Meta has agreed to pay up to $17 billion to settle claims brought by almost all US states over the way Facebook and Instagram were designed and marketed to children and teenagers.
The number is big but what is most significant is what Meta has agreed to change.
The settlement requires changes to the design and operation of its platforms, including limits on teenagers’ use, nighttime access restrictions, stronger age-assurance measures, changes to notifications, greater controls over personalised feeds and restrictions on certain features.
This points towards a regulatory environment in which privacy, online safety, consumer protection, AI governance and product design are increasingly converging.
Not just another privacy fine
The settlement includes approximately $459 million to resolve privacy claims connected to the Cambridge Analytica scandal, in which personal data relating to millions of Facebook users was collected without authorisation.
The wider settlement is focused on the argument that Meta’s platforms were designed in ways that encouraged excessive engagement and exposed children to foreseeable risks.
The states alleged that Meta knowingly collected personal information from children without the required parental consent and used children’s data in connection with its generative AI systems. But the case went further, focusing on the architecture and functionality of the platforms themselves.
The distinction is important. Traditional privacy compliance asks questions such as: What personal data are we collecting? Why are we collecting it? What is our lawful basis? How long will we retain it? Who do we share it with?
Those questions are still important but now regulators and legislators are asking what the product does to the person using it.
The remedy?
Meta has agreed that teenagers will face limits on how long they can use Facebook and Instagram. Access will be restricted overnight unless a parent overrides the restriction. Notifications will be reduced during sleeping and school hours. Age-assurance measures will be strengthened. Certain features, including beauty filters, will be restricted. Users will have greater ability to move away from personalised algorithmic feeds.
These are not changes to a privacy policy, they are product-design decisions.
For businesses, that is the big takeaway here.
A company cannot necessarily solve a foreseeable risk by adding another paragraph to its privacy notice or obtaining another consent. If the problem is created by the design of the product, the solution may have to be built into the product too.
For privacy professionals, this is a big change. Privacy and other risks have to be considered before the feature is designed and deployed.
The EU is already there
The EU’s regulatory model increasingly places responsibility on large digital platforms to identify and mitigate systemic risks arising from their services.
Under the Digital Services Act (DSA), very large online platforms face obligations concerning systemic risks, including risks relating to the protection of minors. The European Commission has already scrutinised Meta’s approach to potentially addictive features and the protection of young users.
It’s not just about whether a company has obtained valid consent. The DSA is concerned with the effects of the platform itself. And the EU is increasingly expecting businesses to demonstrate that they have considered risk by design, rather than waiting until harm has occurred.
The same thinking is visible in the EU AI Act. Depending on the system and its use, the Act imposes requirements around risk management, transparency, human oversight, data governance and the mitigation of foreseeable risks.
It’s a similar principle of identifying the risk and building appropriate safeguards into the system.
For businesses developing or deploying AI, that means risk assessment cannot be something that happens after the technology has already been embedded into a product or business process. Risk needs to be considered at the point of design.
And the UK?
UK businesses should not assume that the Meta settlement has little relevance to them.
The UK’s Online Safety Act places duties on regulated online services to manage risks to users, with particular protections for children.
The UK’s data protection framework is also evolving. The Data (Use and Access) Act 2025 has amended elements of the UK GDPR and Data Protection Act 2018, while the ICO continues to emphasise accountability, children’s privacy and responsible use of emerging technologies.
A product that creates risks for children could potentially raise questions across data protection, online safety, consumer protection and AI regulation.
Privacy by design
Privacy by design requires privacy and data protection to be considered throughout the development process. And the regulatory landscape is stretching that concept to risk by design.
A traditional privacy review for a company introducing a new AI-powered recommendation feature might ask whether the organisation has a lawful basis for processing the relevant data, whether the privacy notice is adequate and whether the data minimisation principle has been satisfied.
But a modern assessment should also ask whether the recommendation system could manipulate users, disproportionately affect vulnerable people, expose children to inappropriate material, reinforce harmful patterns or encourage excessive engagement.
And those risks will not be solved by changing the privacy notice.
They may require changing the algorithm, introducing friction, limiting functionality, adding human oversight or giving users meaningful control.
Is it just about big tech?
It would be easy to dismiss the $17b number as just another huge Big Tech settlement.
Of course, Meta’s 2025 net income was approximately $60.5 billion, so even this multibillion-dollar settlement is not going to have that big an impact on the company.
But businesses cannot only focus on the amount. Meta has committed to changes that could affect how its products are designed, how users interact with them and how the company measures engagement.
There is also the possibility that the settlement will influence the hundreds or thousands of other cases and regulatory actions involving social media platforms.
And the agreement includes a condition that around $5 billion of the potential settlement is contingent on other major platforms adopting comparable protections.
That means this could become an industry benchmark.
Where does compliance fit in?
The regulatory expectation is moving towards compliance being embedded in product development rather than tacked on afterwards. A new feature should not reach the final approval stage before anyone asks what risks it creates.
Why was the feature designed this way? What risks were identified? What evidence was considered? What alternatives were rejected? What safeguards were introduced? How will the organisation know whether those safeguards are working?
Those questions create an evidence trail that can become important when regulators, courts or customers later ask what the organisation knew and when it knew it.
Most businesses will never face a $17b penalty. But they should pay attention to what sits behind it.
This case is about where responsibility for risk sits. Increasingly, regulators are looking beyond policies and processes to the products themselves and asking whether foreseeable harm was designed out from the start.
That means privacy and compliance professionals need to be in the room earlier, working with product, technology and business teams rather than reviewing decisions once they have already been made.
And when questions are asked later, organisations will need to show not just what they decided, but how they identified the risks, what they considered and why they believed their safeguards were sufficient.
Meta’s settlement indicates that the future of compliance is increasingly about designing risk out, not explaining it after the fact.
