Meta is paying up to 18 billion dollars to settle a massive dispute with attorneys general from 29 states, but the fine comes with a surprising concession buried in the paperwork. As part of the deal, several states have agreed never to sue Meta under existing child safety laws regarding how the company retains and uses children’s data. While this legal shield is intended specifically to allow Meta to build and test new tools for detecting underage users, critics argue it creates a risky loophole in a case that was supposed to prioritize child safety.

The core of the arrangement requires Meta to develop a system capable of identifying users under the age of 13 within a year. Under the Children’s Online Privacy Protection Act, known as COPPA, companies are generally prohibited from collecting personal information from young children without strict oversight. To avoid running afoul of these rules while building its detection model, Meta secured a promise from state officials that they would not bring past, present, or future claims related to this specific use of data. Although the agreement forbids Meta from using this information for advertising or marketing, it grants the company significant leeway in how it handles sensitive user signals.

Legal experts suggest that such protections are common when trying to ensure technical compliance, yet they warn that enforcing these boundaries will be difficult. It is notoriously hard for tech giants to completely isolate certain sets of data from their broader internal systems. There are lingering concerns that behavioral insights gathered during this process could eventually leak into other parts of Meta’s ecosystem or be repurposed for different goals. While an independent auditor will monitor the company’s progress, some lawyers worry that barring state lawsuits could disincentivize regulators from taking action if something goes wrong.

This trade off highlights a growing tension in the era of artificial intelligence, where high performing models often require vast amounts of personal data to function effectively. In this instance, Meta argues it needs deep insight into how children behave online to actually find and remove them from its platforms. However, by granting a permanent pass on certain legal challenges, regulators may have rushed into a compromise that complicates future accountability efforts should Meta step outside the narrow lines drawn in the settlement.