Meta Pays $18B to Settle 52 State AG Teen Claims

A bipartisan group of 29 states sued Meta jointly in the Northern District of California in 2023. By trial the coalition had grown to 52 attorneys general covering states, US territories and the District of Columbia. Meta admitted no wrongdoing. It agreed instead to change what Facebook and Instagram do by default for every user under 18, and to let an outside auditor check that it did.

Key Takeaways

• Meta agreed on 26 August 2026 to pay up to $18 billion over ten years to settle claims from 52 attorneys general that it designed Instagram and Facebook to be compulsive for minors.
• Roughly $12.7 billion is committed to the states outright; $5.3 billion, about 30 percent, is withheld unless YouTube and TikTok adopt comparable teen protections.
• California's share is $1.5 billion to $2.1 billion, earmarked for prevention and remediation of social media related harm to young Californians.
• Under 18 accounts get a default two hour daily cap, a midnight to 6am block, muted notifications during school hours, hidden like counts and no cosmetic surgery filters.
• US District Judge Yvonne Gonzalez Rogers must still approve the agreement before any of it binds.

What Did the 29 States Actually Allege?

Two distinct wrongs, not one. The California Attorney General's announcement sets out the first as design: Meta built features meant to drive compulsive, extended use by young people, then made misleading public statements about how safe they were. The second is a straight data protection claim. The states allege Meta knowingly collected personal information from children under 13 without parental consent, in violation of the Children's Online Privacy Protection Act and California consumer law.

Read that second claim closely, because regulators keep reaching for it. Brussels made a near identical argument about how Meta establishes age, covered here when the Commission called Meta's age check a birthday field. A platform that cannot reliably tell who is 12 cannot claim it never processed a 12 year old's data.

Where Does the $18 Billion Actually Go?

To state treasuries in annual installments over ten years, not to families. About $12.7 billion goes to participating states, California taking a reported $1.5 billion to $2.1 billion earmarked for prevention and remediation of mental health harm to young Californians. No consumer claims process is attached.

Meta reported $60.8 billion of revenue in the second quarter of 2026 alone, so the whole ten year payout is worth roughly one quarter's takings spread across a decade. Against Meta's earlier penalties the trend is still steep: $5 billion in the FTC's 2019 privacy order, and $567 million in the judgment we covered three weeks ago, Meta Ordered to Pay $567M in New Mexico Youth Case. This settlement is roughly 32 times that figure, agreed 17 days later.

Why Is $5.3 Billion Riding on YouTube and TikTok?

Because Meta wrote a competitor clause into a settlement, which is the genuinely novel part of the filing. The Register reported that about 30 percent of the money is held back unless Google owned YouTube and TikTok adopt comparable daily limits, night mode and age verification. If they do, Meta's own terms tighten rather than relax: the cap drops from two hours to one per app, night mode widens to 10pm through 7am, and the commitment runs ten years instead of five. Meta legal chief C.J. Mahoney said the framework "will only work if all our peers join us."

Most coverage read that as blame shifting. The sharper reading is regulatory: a private settlement is manufacturing an industry standard no legislature passed, with $5.3 billion as the incentive. Regulators have been trying the slow route, as when Ofcom extracted child safety promises while YouTube and TikTok argued their existing features were enough. TikTok arrives carrying its own bill, having just paid $400 million to settle a US children's privacy case.

What Changes Inside Instagram and Facebook?

Defaults, which is the part that matters. Per the terms published by Bonta's office, accounts belonging to users under 18 get:

• A two hour daily limit shared across both apps, liftable only by a parent
• The apps blocked midnight to 6am, notifications muted 10pm to 7am and during school hours
• Usage prompts every fifteen minutes, autoplay off
• Like and reaction counts hidden, cosmetic surgery filters blocked
• The option of a feed that is not algorithmically personalised
• Age assurance aimed at finding and removing accounts held by under 13s
• A teen reporting channel answering 90 percent of reports within six hours

Direct messaging is carved out of night mode, the limits and the school pause. An outside auditor reviews compliance annually, an independent research foundation receives consented user data to study teen wellbeing, and most obligations run ten years.

What Evidence Never Reached the Jury?

Meta's own research, which is why the timing reads as a tell. Whistleblower Arturo Béjar opened the plaintiffs' case, having told the Senate Judiciary Committee in written testimony that internal surveys found 13 percent of Instagram users aged 13 to 15 had received an unwanted sexual advance in the previous seven days. Jurors also saw an internal document showing only 1.8 percent of teens ever used Take a Break, the feature Meta promoted as its answer to compulsive use.

Then there is Project Mercury, the 2020 study Meta ran with Nielsen on what happens when people stop using its apps. Users who quit Facebook for a week reported less depression, anxiety, loneliness and social comparison. Meta shut the work down and blamed the result on an existing media narrative. Separately, Judge Yvonne Williams of the DC Superior Court found that Meta lawyers had advised employees to remove, block, button up or limit portions of internal teen mental health studies. Mosseri denied any coverup on the stand. Meta settled the next day.

What Should Compliance Teams Take From This?

Three lessons, none needing a social network. First, your discovery risk is your own research. The most damaging exhibits were studies Meta commissioned itself, and routing them through legal review became a liability rather than a shield. If you run user wellbeing or dark pattern research, decide now how it reads handed to a jury.

Second, age assurance is no longer a checkbox. A self declared birthday field has been rejected by the European Commission under the DSA, by the UK regulator under the Online Safety Act, and now by 52 American attorneys general, all inside eighteen months. Third, defaults are the regulated surface: nothing here bans a feature outright, it changes what happens when nobody touches a setting. That is the instinct behind the FTC's updated COPPA Rule, and it cannot be satisfied with a policy document. It has to be built.

What This Means for Your Accounts

The age assurance clause has a side effect worth naming. To find and remove accounts held by under 13s, Meta has to collect more identity signal from everyone, not less: document uploads, video selfies, linked contact addresses. Expect a wave of account verification mail in ordinary inboxes as the changes land within months rather than years, in Bonta's framing.

Scammers read settlement news too. A high volume of legitimate "confirm your age" mail is the cover impersonation campaigns want, because recipients stop treating the genre as unusual. Treat any emailed identity check as a credential request: open the app and read the notice there. And since the money goes to state treasuries rather than a consumer fund, any mail offering you a share of the settlement is a scam by construction.

What Can You Do Right Now?

Two audiences, two lists. If your job is regulatory exposure at a company whose product minors can reach:

• Inventory your minor facing defaults and record who signed off on each. The settlement terms are the clearest public statement of where state attorneys general now draw the line: session length, overnight availability, notification timing, autoplay, algorithmic ranking and visible engagement counts. Every one of those is a default someone chose. Assume the choice is discoverable.
• Scope user harm research on the assumption it becomes exhibit one. Project Mercury and the 1.8 percent Take a Break figure were Meta's own work product, and legal review of that research did not protect it. Before commissioning the next study, settle what question is being asked, who holds the output, how long it is retained and whether counsel's involvement is documented as advice rather than as editing.
• Check that your written children's data retention policy actually exists. Since 22 April 2026 the amended COPPA Rule requires operators to maintain one stating the purposes of collection, the specific business need and a deletion timeline, published inside the privacy notice rather than linked from it, with indefinite retention prohibited. The final rule as published in the Federal Register is the controlling text; the FTC's children's privacy business guidance is the plain reading.
• Produce the impact assessment before a regulator asks, because the clock is short. Maryland's Age Appropriate Design Code requires covered entities to prepare a data protection impact assessment for products reasonably likely to be accessed by children. The Attorney General's Division of Consumer Protection can demand a list of all such assessments within five business days and the assessments themselves within seven.
• Watch the multistate channel, not only the FTC. This case began as a joint action by 29 attorneys general, and that coordination runs through the National Association of Attorneys General. Pair it with the FTC's press release feed; the next wave will surface in one of the two before it reaches a docket.

If you are a parent, or you manage your own teenager's account:

• Set the limits yourself. A parent can already set daily time limits, scheduled breaks and notification pauses through Meta's Family Center. The settlement makes several of them defaults; the controls exist today.
• Check the birthday on the account. Age sweeps act on what the profile says, so an account created years ago with a fabricated birth year is the one most likely to be flagged or removed without warning.
• File a complaint with your attorney general. Every state runs a consumer channel; California's is the consumer complaint page. Filings like these built the 2023 case.
• Report an under 13 account. COPPA complaints go to the FTC reporting portal, and the underage data claim here rests on exactly that evidence.

What Happens Next?

Judge Gonzalez Rogers must approve the agreement before it binds. She also presides over the consolidated personal injury and school district litigation against the platforms in the same district, so these terms will be read closely by everyone still suing.

The number to watch is not $18 billion. It is whether YouTube and TikTok move. If they do, an industry wide teen default emerges from a private settlement rather than Congress, and the rule for every smaller platform is set by three companies that never had to defend it before a jury.

Sources: California Attorney General: $17 Billion Settlement with Meta; The Register: Meta's proposed $18B teen harm settlement; Washington Post: Meta to pay up to $18B over harm to children; NPR: Béjar testimony in the Meta trial; Senate Judiciary: written testimony of Arturo Béjar; FTC: Children's Online Privacy Protection Rule; FTC: $5 billion penalty on Facebook; Federal Register: Children's Online Privacy Protection Rule final amendments; Maryland General Assembly: HB 603, Age Appropriate Design Code. Settlement terms are drawn from the proposed agreement as reported on 26 August 2026 and remain subject to court approval.