Meta's $18 billion deal bets on age verification tech that still fails

Meta settled on Wednesday for $18 billion to end a lawsuit filed by 29 US states over child safety, according to TechCrunch. The settlement involves a group of 52 attorneys general and requires the company to implement sweeping changes to how minors use Instagram and Facebook, without admitting wrongdoing.

The number draws attention for its scale, but TechCrunch's own reporting puts the financial impact in perspective: the amount will be paid out over 10 years, and Meta reported more than $200 billion in total revenue in 2025.

The company will pay it out over 10 years, which really softens the financial impact of the big number, especially compared to Meta's annual revenue (...) We're talking about one of those tech companies whose annual revenue is larger than the GDP of most European countries.

-- Jessica Nall, technology litigator at Withers, to TechCrunch

The central point, then, isn't the check, but what Meta will have to build: according to TechCrunch, it's the most detailed set of child safety rules a major platform has ever agreed to follow, and it rests on age verification technology that, in practice, still doesn't work very well.

What changes in the product

Under the terms of the deal, Meta proposed a list of design changes that apply by default to accounts identified as belonging to minors:

| Change | How it works by default | |---|---| | Screen time limit | 2 hours of daily app use | | Usage reminders | Alert every 15 minutes to "encourage intentional use" | | Nighttime lockout | Apps blocked between midnight and 6am | | Quiet during school hours | Notifications muted between 8am and 3pm | | Like count hidden | Teens don't see "likes" on their own posts or others' |

The detail that ties all of this together is identifying who is and isn't a minor. Without reliable age checking, none of these rules can be applied consistently.

The design changes proposed in the settlement look great on paper, but they all depend on age verification technology that's effective, successful and unbiased (...) and the way we do this today isn't really effective.

-- Dr. Alexis Ingber, professor of communication at Syracuse University, to TechCrunch

Why age verification is the bottleneck

TechCrunch describes the current state of the techniques used to estimate or verify age, each with a different flaw:

• Behavioral analysis, which examines usage patterns, can misclassify adults as minors and vice versa.
• Official ID and biometrics (like a selfie) require children and adults to hand over sensitive data to third parties just to use an app.

The privacy risk is the flip side of the coin. As Ingber sums it up, it's the classic tradeoff between safety and privacy: to keep children safe, the platform needs to collect signals that introduce new data protection concerns. And there's an aggravating factor pointed out by experts interviewed for the report: even if the company doesn't store the data, transmitting a scanned ID or facial biometrics over the internet already carries risk, and a leak of a minor's face or fingerprint opens the door to identity theft. Unlike a password, a leaked face can't be changed.

The market itself has already stumbled on this. TechCrunch notes that Discord had to delay the global rollout of age verification earlier this year after a strong user backlash.

Not everyone is pessimistic. Philip Yannella, co-chair of the data privacy and security practice group at Blank Rome, argues it's possible to verify age without keeping personal data:

There are ways to verify someone's age, create a token that signals that this IP is associated with someone under 13, under 16, whatever it is, but discard the personal information.

-- Philip Yannella, Blank Rome, to TechCrunch

Why this matters for those building software in Brazil

Although the settlement is with American attorneys general, the effect is global: the design changes described apply to the product, and Instagram and Facebook serve a huge base of Brazilian users. If the default settings for teenagers change, they change for teenagers here too.

For those working on social products, media, or any platform that engages young users, the case adds a concrete data point to the compliance debate:

• Age verification stops being a "yes, I'm an adult" button. The reference to biometrics, ID documents and behavioral analysis signals that robust checking is becoming a regulatory expectation, not a differentiator.
• Data architecture becomes a legal decision. The distinction Yannella draws, verify and discard versus verify and store, is exactly the kind of choice engineering teams will have to document. In the Brazilian context, this connects directly to the minimization and purpose limitation principles of the LGPD, Brazil's data protection law, although the report doesn't address the Brazilian case.
• Default settings carry weight. All the guardrails in the settlement (screen time, nighttime lockout, hidden likes) apply by default. For product designers, the takeaway is that the default is what actually protects, not the option buried in settings.

What remains open

Two points go unanswered in the report. The first is legal: by settling, Meta avoided a trial that could have produced a ruling on Section 230 and the First Amendment, protections that shield platforms from liability for what users post. Nall describes the risk of a loss as potentially "existential," not just for Meta but for practically every company whose product interacts with users. That debate remains open.

The second is competitive. According to TechCrunch, Meta is running full-page newspaper ads asking TikTok and YouTube to adopt similar changes, without mentioning that its own adoption came from a legal settlement. And it's not just rhetoric: about 30% of the settlement payment depends on TikTok and YouTube also complying with these guidelines, which Meta will have to follow for the next 10 years.

For Ingber, beyond the technical detail, the case signals a cultural shift: "Meta has extraordinary power to create norms through platform design. If you change the way the platform is designed, you can establish new norms." The question that remains is whether those norms can be met without verification technology that, today, experts themselves classify as flawed.