Meta's $18B Settlement Shields Its Kids' Data Play From Future Lawsuits

The Settlement That Lets Meta Keep the Children’s Data

Meta is paying up to $18 billion to settle privacy lawsuits from 29 state attorneys general. The headline number looks like a reckoning. But buried in the fine print is something far more consequential: a permanent legal shield that lets Meta continue collecting and using children’s data for purposes the settlement itself frames as necessary.

The states have agreed — fully, finally, and forever — not to sue Meta under COPPA or similar state laws for its retention and use of children’s data. This permission covers the development and testing of an age-assurance model Meta must build within a year. The model is supposed to detect which users are under 13. But the legal mechanism that enables it is unusually broad, and it raises questions that extend well beyond California or New York.

Why This Loophole Matters

Under normal circumstances, COPPA requires companies to limit how they collect and retain data from children under 13. Meta has been accused of violating that law for years by continuing to gather behavioral signals from young users even after they’ve been identified as underage. The settlement purports to end that practice. Meta cannot use data from users under 13 for ad targeting, marketing, or algorithmic optimization. On paper, that is a meaningful restriction.

But the carve-out for training and testing the age-assurance model effectively grants Meta a license to keep harvesting children’s data indefinitely, so long as the company says it is doing so for age detection. The agreement does not specify what data will be retained, how much behavioral information is included, or how long Meta will hold onto it. Those details are left to Meta’s discretion and the oversight of an independent auditor — a arrangement that sounds rigorous but functionally places the burden of enforcement on a company that has every incentive to interpret the rules generously.

Philip N. Yannella of Blank Rome noted that data minimization guardrails are typical in privacy compliance. But this is not a routine compliance exercise. It is a settlement centered on child safety that explicitly permits the very data practice the case was about. That tension is not accidental. It reflects a negotiation posture that prioritizes corporate certainty over enforcement leverage.

The FTC Question No One Is Answering

Perhaps the most significant ambiguity in the settlement concerns the Federal Trade Commission. COPPA is primarily enforced by the FTC, not by state attorneys general. The settlement does not bind the FTC. Peter Jackson of Greenberg Glusker LLP warned that the carve-out could disincentivize future enforcement actions precisely because state-level recourse has been partially neutralized. If the FTC later brings a COPPA claim against Meta for how it uses children’s data, the agency would have to navigate a settlement in which 29 states have already waived their right to pursue similar claims. The legal dynamics of that scenario are unclear.

Joshua Wurtzel of Schlam Stone & Dolan LLP acknowledged that states can still pursue claims if Meta steps outside the settlement’s terms. But those disputes would hinge on whether Meta’s data use falls within the agreement’s scope — a question that requires litigating the boundaries of a provision that was itself drafted with considerable haste. Jackson described the settlement as bearing “all the hallmarks of a heavy, and perhaps hasty, negotiation.” That assessment matters because hasty settlements tend to produce narrow interpretations that favor the party with the deeper legal team.

What This Means Beyond the United States

The implications of this settlement extend well beyond American borders. Meta operates globally, and the technical architecture it builds for age assurance will likely influence how the company handles children’s data in Europe, Asia, and elsewhere. The European Union’s Digital Services Act and its upcoming Digital Markets Act already impose stricter obligations on platforms regarding minors. If Meta establishes a precedent in the United States that children’s behavioral data can be retained for model training under a broadly defined compliance purpose, it will test the resolve of European regulators who are watching closely.

The same dynamic plays out in South Korea, where the Personal Information Protection Commission has been increasingly aggressive about platform accountability. And in India, where the Digital Personal Data Protection Act contains specific provisions about verifiable parental consent and children’s data. A settlement that weakens domestic enforcement signals to regulators abroad that even the most politically visible privacy cases can produce outcomes favorable to the dominant platform.

The Bigger Picture: AI Needs Your Children’s Data

There is a deeper structural force at work here. Meta’s request for legal protection over children’s data is not an anomaly. It reflects a pattern across the AI industry: systems designed to understand users require access to large volumes of personal data, and companies are increasingly seeking legal cover to obtain that access. Age-assurance models are just one example. Content recommendation engines, sentiment analysis tools, and emerging AI agents all depend on behavioral signals that are difficult to isolate from the very data communities are trying to protect.

The settlement forces Meta to do exactly what the law traditionally requires: minimize data collection from children. But it also creates a pathway for Meta to bypass that requirement by reclassifying the data as necessary for a compliance function. That distinction is thin. Behavioral signals that help an age-detection model understand how children interact with platforms are not qualitatively different from the signals that drive engagement and ad delivery. The data does not change. Only the legal framing does.

Who Wins, Who Loses, and What Happens Next

Meta wins the most. It avoids admitting liability, limits its financial exposure relative to the $18 billion figure, and secures a legal environment in which it can continue refining the data systems that power its platforms. State attorneys general win political points for extracting a record settlement. Independent auditors win jobs. Children lose the protections their data should have enjoyed under existing law.

The next phase will determine whether this settlement becomes a template. If regulators in other jurisdictions accept the argument that compliance-driven data retention justifies broad collection of children’s behavioral information, the precedent will reshape privacy enforcement globally. If they reject it, Meta will face a fragmented compliance landscape in which the same data practice is permissible in some markets and prohibited in others.

The agreement also leaves open the question of how Meta’s age-assurance model will evolve. The settlement requires the model to be deployed within a year. It does not require the model to be accurate, transparent, or independently validated. A poorly calibrated age-detection system could miss children who should be protected and flag adults who should not be surveilled. Both outcomes carry real consequences, and neither is addressed by the current terms.

What emerges from this settlement is not a resolution of the children’s privacy debate. It is a recalibration in Meta’s favor. The $18 billion price tag makes headlines. The legal pass on kids’ data is what actually matters.