Meta has secured a notable carve-out in its $18 billion settlement with 29 state attorneys general. The company can continue collecting and using data from children under 13 to build and refine age-detection models, even as the settlement ostensibly tightens privacy protections for minors.
The settlement, one of the largest privacy penalties ever levied against a tech company, came after investigations into Meta's practices around youth safety and data handling. Yet buried within the agreement sits language that permits Meta to retain child data for machine learning purposes tied to age verification systems. The company argues these models are necessary to enforce its own age restrictions and protect younger users from inappropriate content and targeting.
This data retention permission reveals a fundamental tension in modern privacy regulation. Regulators wanted to punish Meta for past practices while also acknowledging that effective age-detection technology requires training data. Without access to some youth information, Meta cannot build systems that accurately identify minors and shield them from adult-oriented features. The settlement's architects apparently decided this trade-off was acceptable.
Meta's position is defensible on technical grounds. Age-detection models need examples of actual youth behavior and biometric data to function at scale. The alternative—blocking Meta from any minor data use—would leave the company unable to improve its safety guardrails. That creates a perverse outcome where stricter regulations could weaken protections for the very users they aim to defend.
Still, critics argue the carve-out sets a dangerous precedent. Privacy advocates point out that data collected for one stated purpose (age detection) can migrate toward other uses. Meta's track record of repurposing user data fuels skepticism about self-imposed guardrails. The company has faced repeated fines and investigations for precisely this kind of scope creep.
The settlement includes oversight mechanisms. Meta must implement new privacy controls and age-verification procedures. The company faces significant financial penalties for violations. Independent monitors will review compliance. These safeguards are real, if imperfect.
What the arrangement exposes is the difficulty of drafting privacy law that works in practice. Regulators cannot simply forbid companies from accessing any youth data without breaking the security systems those same regulators want companies to build. They cannot achieve their stated goals of protecting children without permitting the data use they claim to prohibit.
Meta's competitors face the same technical constraints. TikTok, YouTube, Snap, and Discord all need age-verification models. They all face pressure to implement safety features for minors. The settlement may have inadvertently blessed a necessary practice across the industry, even as it presented itself as a victory for child protection.
The $18 billion figure dominates headlines, but the details of what Meta can and cannot do with youth data may matter more in the long run. The settlement's data provisions will likely influence how regulators approach age-verification technology going forward. If they allow this carve-out to stand, other companies will point to Meta's precedent when seeking similar exemptions. If they crack down, the next generation of age-detection models may become significantly less effective.