allegations against Meta were serious. The company was accused of deliberately designing its platforms to induce compulsive use among young people, despite knowing the associated mental-health risks. It was also accused of misleading the public about the safety of its platforms and of collecting children’s personal data in violation of the federal Children’s Online Privacy Protection Act (COPPA) and state consumer-protection laws.
Importantly, rather than focusing only on harmful content posted by users (an area traditionally protected by Section 230 of the U.S. Communications Act) the claims also targeted Meta’s own conduct: the design of its platforms and its representations about their safety. In other words, the alleged harm did not simply arise from what users posted on Facebook and Instagram, but from how Meta itself designed and operated those platforms.
The settlement has been welcomed by some as a “dramatic capitulation” and a sign that Meta is not above children’s fundamental rights. Others, however, question whether it represents a real victory: Meta admitted no wrongdoing and continues to deny the allegations, while the settlement’s measures are considered by many insufficient to protect the well-being of children and teenagers.

1. The content of the settlement is very specific and elaborate. Meta must implement safeguards and protections for teenagers and make payments of up to $17.1 billion over ten years.
From a financial point of view, however, only about 70% of Meta’s payment is guaranteed ($12.1 billion). The remaining 30% (about $5 billion) will be paid only if the settlement’s “Industry-Wide Adoption” conditions are met, meaning that the “Core Industry Members” (defined as Snap, TikTok, and YouTube) become subject to comparable protections for teenage users. In particular, the contingent 30% will be paid by Meta only if two conditions are met: first, Snap, YouTube and TikTok adopt protections equivalent to some of those adopted by Meta (specifically, a one-hour daily limit, a night mode and age-assurance measures); second, each Core Industry Member whose annual profits exceed $10 billion must itself be subject to a monetary obligation at least equal to the relevant contingent amount owed by Meta.

2. From a substantive point of view, the new guarantees that Meta must adopt are several, and some of them would become more restrictive if Snap, YouTube and TikTok became subject to equivalent obligations.
Within one year, Meta must implement an “age assurance framework” capable of assessing whether users are minors. The settlement establishes specific standards for identifying users aged 13 - 17 and, for children under 13, requires additional measures to detect and remove their accounts. Data retained for the purpose of detecting under-13 users cannot be used for advertising, marketing or algorithmic optimisation.
On top of this, there are two other groups of interventions. The first mainly concerns time limits and notifications, with the goal of reducing the amount of time teenagers spend on the platforms. By default, Meta must impose a maximum of two hours of cumulative use per day across its platforms. However, time spent watching long-form content (defined as audio or video lasting at least 22 minutes), using messaging services or accessing settings does not count towards the limit. Furthermore, a supervising parent can make these restrictions less stringent. If the conditions for “Industry-Wide Adoption” are met, the rules become stricter: teenagers will be limited to 60 minutes per day on each Meta platform, while remaining subject to an overall maximum of 120 minutes across Meta platforms.
There is also a specific restriction on nighttime access. By default, teenagers aged 13 - 17 cannot access the platforms between midnight and 6 am. In addition, push notifications are disabled by default between 10 pm and 7 am and during school hours (8 am - 3 pm, Monday to Friday, between August 15 and June 15). Whether the “Industry-Wide Adoption” conditions are satisfied, the nighttime access restriction will also become stricter, expanding to 10 pm - 7 am.
To address more specifically the phenomenon of “endless scrolling”, within the next four months Meta must also introduce “productive pauses”: users will receive a prompt after 15 minutes of continuous screen time, and after 60 and 90 minutes of cumulative daily use.
One important point is that Meta’s direct messaging features are excluded from Night Mode, Time Limit, and School Mode restrictions to – in the words of Meta – “allow teens to stay connected with friends and family”.
The second group of interventions concerns features that may intensify social comparison and personalised engagement. By default, Meta must prevent teenagers from seeing the number of likes or reactions received by their own or others’ content and must prevent them from using cosmetic surgery and extreme makeup filters. Meta must also provide a reasonably accessible option allowing teenagers to select a non-personalised feed as their default home feed. In this case, content from accounts they follow or have friended is displayed chronologically rather than ranked through personalised recommendations.
Further measures must then be taken to prevent unwanted contact from strangers, unsure effective reporting and protection mechanisms from harmful content and age-appropriate content restrictions.

3. The settlement comes as a surprise, but not as an unpredictable surprise. For Meta, the litigation risk of proceeding to trial was substantial, because the claims were extremely serious and not without precedent. Just in March 2026, Meta and Google were found liable in California for negligence and failure to warn in relation addictive platform design that contributed to a young plaintiff’s mental-health harm. That same week, a New Mexico jury found that Meta had misled users about the safety of its platforms and endangered children by allowing predators to use them for child sexual exploitation.
The relevance of all these cases lies particularly in the role attributed to platform design. The features contested are designed to repeatedly provide users with new stimuli, thereby encouraging prolonged and potentially compulsive engagement. A recent systematic review of 270 scientific sources identifies precisely the mechanism mentioned in the settlement (such as infinite scroll, push notifications, highly personalised recommender systems and autoplay) as central forms of “addictive design”, and a 2026 experimental study on TikTok found that disabling autoplay and introducing friction into infinite scrolling reduced compulsive engagement patterns.
These concerns have increasingly entered the legal debate as well. Legal scholars have argued that regulation should focus specifically on the design choices through which platforms capture and retain users’ attention, rather than merely on the content. Addictive design has been described as a regulatory problem produced by the incentives of platforms to maximise user attention and some scholars have drawn on the regulation of gambling and psychoactive substances to argue that legal responses should focus on the design of potentially addictive products, rather that placing the burden primarily on their users.
In the EU, this approach is also increasingly reflected in regulation: the European Commission’s Guidelines on the protection of minors under the Digital Services Act (2025) recommend disabling the default features that contribute to excessive use, including autoplay and push notifications, and limiting persuasive design primarily aimed at increasing engagement. In July 2026, the Commission went further, preliminary finding the design of Facebook and Instagram incompatible with the DSA.
The measures of the settlement are therefore not simply restrictions on teens’ screen time: they directly constrain design features that sustain and prolong personalised engagement.

4. One of the most significant aspects of the settlement is therefore that responsibility is no longer placed exclusively on teenagers and their parents. Furthermore, the settlement also weakens an argument frequently advanced against stricter regulation: that substantial modifications of the product are technically impracticable. Meta has now accepted that such changes are possible and should be implemented.
This should not, however, be confused with a transformation of Meta’s underlying business model. Facebook and Instagram remain advertising-funded platforms whose economic incentives depend heavily on retaining users’ attention. As observed, Meta’s internal documents indicate that highly engaged users have historically produced a disproportionate share of advertising revenues. The settlement thus places important constraints around this model for teenagers but does not fundamentally replace it.
The “Industry-Wide Adoption” mechanism makes this tension particularly visible: as correctly noted, it gives Meta a direct interest in seeing equivalent obligations imposed on its competitors. In this way, child protection and competitive strategy become difficult to separate.

5. What effect, then, can a settlement between Meta and U.S. state authorities have outside the jurisdictions formally bound by it? Legally, the answer is limited because the agreement does not bind Meta in Europe. However, the settlement has created a concrete regulatory benchmark, making the geographical limitation of those protections more difficult to justify: if Meta can implement them for U.S. teenagers, it can also do it for comparable users elsewhere.
At the same time, there is no reason for the European response to stop where the U.S. settlement does. The settlement may instead serve as a starting point: its design-focused approach could offer an alternative to age-based social-media bans, such as the Australian model, and could contribute to shifting the debate from excluding minors from platforms to making those platforms safer for them.

It was back in 2021 when the EU Commission tabled a ‘Proposal for a regulation laying down harmonized rules on artificial intelligence’ with the specific object, among the others, to ensure that AI systems placed and used on the Union market are safe and respectful of existing law on fundamental rights.
The normative choice of the Regulation stems from the imperative for consistent legislation and the necessity to establish a market environment that fosters innovation while safeguarding the rights of citizens. It reflects a commitment to uphold the digital sovereignty of the European Union, thereby ensuring that Member States have limited room for independent action.
The Proposal strived to balance the numerous risks and benefits the use of AI can provide, using a risk-based approach. The idea behind the risk-based approach can be visually represented by a risk pyramid: at the top there are the applications that are prohibited because they pose an unacceptable risk; then there is the main core of high-risk systems, which, although risky, enable important functions and are therefore allowed at certain conditions; there are then limited risk systems, that will have to comply with ‘minimal transparency requirements’; and at the bottom there are minimal or no risk systems, which are allowed without restriction.
After the Commission adopted the Proposal on 21 April 2021, the Council unanimously adopted its General Approach on 6 December 2022. In May 2023, the European Parliament introduced some amendments, and recently, on 14 June 2023, these amendments were adopted with a substantive majority vote, giving start to the Trilogue negotiations. Once approved, after the end of Trilogue process, the AI Act will be the world’s first comprehensive rule on AI.
Comparing to the Commission’s version, the Parliament’s version contains different changes that mainly concern the definition of AI, the new regulation of foundation models, the extension of prohibited AI systems, AI high-risk classification, the extension of the list of high-risk uses cases, and the introduction of additional and specific obligations on specific subject. Furthermore, the Parliament’s proposal increases the penalties for violating the AI Act.
A groundbreaking part of the document approved by the EU Parliament concerns the regulation of Large Language Models (LLMs) also referred to as ‘foundation models’ or ‘large generative AI models’ (LGAIMs). In response to the recent proliferation of LLMs in the market and given the uncertainty about the way in which foundation models will evolve, the Parliament has imposed obligations on the providers of foundation models. More specifically, generative foundational models call for increased transparency requirements. Indeed, where contents such as complex text, images, audio or video have been generated by AI, this information must be disclosed in a timely, clear and intelligible manner. The provider must also provide adequate safeguards to ensure that the generative system does not produce content that is illegal or in violation of European standards and must publish summaries of copyrighted data used for training purposes. These additional requirements are justified by the fact that precisely because foundational models require a lot of data, their developers often rely on training data available on the Internet, which is often of poor quality. In fact, the contents generated by these models are frequently incorrect or biased (think of the problem of fake news generated by models such as Chat GPT).
However, scholars have raised concerns: compliance with the required obligations, including the establishment of a comprehensive risk management system prescribed for high-risk uses, seems almost impossible to achieve.
Indeed, providers would be required to identify and analyze all known and foreseeable risks that are most likely to occur to health, safety and fundamental rights, and, based on this analysis, they would have to identify mitigation strategies for each risk.
Consequently, due to the challenges of adhering to the new AI Act regulations, it can be expected that only large and financially robust players such as Google, Meta, and Microsoft/Open AI would be able to afford the costs associated with developing LLMs that are approximately compliant with the AI Act. This would result in a limited pool of companies capable of meeting the regulatory requirements, potentially leading to reduced competition and innovation in the field.
Another significant change in the Parliament’s version is the expansion of the list of prohibited AI systems. It is the first of its kind in Europe and the first major ban on such system worldwide, and includes: ‘real-time remote biometric identification systems in publicly accessible spaces;  post remote biometric identification systems, with the only exception of law enforcement for the prosecution of serious crimes and only after judicial authorization; biometric categorisation systems using sensitive characteristics (e.g. gender, race, ethnicity, citizenship status, religion, political orientation); predictive policing systems (based on profiling, location or past criminal behaviour); emotion recognition systems in law enforcement, border management, workplace, and educational institutions; indiscriminate scraping of biometric data from social media or CCTV footage to create facial recognition databases (violating human rights and right to privacy).’.
The ban reflects a growing recognition that AI systems must be developed and used in a manner that is both ethically responsible and respectful of fundamental rights. It paves the way for a more transparent, accountable, and equitable approach to law enforcement, promoting a system that upholds fairness and justice. However, in concrete terms, the ban will probably have demanding consequences. For instance, once the ban on predictive policing will become effective, law enforcement authorities and agencies will be obliged to cease the use of all the predictive policing tools already in use in EU. Therefore, it is possible that authorities may mandate the removal of such tools from operational systems and databases. This action would probably involve first dismantling or reconfiguring the existing infrastructure that supports predictive policing and then providing regular reports on the implementation and progress of the ban.
The Parliament has also adopted some modifications concerning the high-risks AI systems: first, while the Commission proposed to automatically categorize as high-risk all systems in certain areas or use cases, the Parliament adds the additional requirement that these systems must pose a ‘significant risk’ (Article 3) to be qualified as high-risk. Second, the Parliament has expanded the category of high-risk applications, to include those AI systems that pose a significant harm to people’s health, safety, fundamental rights or the environment and those that have the power to influence voters in political campaigns and in recommender systems used by social media platform.
Another change made by the Parliament concerns a new obligation on ‘deployers’ - previously referred to as ‘users’, namely those who use AI systems for professional purposes- of high-risk AI solutions. They must undertake a comprehensive ‘fundamental rights impact assessment’ (FRIA) before putting their systems into use:  the aim is to ensure that fundamental rights are protected and the ‘minimum’ of what the FRIA should include is broadly described in the new Article 29(a).
The ones just described are only the main changes presented in the Parliament’s version of the AI Act. It is important to note that these changes will probably be subjected to further modifications during the Trilogue. However, even at this stage, it is possible to analyze the direction that the EU is taking in terms of regulation and the reactions from stakeholders and civil society.
It should be premised that all the amendments regarding the prohibited systems and the high-risks system were not entirely unexpected: they have been the result of various comments and criticisms that arose over the past year following the text adopted by the Commission.
Indeed, already in 2021, the European Data Protection Board (EDPB) and the European Data Protection Supervisor (EDPS) jointly expressed their support for the European Commission’s proposal on AI, but at the same time they raised specific concerns. They emphasized the need to align the concept of ‘risk to fundamental rights’ with the principles set out in the GDPR and they called for a comprehensive ban on the use of AI for automated recognition of human features in public spaces, regardless of the context.
Therefore, it is no surprise that the Parliament has done similar changes and has banned the use of biometric identification for both real-time and ex-post use (except in cases of severe crime and pre-judicial authorization for ex-post use) and not only for real-time use, as proposed by the Commission.
However, many representatives of civil society, while appreciating the changes adopted by the Parliament, have pointed out that too little has been done to ensure respect for fundamental values and human rights and claimed a total ban of facial recognition systems.
Furthermore, significant criticism has emerged regarding the Parliament’s failure to address the concerning absence of prohibitions on the use of AI systems in the context of migration. In the Parliament’s version, there are no explicit bans on discriminatory profiling, risk assessment systems, or profiling intended to restrict, prohibit, or hinder border movements. This ‘omission’ is seen as a favorable signal to reinforce surveillance system at the borders, further exacerbating the concern surrounding privacy, human rights and equal treatment.
However, the list of prohibited AI practices could be expanded in the future to cover all systems that are proven to pose an unacceptable risk of violating fundamental rights. Such a possibility is provided for the high-risks system, and now also for the list of prohibited systems.
Indeed, the legislative process is not over: in the coming months, substantial negotiations are expected to take place between the Commission, the Council and the European Parliament, that may be influenced by the looming 2024 European Parliament election scheduled for June 2024. The debate surrounding AI has proven to be far from unanimous, and one highly contentious issue stands out: the real-time biometric identification of individuals in public areas. While the European Parliament seems keen to ban this practice entirely, several Member States are advocating for retaining exceptions, primarily for law enforcement purposes.
The ultimate objective remains to have a final version before the upcoming elections and Spain has made it clear that AI is a top priority during its presidency. Nonetheless, there are numerous complexities and challenges that still need to be addressed in this ongoing process.